Terms of Service

By accessing or using the AllegoryOS platform (the "Platform") or any related services, or by executing a Statement of Work with Allegory, you ("Client," "you," or "your") acknowledge that you have read, understood, and agree to be bound by these Terms, together with our Privacy Policy at allegoryos.com/privacy-policy.

If you are accessing or using the Platform on behalf of a corporation, partnership, or other legal entity, you represent and warrant that:

• you have full legal authority to bind that entity to these Terms
• these Terms are enforceable against that entity
• all references to "you" and "Client" in these Terms refer to that entity

Where the Client has executed a Statement of Work with Allegory, the Statement of Work supplements these Terms and, in the event of conflict with respect to the specific engagement it governs, supersedes these Terms. These Terms govern all access to and use of the Platform not expressly addressed in an applicable Statement of Work.

2.1 What AllegoryOS Is

AllegoryOS is a managed cloud infrastructure and software platform purpose-built for insurance operations. AllegoryOS provides insurance carriers, managing general agents, and underwriting teams with configurable environments for:

Quote Management

End-to-end quoting workflows from submission intake to rated quote output

Product and Pricing Administration

Rating engine configuration and pricing logic embedded within the Platform

Document Generation

Automated generation of quote documents, deck pages, bordereau outputs, and other insurance workflow documents from structured data

AI-Assisted Underwriting Workflows

Document parsing, data extraction, and field pre-population using artificial intelligence, subject to mandatory human review as described in Section 8

Managed Infrastructure

Dedicated, secure, and Canadian-data-resident cloud environments operated by Allegory on behalf of clients

2.2 What AllegoryOS Is Not

All insurance decisions — including underwriting determinations, coverage selections, pricing approvals, policy issuances, and claims decisions — are the sole responsibility of the Client and its licensed personnel. AllegoryOS generates outputs that assist human decision-making. It does not make binding decisions of any kind. See Section 8.4.

Clients are solely responsible for ensuring that their use of the Platform and any outputs it generates complies with all applicable laws and regulatory requirements, including requirements of applicable insurance regulators and any relevant reinsurance or syndicate standards.

2.3 Specific Engagement Scope

The specific services, deliverables, and features available to any given Client are governed by the applicable Statement of Work. Not all Platform capabilities described in these Terms are available to all Clients. Capabilities are configured per engagement based on agreed Statement of Work scope.

3.1 Organizational Clients

AllegoryOS is an enterprise platform. Access is available only to organizations — including corporations, partnerships, and other legal entities — operating in the Canadian insurance market. We do not currently offer Platform services to individuals acting in a personal or consumer capacity, or to organizations operating outside Canada.

3.2 Authorized Representatives

By accepting these Terms or executing a Statement of Work, you represent and warrant that:

• your organization has full legal capacity to enter into binding agreements
• you have full authority to bind your organization to these Terms and any applicable Statement of Work
• your organization's use of the Platform will comply with all applicable laws and regulations, including Canadian privacy law, applicable insurance regulatory requirements, and any relevant reinsurance or syndicate standards
• all information provided to Allegory in connection with the engagement is accurate and complete

3.3 Regulatory Standing

Clients that are regulated insurance entities represent and warrant that they hold all licences, registrations, and approvals required to carry on their insurance operations, and that their use of AllegoryOS does not violate any term or condition of those licences or any regulatory order to which they are subject.

4.1 Client Environments

Access to AllegoryOS is provided through a dedicated Client Environment provisioned and maintained by Allegory pursuant to the applicable Statement of Work. Each Client Environment is:

• Logically isolated from all other client environments within the Platform by a unique enterprise identifier; no Client Data processed within one Client Environment is accessible to or processable by any other client environment
• Hosted in the AWS ca-central-1 (Canada) region to maintain Canadian data residency for all stored Client Data
• Configured with dedicated data storage, authentication infrastructure, document processing infrastructure, and communication services
• Accessible via a designated subdomain of allegoryos.com

Client Environments are not self-service. Allegory provisions, configures, and maintains the Client Environment on the Client's behalf. The Client does not manage, administer, or access the underlying infrastructure layer directly.

