Legal

Terms of service

Version 1.0, 16 October 2026

Replaces the terms of 4 October 2026.

The Data Processing Agreement forms part of these Terms.

These Terms are the contract between Caspian BV and the business that uses Caspian. Please read them before you click "Continue". This version stays available at getcaspian.io/terms, and you can print it or save it as a PDF from your browser.

1. Who we are and who these Terms are for

1.1 Caspian. Caspian BV, Brusselsesteenweg 6 bus 104, 9050 Gent, Belgium, enterprise number (KBO) 1042.322.507, VAT BE 1042.322.507, hello@getcaspian.io ("Caspian", "we").

1.2 Customer. The company or other business that creates or uses a Caspian workspace ("Customer", "you"). The person who clicks "Continue" confirms that they act for that business and may bind it. If they may not, they must not click.

1.3 Businesses only. Caspian offers the Services only to businesses, for their business purposes. The Services are not for consumers. We may close a workspace that is not used by a business.

1.4 How the contract is made. The contract is made when a person from the Customer clicks "Continue" at sign-in under the statement that they agree to these Terms. Using the Services without that click is not acceptance. We record the time of acceptance, the user, the workspace and the version of the DPA that was accepted. These Terms apply in the version published on that date.

1.5 Signed agreements come first. If the Customer has signed a separate agreement or order form with Caspian for the same workspace, that document applies where it differs from these Terms.

2. Definitions

"Active Person": a person who, at any time in a calendar month, has an active account in the identity provider that the Customer connected to Caspian and is covered by a paid module. For Devices, a person with at least one enrolled device. Admins are not counted. A leaver stops counting from the month after their account is suspended or deleted.
"Admin": a user with the Owner or Admin role in a workspace.
"AI Features": the features that use AI models, listed in DPA section 15.1.
"Customer Data": all data the Customer, its users or its connected systems put into or make available to the Services, including Customer Personal Data. Usage Data is not Customer Data.
"Customer Personal Data" and "Sub-processor": as defined in the DPA.
"Distributed Software": the Caspian software we let the Customer install: the browser extension, the device agents for macOS and Windows, the Microsoft Teams and Slack apps, the connectors for AI clients (MCP), and their updates.
"Documentation": the help pages, guides and the Trust Center that describe the Services.
"DPA": the Caspian Data Processing Agreement at getcaspian.io/dpa, or a DPA the Customer signed with Caspian.
"Modules": Software, Devices, Automate and Everything, described in section 3.
"Services": the Caspian web application at app.getcaspian.io, the Distributed Software, the Set-up Templates, the AI Features, the Documentation and support.
"Set-up Templates": the templates and scripts we provide so the Customer can create, in its own AWS, Google Cloud or Azure account, the storage for a workspace with customer-hosted data (DPA Part 2B).
"Usage Data": technical data about how the Services run and are used (for example error logs, performance figures and which features are used), not the content of Customer Data.

3. The Services and the Modules

3.1 What Caspian does. Caspian helps IT teams see the software, AI tools, access and devices of their organisation, set policies over them, and act on them with the people involved. The Documentation describes the features.

3.2 Modules.

Software (free): a read-only view of every app and AI tool found, and who has access.
Devices: management of the Customer's laptops.
Automate: joiner, mover and leaver workflows, including apps without an API, run after the Customer approves them.
Everything: all Modules that are live when the Customer subscribes to Everything.

3.3 New capabilities. We add new capabilities either to an existing Module or as a new Module with its own price. "Everything" covers the Modules live at the time the Customer subscribes to it. The Customer may add new Modules when they appear.

3.4 Trials. Each paid Module has a free trial of 30 days. No payment card is needed. The trial starts when the Module is live in the workspace, not when the account is created. When a trial ends without a paid plan, nothing is deleted: the Module pauses (for Devices, enrolled devices stay enrolled but management stops) until the Customer chooses a plan or ends the Agreement.

3.5 Changes to the Services. We improve the Services all the time. We will not remove a feature that is a material part of a paid Module the Customer uses, unless we give at least 60 days' notice, or the change is needed for security or by law. If such a change materially reduces a paid Module, the Customer may end that Module at once without paying for the rest of the month.