4.2 User Account Provisioning

User accounts within the Client Environment are provisioned and deprovisioned by Allegory on the Client's written request. There is no self-service user registration for Client Environments. The Client is responsible for:

• notifying Allegory promptly when a user's access should be provisioned or revoked
• ensuring that access requests are made only for personnel who require it for the purposes of the engagement
• ensuring that all provisioned users are informed of and comply with the acceptable use requirements in Section 6 of these Terms

4.3 Authentication

All Platform access is authenticated via AWS Cognito. Multi-factor authentication (MFA) is supported and enforced for all platform access, including TOTP (authenticator application) and SMS one-time passcode options. The Client is responsible for ensuring that its users maintain appropriate credential security and notify Allegory immediately of any suspected unauthorized access to the Client Environment.

4.4 Account Security Responsibilities

The Client is responsible for:

• maintaining the confidentiality of all account credentials issued to its personnel
• all activity that occurs within the Client Environment under provisioned user accounts, whether or not authorized by the Client
• notifying Allegory immediately upon becoming aware of any actual or suspected unauthorized access to the Client Environment or any credential compromise
• ensuring that user accounts are not shared between individuals

5.1 Engagement Governance

Each client engagement is governed by a written Statement of Work (SOW) executed by authorized representatives of both Allegory and the Client. The SOW sets out the specific services to be delivered, deliverables, acceptance criteria, commercial terms, data handling obligations, and any engagement-specific governance requirements.

These Terms govern access to and use of the Platform generally. Where an applicable SOW addresses a matter expressly, the SOW governs for that engagement. In the event of any conflict between these Terms and an applicable SOW, the SOW prevails with respect to the specific engagement it governs.

5.2 Scope Changes

The scope of any engagement is as described in the applicable SOW. Changes to scope, timelines, or commercial terms require a written Change Order executed by authorized representatives of both parties. No change is effective unless documented in a signed Change Order.

5.3 Delivery Obligations

Allegory's delivery obligations — including timelines, acceptance criteria, and remediation processes — are as set out in the applicable SOW. General commitments in these Terms apply to the extent not addressed by the applicable SOW.

5.4 Multiple Engagements

Where a Client has executed multiple SOWs with Allegory, each SOW governs its respective engagement independently. Unless the SOWs expressly state otherwise, obligations and liabilities under one SOW are independent of obligations and liabilities under any other SOW.

By accessing and using AllegoryOS, you agree not to engage in any of the following:

6.1 Unlawful and Fraudulent Activity

• Use the Platform for any unlawful purpose or in violation of any applicable law or regulation, including applicable insurance laws and Canadian privacy law
• Submit fraudulent, altered, or unauthorized documents or data to the Platform
• Misrepresent your identity, your organization's identity, or your authority to access or use the Platform
• Use the Platform to facilitate insurance fraud, material misrepresentation, or any criminal activity

6.2 System Abuse

• Attempt to gain unauthorized access to any component of the Platform, any other Client Environment, or any underlying infrastructure layer
• Upload or transmit files containing viruses, malware, ransomware, or any other malicious or harmful code
• Scrape, crawl, mirror, or systematically extract data from the Platform without Allegory's prior written authorization
• Use automated tools, bots, or scripts to access or interact with the Platform without Allegory's prior written consent
• Conduct load testing, penetration testing, or security assessments of the Platform without Allegory's prior written consent and co-ordination
• Overload, disrupt, or degrade Platform infrastructure or the infrastructure supporting any other Client Environment

6.3 AI Misuse

• Use prompt injection, adversarial inputs, or other techniques to manipulate, deceive, or circumvent AI controls or safety measures within the Platform
• Attempt to extract model weights, system prompts, proprietary configuration details, or training data from the Platform's AI infrastructure
• Use AI-generated outputs as the sole basis for any binding insurance decision without the required human review and authorization described in Section 8.4
• Use the Platform's AI capabilities for purposes outside the scope of the contracted engagement or applicable SOW
• Attempt to use the Platform to generate content that is illegal, deceptive, harmful, or that violates applicable law or regulation

6.4 Intellectual Property Violations

• Copy, modify, distribute, sublicense, reverse-engineer, decompile, or create derivative works from any component of the Platform without Allegory's prior written consent
• Remove, alter, or obscure any proprietary notices, branding, or attribution within the Platform
• Use Allegory or AllegoryOS branding, trademarks, or trade names without prior written authorization

6.5 Data Misuse

• Submit data to the Platform that the Client does not have the legal right to process for the purposes of the engagement under applicable law
• Use Client Environment outputs for any purpose inconsistent with the applicable Statement of Work or applicable law
• Transmit or store within the Platform data subject to specialized regulatory requirements for which the Platform has not been assessed, without Allegory's prior written review and consent

7.1 Allegory's Intellectual Property

AllegoryOS — including its architecture, codebase, AI agent frameworks, rating engine infrastructure, document generation tooling, operational processes, user interfaces, and all related software, systems, and proprietary methodologies — is and remains the exclusive intellectual property of Allegory Technology Inc., protected by applicable Canadian and international copyright, trade secret, and other intellectual property laws.

Access to and use of the Platform under these Terms and any applicable SOW does not transfer any ownership interest in AllegoryOS or any component thereof. The Client's rights are limited to access to and use of the Client Environment during the term and for the purposes of the applicable engagement.

7.2 Client Intellectual Property

All data, documents, materials, and information provided by the Client to Allegory in connection with an engagement — including submission data, pricing algorithms, underwriting guidelines, document templates, brand assets, and customer records (collectively, "Client Data") — is and remains the exclusive intellectual property of the Client.

The Client grants Allegory a limited, non-exclusive, non-transferable licence to access and use Client Data solely for the purpose of delivering the services described in the applicable SOW. This licence terminates upon expiry or termination of the applicable SOW and completion of the data extraction and decommissioning process described in Section 16.5.

7.3 Deliverables

Deliverables produced under a SOW that incorporate both Allegory's Platform IP and the Client's intellectual property are licensed to the Client for use within the Client Environment on a non-exclusive basis for the purposes of the engagement. Underlying Platform IP embedded in or used to generate Deliverables remains the exclusive property of Allegory.

7.4 AI-Generated Outputs

AI-generated outputs, pre-populated data, and analytical results produced within the Client Environment are provided to the Client for use within the scope of the applicable engagement and the Client's insurance operations. Allegory retains no claim over the Client's underlying data. The Client has the right to use AI-assisted outputs it generates within its Client Environment for the purposes described in the applicable SOW.

7.5 Aggregated and Anonymized Data

Allegory may aggregate and anonymize operational and usage data across the Platform for internal analytics, platform improvement, and industry research. Data aggregated and anonymized in this manner is owned by Allegory and cannot be traced back to any individual client, Client Environment, data subject, or specific submission.

7.6 No Implied Licences

Nothing in these Terms or any SOW grants either party any rights in the other party's intellectual property beyond those expressly stated herein. No implied licences are granted.

AllegoryOS uses artificial intelligence to assist insurance operations. The following provisions govern all AI capabilities delivered within the Platform and form a material part of the terms of engagement.

8.1 AI Models in Use

AllegoryOS currently uses Anthropic Claude Sonnet 4 and Claude Opus 4, accessed via Anthropic's commercial Messages API. These are the foundational AI models used to process Client Data within the Platform. Allegory holds and manages the API credentials used to access these models on the Client's behalf; the Client does not hold or manage API credentials directly.

Allegory reserves the right to substitute, upgrade, or supplement foundational models used to deliver AI services, provided that:

• any substituted model delivers equivalent or superior capability for the relevant use case
• the substitution does not materially degrade the quality, accuracy, or performance of AI outputs
• the substitution does not compromise the Client's data handling requirements
• Allegory provides the Client with reasonable advance written notice of any material model change

8.2 Zero Data Retention

Allegory accesses Anthropic's models using commercial API credentials subject to Anthropic's Zero Data Retention (ZDR) policy. Under this policy, prompt inputs and model outputs are not retained by Anthropic after the API response is returned. Client Data submitted for AI parsing is processed in real time and is not stored by Anthropic following completion of the API response.

Allegory commits to:

• maintaining ZDR-eligible API endpoints and credentials throughout all client engagements
• not routing Client Data through non-ZDR-eligible Anthropic products or interfaces without the Client's prior written consent
• notifying the Client promptly if Anthropic modifies its Zero Data Retention policy in a manner that materially affects these protections

8.3 No Training on Client Data

8.4 No Autonomous Decision-Making

No AI output generated within the Platform constitutes a binding decision of any kind — including underwriting decisions, coverage determinations, rated quotes, or policy issuances — unless expressly confirmed and authorized by a qualified human user. AI capabilities within the Platform are designed to assist and accelerate human decision-making. They do not replace it.