3.6 Third-party services. The Services connect to services the Customer chooses, such as Google Workspace, Microsoft Entra, Okta, Slack, Microsoft Teams, Apple Business Manager and the apps the Customer manages. Those services have their own terms, which the Customer accepts with their providers. We are not responsible for their availability, their changes or their data. What we can do depends on the access the Customer grants them.

3.7 Google data. Caspian's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Fees and payment

4.1 Prices. The prices are on getcaspian.io/pricing on the day the Customer subscribes: Software is free; Devices EUR 4, Automate EUR 8 and Everything EUR 10, per Active Person per month, excluding VAT. Admins are unlimited. There is no minimum. The prices as they stood on that day apply, subject to section 4.5.

4.2 Billing. We invoice monthly in arrears, for the Active Persons of the previous month. Invoices are due within 30 days. There is no annual plan and no prepayment.

4.3 Late payment. If an invoice is unpaid on the due date, the statutory interest and compensation for late payment between businesses apply (Wet van 2 augustus 2002). We may suspend paid Modules only under section 10.1(c).

4.4 Taxes. Prices exclude VAT and other taxes, which the Customer pays where the law requires.

4.5 Price changes. Launch pricing: the price of a Module stays the same for 12 months from the date the Customer first subscribes to it. After those 12 months we may change prices with at least 60 days' notice by email to the Owners. If the Customer does not accept the new price, it may end the Agreement or the Module before the new price applies, without any cost.

5. Your workspace and users

5.1 Accounts. Users sign in with the Customer's Google or Microsoft account. The Customer decides who uses the workspace and with which role, and keeps its sign-in accounts secure. The Customer tells us without delay at security@getcaspian.io if it suspects unauthorised access.

5.2 Responsibility for users. The Customer is responsible for what its users do in the Services, as if it did it itself.

5.3 Authority over connected systems. The Customer connects only systems it is allowed to connect, and gives only instructions it is allowed to give. An action Caspian takes in a connected system (for example removing access, locking a device or running a workflow) is taken on the Customer's instruction, as recorded in the audit log (DPA section 15.4(e)).

5.4 People at work. Caspian processes data about the Customer's employees and contractors. The Customer, as employer and controller, is responsible for informing them and, where the law requires, its works council or employee representatives, before it uses features that observe how people use software or devices.

5.5 Notices. The Customer accepts the email addresses of its Owners and in-app messages as the channel for notices from us, and keeps at least one Owner email address up to date. Notices to Caspian go to hello@getcaspian.io, or for security matters to security@getcaspian.io.

6. Licence and restrictions

6.1 Your right to use the Services. During the Agreement, Caspian gives the Customer a non-exclusive, non-transferable right, without the right to sublicense, for its users to use the Services for the Customer's internal business purposes, in line with these Terms and the Documentation.

6.2 Distributed Software. The Customer may install and run the Distributed Software only on devices and browsers it owns or controls, and only to use the Services. The Distributed Software may update itself. Its right to use the Distributed Software ends when the Agreement ends; the Customer then removes it.

6.3 Set-up Templates. The Customer may run, copy and adjust the Set-up Templates only to create and operate storage for its own Caspian workspace. It may not use them for any other purpose or give them to others, except to its own IT service providers who help it under a duty of confidentiality.

6.4 Restrictions. The Customer will not, and will not let anyone else:

(a) decompile, disassemble or reverse engineer the Services, including the web application, the browser extension and the device agents, or try to discover their source code, models or underlying algorithms, except to the extent the law expressly allows it. This includes the rights of a lawful user to make a backup copy, to observe, study and test the software while using it normally, and to decompile it where that is indispensable for interoperability, under the conditions of articles XI.299 §§2-3 and XI.300 of the Belgian Code of Economic Law (Wetboek van economisch recht). Before decompiling for interoperability, the Customer first asks us for the information it needs; we answer within 30 days;
(b) copy, modify or make derivative works of the Services, except as section 6.3 allows or the law expressly allows;
(c) sell, rent, lend, sublicense or otherwise make the Services available to third parties, or use them to run a service for others;
(d) use the Services or Caspian's Confidential Information to build a competing product, or copy their features, design or texts for that purpose;
(e) remove or change any notice of rights, or circumvent any security or usage limit of the Services;
(f) test the security of the Services, including penetration tests and load tests, without our prior written consent. We give it for reasonable requests;
(g) access the Services by automated means other than the interfaces we document, or scrape them;
(h) break the acceptable use rules in section 7.

6.5 Open source. Some parts of the Distributed Software are open source software under their own licences. Nothing in these Terms limits the Customer's rights under those licences.

6.6 No other rights. Caspian keeps all rights in the Services and in all improvements, whether made before or after the Agreement. The Customer gets only the rights expressly given in these Terms.

7. Acceptable use

7.1 The Customer will use the Services lawfully and will not:

(a) access another organisation's data, or a connected system, without permission;
(b) misuse integration credentials or share them with people who may not have them;
(c) send or store malicious code, or content that is unlawful or infringes others' rights;
(d) interfere with the Services, their providers or other customers;
(e) use the AI Features for a practice the EU AI Act forbids, in particular to infer the emotions of people at work;
(f) use the Services, including the AI Features, to evaluate, rank, monitor or discipline individual workers, or to decide on hiring, promotion or dismissal. The intended purpose of the Services is IT administration: knowing and governing software, access and devices, coaching people on IT policies, and handling access requests. Caspian has not designed the Services as a high-risk AI system and the Customer will not change their purpose into one;
(g) hide or remove the notices that tell people they are talking to an AI system;
(h) install the Distributed Software on devices the Customer does not own or control, or use device management on personal devices.

7.2 Any action that affects a connected system must be authorised by the organisation that controls that system.

8. Customer Data, privacy and security

8.1 The Customer's data stays the Customer's. As between the parties, the Customer keeps all rights in Customer Data. The Customer gives Caspian the right to use Customer Data only to provide, secure and support the Services for the Customer, as the DPA describes.

8.2 The DPA is part of these Terms. The DPA forms part of these Terms and applies whenever Caspian processes personal data for the Customer. For anything about personal data, the DPA prevails over these Terms.

8.3 No training, no selling. Caspian does not use Customer Data, prompts or outputs to train or improve AI models, does not use Customer Data for advertising or benchmarking, and does not sell it (DPA sections 3.3 and 15.2).

8.4 Anonymous catalogue and statistics. Caspian may build a shared software catalogue (names, domains and vendors of applications, with no information about people) and statistics where at least five customers contribute to each figure, exactly as DPA section 3.4 describes. That data is anonymous and belongs to Caspian. For a workspace with customer-hosted data, an Owner can switch off contributions to the catalogue.

8.5 Usage Data. Caspian may use Usage Data to run, secure, support and improve the Services. Caspian does not disclose Usage Data outside Caspian unless it is aggregated so that it does not identify the Customer or any person.

8.6 Security. Caspian protects Customer Data with the measures in DPA Annex II and tells the Customer of a personal data breach as DPA section 10 sets out.

8.7 Government access. If a public authority outside the EU asks Caspian for Customer Data that is not personal data, Caspian follows the same steps as for personal data in DPA section 14.6: it tells the Customer promptly unless the law prohibits it, challenges a request it reasonably considers unlawful, including under EU law, and discloses no more than the request requires. Where Caspian stores and processes data is set out in the DPA (Annex I, part K, and Annex III).

8.8 Customer responsibility. The Customer is responsible for the lawfulness, accuracy and content of Customer Data and for its instructions. Information in the Services depends on what the connected sources supply. An unknown activity date is not proof of inactivity. The Customer reviews the source evidence before it takes access, security or licensing decisions.

9. AI Features

9.1 How they run. The AI Features run on Amazon Bedrock through EU inference profiles or in the AWS Frankfurt region, as DPA section 15 describes. Caspian does not train models on Customer Data, prompts or outputs.