The Client is solely responsible for ensuring that its personnel:

• treat all AI-generated outputs as inputs requiring human review and professional judgment before being applied to any rating, pricing, or policy decision
• do not use AI-generated outputs as the sole basis for any consequential decision
• notify Allegory promptly if any AI output appears inaccurate, anomalous, or inconsistent with expected underwriting or operational parameters

8.5 AI Accuracy Disclaimer

AI outputs are probabilistic in nature and are not guaranteed to be accurate, complete, or suitable for any particular purpose. Factors that may affect accuracy include:

• The quality, completeness, legibility, and format of documents submitted for parsing
• The complexity or non-standard structure of submission materials
• Niche or novel document formats that may be extracted with less reliability
• Model training data cutoffs that may not reflect the most current insurance products, regulatory requirements, or market practices

Allegory does not warrant that AI outputs will be error-free or suitable for any particular purpose. The Client is responsible for verifying all AI-generated outputs before applying them to any decision, quote, rating, or policy action. See Section 13.5.

8.6 Regulatory Responsibility for AI Use

The Client is solely responsible for ensuring that its use of AI-assisted outputs complies with all applicable laws and regulatory requirements, including any requirements of applicable insurance regulators regarding the use of artificial intelligence in underwriting, rating, pricing, or claims workflows. Allegory makes no representation that the Platform's AI capabilities satisfy any specific regulatory requirement applicable to the Client's operations.

9.1 Privacy Policy

Our Privacy Policy, available at allegoryos.com/privacy-policy, is incorporated into these Terms by reference and governs the collection, use, storage, and protection of personal information by Allegory in connection with the Platform and its operations.

9.2 Allegory as Data Processor

As set out in our Privacy Policy and the applicable SOW, Allegory acts as a data processor with respect to Client Data submitted to the Platform. The Client is the data controller and is solely responsible for:

• having a valid lawful basis for processing any personal information submitted to the Platform under applicable law
• providing required privacy notices to individuals whose personal information is submitted
• responding to data subject rights requests in respect of Client Data
• complying with all applicable privacy laws governing the collection, use, and processing of personal information submitted through the Platform, including PIPEDA and Quebec Law 25
• ensuring that Client Data submitted to the Platform does not include categories of sensitive personal information for which the Platform has not been assessed, without Allegory's prior written agreement

Allegory will process Client Data only on the Client's documented instructions as set out in the applicable SOW, and will not use Client Data for any purpose beyond service delivery.

9.3 Data Residency

All Client Data stored within the Client Environment is held in the AWS ca-central-1 (Canada) region. Canadian data residency is maintained as a material obligation of all client engagements. Any change to the data residency configuration of a Client Environment requires the Client's prior written consent.

9.4 Sub-Processors

Allegory uses the following sub-processors that may have access to Client Data in connection with Platform operations:

Amazon Web Services (AWS)

Cloud infrastructure, storage, compute, authentication, and communications — governed by the AWS Customer Agreement and AWS Data Processing Addendum

Anthropic

AI model inference — governed by Anthropic's API Terms of Service and subject to Zero Data Retention policy; no Client Data is retained post-response

Allegory will provide the Client with reasonable advance notice before engaging any additional sub-processor that will have access to Client Data. All sub-processors are contractually bound by data handling obligations consistent with Allegory's obligations under the applicable SOW.

9.5 Detailed Data Handling Terms

Specific data handling obligations — including log retention periods, transient data expiry schedules, data extraction procedures on termination, and breach notification timelines — are set out in the applicable SOW and its appendices, which govern those matters in detail.

10.1 Fee Structure

Fees applicable to each engagement are set out in the applicable Statement of Work. AllegoryOS is an enterprise platform; pricing is negotiated and governed individually by SOWs. There are no standard public subscription tiers.

10.2 Invoicing

Allegory will issue invoices in accordance with the payment schedule set out in the applicable SOW. All fees are stated in Canadian dollars and are exclusive of applicable taxes unless otherwise stated. HST at the applicable rate will be applied to all invoices where required by law. Allegory's HST registration number will appear on all invoices.

10.3 Payment Terms

All undisputed invoices are payable within thirty (30) days of the invoice date, or within such other period as is specified in the applicable SOW. Payments are to be made by electronic funds transfer to the account designated by Allegory on the relevant invoice.

10.4 Late Payment

Where payment of an undisputed invoice is not received within the applicable payment period, Allegory reserves the right to charge interest on the outstanding amount at 1.5% per month, compounded monthly, from the due date until the date of payment. Allegory may suspend delivery or Platform access following written notice of non-payment and a reasonable cure period, as specified in the applicable SOW.

10.5 Disputed Invoices

Where the Client disputes any portion of an invoice in good faith, the Client must notify Allegory in writing within fifteen (15) business days of the invoice date, specifying the disputed amount and the grounds for the dispute in reasonable detail. Undisputed portions of invoices remain due and payable on the applicable payment date. The parties will work in good faith to resolve invoice disputes promptly.

10.6 Taxes

All fees are exclusive of applicable taxes, including HST, GST, and any other federal or provincial sales or value-added taxes. The Client is responsible for all applicable taxes associated with the engagement, except for taxes levied on Allegory's net income.

10.7 Third-Party Cost Approvals

Where Allegory incurs third-party costs in connection with delivery that are not covered by the agreed fees, Allegory will notify the Client in advance and obtain written approval before incurring such costs. Approved third-party costs will be invoiced to the Client at cost with no markup unless otherwise agreed in the applicable SOW.

11.1 Confidential Information

Each party acknowledges that it may receive or have access to confidential information of the other party in connection with the engagement. For the purposes of these Terms, "Confidential Information" means all non-public information disclosed by one party to the other in connection with an engagement, including Client Data, Platform architecture, source code, pricing algorithms, underwriting guidelines, commercial terms, security configurations, and any other information designated as confidential or that a reasonable party would understand to be confidential given the nature of the information and the circumstances of disclosure.

11.2 Confidentiality Obligations

Each party agrees to:

• treat the other party's Confidential Information with no less than a reasonable standard of care, and in any event no less care than it applies to its own confidential information of similar sensitivity
• not disclose the other party's Confidential Information to any third party without prior written consent, except to employees, contractors, and advisors who have a legitimate need to know such information for the purposes of the engagement and who are bound by written confidentiality obligations no less protective than those set out in these Terms
• use the other party's Confidential Information solely for the purposes of the applicable engagement, and for no other purpose

11.3 Exceptions

Confidentiality obligations do not apply to information that:

• is or becomes publicly available through no fault of the receiving party
• was known to the receiving party prior to disclosure, free of any obligation of confidentiality, as evidenced by written records predating disclosure
• is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information, as evidenced by written records
• is required to be disclosed by applicable law, regulation, court order, or regulatory authority, provided that the receiving party: (i) gives the disclosing party prompt written notice of the requirement to the extent permitted by law; (ii) cooperates reasonably with the disclosing party in seeking a protective order or other appropriate relief; and (iii) discloses only the minimum information necessary to satisfy the legal obligation

11.4 Client Data

All Client Data is treated as Confidential Information of the Client regardless of whether it has been designated as such. Allegory will not use Client Data for any purpose beyond the delivery of contracted services. Allegory will not use Client Data for competitive intelligence, AI model training, or any commercial purpose other than service delivery.

11.5 Platform Architecture

The architecture, configuration, pricing, and operational details of AllegoryOS are treated as Confidential Information of Allegory. The Client will not disclose Platform architecture details, SOW terms, or pricing information to any third party without Allegory's prior written consent, except as required by applicable law or regulation.

11.6 Personnel Obligations

Each party will ensure that all personnel with access to the other party's Confidential Information — including employees, contractors, and subcontractors — are bound by written confidentiality obligations consistent with this Section 11 before being given such access. Each party remains responsible for any breach of confidentiality by its personnel.

11.7 Survival

Confidentiality obligations under this Section 11 survive the expiry or termination of these Terms and any applicable SOW for a period of five (5) years from the date of expiry or termination, or for such longer period as may be specified in a mutual non-disclosure agreement executed between the parties, which shall prevail in the event of any conflict with this Section 11.

12.1 Allegory's Security Program

Allegory maintains a cybersecurity program aligned with the NIST Cybersecurity Framework, comprising the following operational controls:

• Continuous threat detection via AWS GuardDuty, monitoring CloudTrail logs, VPC Flow Logs, and DNS logs with findings generated within 15 minutes
• Multi-region audit logging via AWS CloudTrail with cryptographic log file validation and encrypted storage
• AES-256 encryption at rest on all data stores, including DynamoDB tables, S3 buckets, and authentication infrastructure
• TLS 1.2 minimum encryption in transit across all Platform endpoints, with HTTPS-only transport enforced at the infrastructure layer
• Named IAM profiles and least-privilege access controls with mandatory MFA for all administrative and infrastructure access
• Full separation of development and production environments throughout all delivery and operational phases
• Regular vulnerability monitoring through AWS managed service patching, GuardDuty findings review, and weekly vulnerability reporting
• A formal Incident Response Plan governing detection, containment, client notification, investigation, recovery, and post-incident review
• A Business Continuity and Disaster Recovery Plan with defined recovery objectives and tested restoration procedures