9.2 Outputs. As between the parties, the Customer owns the outputs the AI Features produce for it. AI outputs can be wrong or incomplete. The Customer checks an output before it relies on it for a decision that matters.

9.3 Approvals. Actions with high risk run only after an authorised user approves them, as DPA section 15.4 describes. The Customer is responsible for the approvals and standing permissions its users and Owners give.

9.4 AI literacy. As the deployer, the Customer takes measures so that the people who use the AI Features understand them well enough, using the Documentation.

9.5 Changing models. Caspian may change the AI models it uses, within the limits of DPA section 15.

10. Suspension

10.1 Caspian may suspend all or part of the Services for the Customer only:

(a) if this is needed to stop a serious and immediate risk to the security or integrity of the Services, of other customers or of the Customer's own systems;
(b) if the Customer seriously breaches sections 6.4 or 7, or the law requires it;
(c) for paid Modules, if an invoice is unpaid 14 days after we sent a written reminder.

10.2 We suspend only as much and for as long as needed. We tell the Customer before we suspend, and give a reasonable time to fix the problem, unless the urgency of the risk does not allow it; then we tell the Customer as soon as possible after. We restore the Services as soon as the reason has gone.

10.3 During a suspension the Customer can still export its data (section 12.2), unless the suspension is under section 10.1(a) and the export itself would continue the risk.

11. Confidentiality

11.1 Confidential Information means all non-public information a party receives from the other in connection with the Agreement that is marked as confidential or that a careful business would understand to be confidential. Caspian's Confidential Information includes the non-public parts of the Services: their source code, models, prompts, detection rules, catalogue scoring, security design and roadmap, and the Set-up Templates. The Customer's Confidential Information includes Customer Data.

11.2 The receiving party uses Confidential Information only for the Agreement, protects it with at least the care it uses for its own confidential information (and never less than reasonable care), and shares it only with its employees, auxiliaries and advisers who need it for the Agreement and are bound by confidentiality duties at least as strict.

11.3 This section does not apply to information that is or becomes public without fault of the receiving party, that the receiving party already had or developed independently, or that it lawfully received from a third party without a duty of confidence. A party may disclose Confidential Information where the law or a court requires it, after telling the other party where allowed.

11.4 Both parties treat their Confidential Information as trade secrets within the meaning of Book XI, Title 8/1, of the Code of Economic Law where it qualifies. The restrictions in section 6.4 are a duty to limit the acquisition of Caspian's trade secrets.

11.5 These duties last during the Agreement and for 5 years after it ends; for trade secrets, as long as they remain trade secrets. Customer Personal Data is governed by the DPA.

12. Term, termination and leaving Caspian

12.1 Term. The Agreement runs for an indefinite period from acceptance, month by month.

12.2 Ending by the Customer. The Customer may end the Agreement, or any paid Module, at any time by email to hello@getcaspian.io from an Owner's address. It ends at the end of the calendar month in which the Customer gives notice. There is no termination fee.

12.3 Ending by Caspian. Caspian may end the Agreement with at least 60 days' notice for a workspace with a paid Module, and at least 30 days' notice for a workspace on the free Module only.

12.4 Ending for breach. Either party may end the Agreement by written notice that names the breach if the other party seriously breaches it and does not fix the breach within 30 days of written notice. The parties agree that these are serious breaches: non-payment of an invoice 30 days after a written reminder; a breach of sections 6.4, 7 or 11; and a material breach of the DPA. The Customer's other rights under the law and the DPA (including DPA section 18.3) remain.

12.5 Effect of ending. When the Agreement ends, the Customer's right to use the Services ends, it removes the Distributed Software, and it pays for the months already used. Months already paid are not refunded, except where these Terms or the DPA say otherwise. Sections 6.4, 8, 11, 12, 13 to 16 survive.

12.6 Leaving Caspian (switching and export).

(a) Export at any time. During the Agreement, an Owner or Admin can export all Customer Data of the workspace in one click from Settings → Data & Privacy: a ZIP of CSV files with the uploaded files and a description of each file (secrets and credentials are left out).
(b) Switching. The Customer may ask, with notice of at most two months, to move its data to another provider or to its own systems, or to have it deleted. During a transition period of up to 30 days after the notice period, Caspian keeps the Services running, helps the Customer and its new provider in good faith with the export, and tells the Customer of any known risk to continuity. If 30 days is technically not possible, Caspian says so within 14 working days with the reasons, and the transition can last up to 7 months. The Customer may extend the transition period once.
(c) Export Period and deletion. After the Agreement ends, the Customer can still export its data for 30 days (the Export Period). Caspian then deletes Customer Data within 30 days (by day 60), and it is gone from backups by day 95, with a written deletion certificate, as DPA section 12 sets out.
(d) What is not exported. Caspian's own internal data is not exported, because it holds Caspian's trade secrets: catalogue scoring and detection models, prompts, and the anonymous cross-customer catalogue and statistics.
(e) Free of charge. Export, switching help and deletion are free.

13. Warranties

13.1 Caspian provides the Services with the care and skill of a careful professional provider of similar services, and the Services perform materially as described in the Documentation. This is an obligation of means (inspanningsverbintenis), not a promise that the Services will always be available, error-free or uninterrupted.

13.2 If the Services do not perform as section 13.1 says, the Customer tells us, and we fix the problem within a reasonable time. If we cannot, the Customer may end the affected Module at once and pay nothing for the month of the problem. This does not limit the Customer's other rights under section 14 and the law.

13.3 Free Modules, trials and features marked as preview or beta are provided as they are, without the commitments in sections 13.1 and 13.2, but sections 14.3 and 14.4 still apply to them.

13.4 Each party confirms it may enter into the Agreement. Apart from this section, neither party gives any other guarantee, to the extent the law allows.

14. Liability

14.1 General cap. Each party's total liability under or in connection with the Agreement is limited to the higher of (a) the fees the Customer paid or must pay for the Services in the 12 months before the event that caused the claim, and (b) EUR 25,000.

14.2 Higher cap. For claims for breach of section 11 (confidentiality) and for claims under section 15 (claims by third parties), the cap is the higher of (a) three times the fees in section 14.1(a) and (b) EUR 100,000.

14.3 Free Modules and trials. For a workspace that has paid no fees in the 12 months before the event, Caspian's total liability is limited to EUR 2,500, except as sections 14.4 and 14.6 provide.

14.4 Not limited. No cap and no exclusion applies to:

(a) wilful misconduct (opzet) or fraud of a party or of a person for whom it is responsible;
(b) gross fault (zware fout) of a party or of a person for whom it is responsible;
(c) harm to the life or the physical or psychological integrity of a person;
(d) the Customer's duty to pay the fees;
(e) any liability that the law does not allow to be limited.

14.5 Indirect loss. Neither party is liable for indirect loss, such as lost profit, lost revenue, lost savings, loss of goodwill or business interruption, except in the cases of section 14.4(a) to (c). The reasonable costs of restoring lost or damaged Customer Data, and the legally required costs of notification and forensic investigation of a breach, are direct loss.

14.6 Personal data. For claims under the DPA and data protection law, DPA section 16 applies instead of sections 14.1 to 14.3 and 14.5. The two caps are never added together.

14.7 Core promises. Nothing in this section empties Caspian's essential obligations: giving access to the Services, protecting Customer Data, keeping it confidential and returning it at the end.

14.8 Time limit. A claim must be brought within 2 years after the party became aware, or should reasonably have become aware, of the facts giving rise to it, except in the cases of section 14.4(a) to (c).

14.9 This section also protects each party's employees and auxiliaries, except in the cases of section 14.4(a) to (c).

15. Claims by third parties

15.1 Caspian. If a third party claims that the Services, used in line with these Terms, infringe its intellectual property rights, Caspian defends the Customer against the claim at its cost and pays the amounts a court finally awards or that Caspian agrees in a settlement. If needed, Caspian may get the right for the Customer to continue, change the Services so they no longer infringe, or end the affected Service and refund the fees paid for the period after it ends. This does not apply to claims caused by Customer Data, by a combination with something Caspian did not provide, or by a use that breaks these Terms.