12.2 Breach Notification to Clients

In the event of any actual or reasonably suspected unauthorized access to, disclosure of, loss of, or destruction of Client Data within the Platform, Allegory will:

• notify the Client in writing within 48 hours of becoming aware of the incident, regardless of whether the full scope of the incident has been confirmed at that time
• include in the initial notification, to the extent known at the time: the nature of the incident; the categories and approximate volume of Client Data affected; the likely consequences of the incident; and the measures Allegory has taken or proposes to take to address the incident and prevent recurrence
• provide timely supplemental notification as the investigation progresses and additional information becomes available
• cooperate fully with the Client in investigating, containing, and remediating the incident, and in supporting the Client's regulatory notification obligations under applicable law, including PIPEDA breach reporting requirements and any applicable provincial or insurance regulatory notification requirements

12.3 Costs of Incidents

The costs of investigating and remediating a security incident will be borne by the party whose breach, negligence, or wilful misconduct caused or materially contributed to the incident. Where both parties contributed, costs will be allocated proportionately having regard to the degree of each party's contribution.

12.4 Evidence Preservation

Allegory will preserve all evidence relevant to a security incident, including CloudTrail audit logs, GuardDuty findings, CloudWatch logs, and related communications, for a minimum of three (3) years from the date the incident is identified. Allegory will make this evidence available to the Client on request to the extent permitted by applicable law and Allegory's legal obligations.

12.5 Client Security Obligations

The Client is responsible for:

• maintaining appropriate security practices for all devices and systems used to access the Client Environment, including endpoint protection on all devices used by its personnel
• ensuring that all provisioned users maintain MFA enrollment and use credentials that are not shared with other systems or individuals
• promptly reporting to Allegory any actual or suspected security incidents, unauthorized access, or credential compromise affecting or potentially affecting the Client Environment
• ensuring that all data submitted to the Platform has been collected and is being transmitted in compliance with applicable privacy and security requirements
• not submitting to the Platform any data containing malware, malicious code, or content designed to interfere with Platform operations

13.1 Allegory's Warranties

Allegory warrants that:

• it has the full right and authority to enter into these Terms and any applicable SOW and to perform all obligations thereunder
• the Platform will be operated and maintained in material conformance with the infrastructure and security standards described in these Terms and the applicable SOW appendices
• services will be performed in a professional and workmanlike manner consistent with reasonable industry standards for managed enterprise cloud software platforms
• Allegory will maintain the licences, agreements, and relationships with third-party providers — including AWS and Anthropic — necessary to operate the Platform and deliver contracted services

13.2 Client's Warranties

The Client warrants that:

• it has the full right and authority to enter into these Terms and any applicable SOW and to perform all obligations thereunder
• all Required Inputs, data, and materials provided to Allegory are provided with the legal right to use them for the purposes described in the applicable SOW, and their submission to the Platform does not violate any third-party rights or applicable law
• the Client's use of the Platform and all outputs it generates will comply with all applicable laws, regulations, and regulatory requirements
• the Client holds all licences, registrations, and approvals required to carry on its insurance operations and to use AI-assisted tools in connection with those operations

13.3 Disclaimer of Implied Warranties

Except as expressly set out in Section 13.1, the Platform and all related services are provided on an "as is" and "as available" basis. To the fullest extent permitted by applicable law, Allegory disclaims all implied warranties, representations, and conditions of any kind, including any implied warranty of merchantability, fitness for a particular purpose, title, satisfactory quality, or non-infringement.

13.4 No Guarantee of Uninterrupted Service

Allegory does not warrant that the Platform will be available at all times without interruption, error, or delay. Platform availability is subject to:

• scheduled maintenance windows, for which Allegory will provide reasonable advance notice where maintenance is expected to affect Client operations during normal business hours
• unscheduled maintenance required to address urgent security vulnerabilities or infrastructure failures, carried out as promptly as practicable with notice to the Client as soon as reasonably possible
• events outside Allegory's reasonable control, including AWS service events and force majeure events described in Section 17

Allegory will use commercially reasonable efforts to maintain Platform availability and will notify Clients of known outages or degradations that materially affect Client operations.