15.2 Customer. If a third party claims against Caspian because Customer Data infringes its rights, or because of the Customer's breach of sections 6.4 or 7, the Customer defends Caspian and pays the amounts a court finally awards or that the Customer agrees in a settlement.

15.3 Procedure. The party asking for defence tells the other promptly in writing, lets it control the defence and any settlement, and helps reasonably at its cost. No settlement may admit fault of the protected party without its consent.

15.4 Neither party covers the other for administrative fines (DPA section 16.6).

16. Other terms

16.1 Force majeure. Neither party is liable for a delay or failure caused by an event beyond its reasonable control that it could not reasonably have foreseen or avoided, such as a failure of the electricity grid or the internet, a major outage of a cloud provider Caspian relies on, war, or an act of a public authority. A failure of Caspian's own security measures is not force majeure. The affected party tells the other promptly. If the event stops the Services for more than 30 days in a row, either party may end the Agreement. Payment duties for months already used remain.

16.2 Changes to these Terms. Caspian may change these Terms only for one of these reasons: a change in the law or in a regulator's or court's guidance; a change in the Services, Modules or prices allowed by sections 3.5 and 4.5; security; a change in a third-party service the Services depend on; or to make the Terms clearer. Caspian gives at least 30 days' notice by email to the Owners and in the app, with a summary of the change and the reason. If a change is to the Customer's disadvantage, the Customer may end the Agreement before the change takes effect, without cost. A change takes effect for a Customer when an Owner or Admin accepts it in the app or, if no one has accepted it, at the end of the notice period unless the Customer has ended the Agreement before then. A change needed for security or by law may take effect sooner if it must. Changes to the DPA follow DPA section 20.

16.3 Assignment. Neither party may transfer the Agreement without the other's written consent, except to a successor in a merger, demerger or sale of all or most of its business, after notice. Caspian may use subcontractors; for personal data, the DPA rules on Sub-processors apply. Caspian remains responsible for its subcontractors.

16.4 Publicity. Caspian may name the Customer as a customer, or use its logo, only with the Customer's prior consent.

16.5 Hardship. Each party bears the risk of a change of circumstances; article 5.74 of the Civil Code does not apply. Price changes follow section 4.5.

16.6 Whole agreement and order of documents. The Agreement consists of these Terms, the DPA and any signed agreement or order form. If they conflict: (1) a signed agreement or order form, (2) the DPA for anything about personal data, (3) these Terms, (4) the Documentation.

16.7 Severability. If a clause is void or unenforceable, the rest stays in force. The parties replace the clause with a valid one that comes closest to its purpose.

16.8 No waiver. Not using a right is not a waiver of it.

16.9 Evidence. The parties accept electronic records, including the acceptance record in section 1.4, the audit log and emails, as evidence. Each party may prove the contrary.

16.10 Language. These Terms are in English. If we provide a translation, the English text prevails.

16.11 Governing law. Belgian law governs the Agreement. The UN Convention on Contracts for the International Sale of Goods (CISG) does not apply.

16.12 Courts. The courts of Gent, Belgium (for the ondernemingsrechtbank: the Gent division) have exclusive jurisdiction. Either party may still ask any competent court for urgent or provisional measures to protect its intellectual property, trade secrets or Confidential Information.

17. About these Terms

17.1 The previous version, of 4 October 2026, is available at getcaspian.io/terms/2026-10-04.

17.2 These Terms are adapted from the Common Paper Cloud Service Agreement (Version 2.1) and Common Paper Terms of Service (Version 2.1), free to use under CC BY 4.0, and from the Bonterms AI Addendum (Version 2), free to use under CC BY 4.0 (creativecommons.org/licenses/by/4.0). Caspian has modified them, including for Belgian law. Common Paper and Bonterms are not parties to, and do not endorse, these Terms.

Caspian BV · Brusselsesteenweg 6 bus 104, 9050 Gent, Belgium · KBO 1042.322.507 · hello@getcaspian.io