13.5 AI Accuracy Disclaimer

As set out in Section 8.5, AI outputs are probabilistic in nature and are not guaranteed to be accurate, complete, or suitable for any particular purpose. Allegory assumes no liability for decisions made by the Client or its personnel in reliance on AI-generated outputs. The Client's obligation — set out in Section 8.4 — to apply qualified human review and professional judgment to all AI-generated outputs before any decision, rating, or policy action is taken is a fundamental and material condition of the engagement. Allegory's AI accuracy disclaimer does not limit Allegory's obligations to configure and operate AI services in accordance with the applicable SOW.

13.6 Regulatory Disclaimer

Allegory makes no representation or warranty that the Platform or any of its capabilities satisfies any specific regulatory requirement applicable to the Client's operations. The Client is solely responsible for assessing whether the Platform is suitable for use in connection with its regulated activities and for ensuring that its use of the Platform complies with all applicable insurance regulatory requirements. See Section 2.2 and Section 8.6.

14.1 Exclusion of Consequential Loss

To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, consequential, special, exemplary, or punitive damages, including but not limited to loss of profits, loss of revenue, loss of business opportunity, loss of data, loss of goodwill, or business interruption, arising out of or related to these Terms or any applicable SOW, howsoever caused, whether in contract, tort, negligence, strict liability, or otherwise, and whether or not such damages were foreseeable or the party has been advised of the possibility of such damages.

14.2 Aggregate Liability Cap

Each party's total aggregate liability to the other for all claims arising out of or related to these Terms or any applicable SOW — whether in contract, tort, negligence, or otherwise — shall not exceed the total fees paid or payable by the Client to Allegory under the applicable SOW in the twelve (12) months immediately preceding the event giving rise to the claim, or such other cap as is expressly specified in the applicable SOW. Where multiple SOWs are in effect, the cap applies independently to each SOW.

14.3 Exceptions

The exclusions and limitations in this Section 14 do not apply to:

• death or personal injury caused by a party's negligence
• fraud or fraudulent misrepresentation by a party
• the Client's payment obligations under an applicable SOW
• either party's confidentiality obligations under Section 11 and any applicable mutual non-disclosure agreement
• either party's breach of Section 12 (Security Obligations and Breach Notification) arising from wilful misconduct or gross negligence in connection with a security incident involving Client Data
• either party's indemnification obligations under Section 15 with respect to third-party claims

14.4 Essential Basis of Agreement

The parties acknowledge that the limitations of liability set out in this Section 14 reflect a reasonable and negotiated allocation of risk between commercial parties of comparable sophistication, and form an essential basis of the commercial agreement between them. The fees charged by Allegory are set in reliance on and with reference to these limitations.

15.1 Indemnification by Allegory

Allegory will defend, indemnify, and hold harmless the Client and its officers, directors, employees, and agents from and against any third-party claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to:

• Allegory's material breach of these Terms or an applicable SOW
• Allegory's negligence or wilful misconduct in connection with the delivery or operation of the Platform
• any claim that the Platform, as delivered and used in accordance with these Terms and the applicable SOW, infringes any third-party intellectual property right

15.2 Indemnification by Client

The Client will defend, indemnify, and hold harmless Allegory and its officers, directors, employees, and agents from and against any third-party claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to:

• the Client's material breach of these Terms or an applicable SOW
• the Client's negligence or wilful misconduct
• the Client's use of the Platform or its outputs in a manner inconsistent with these Terms, the applicable SOW, or applicable law
• any claim by a data subject, regulatory authority, or third party arising from the Client's failure to meet its obligations as data controller in respect of Client Data, including any failure to maintain a valid lawful basis for processing or to respond to data subject rights requests

15.3 Indemnification Procedure

The party seeking indemnification (the "Indemnified Party") must:

• notify the indemnifying party (the "Indemnifying Party") in writing promptly upon becoming aware of the claim, provided that a failure to give prompt notice does not release the Indemnifying Party from its obligations except to the extent of actual prejudice caused by the delay
• give the Indemnifying Party sole control of the defence and settlement of the claim, provided that: (i) the Indemnifying Party may not settle any claim that imposes obligations on, or requires any admission of liability by, the Indemnified Party without the Indemnified Party's prior written consent; and (ii) the Indemnified Party may participate in the defence at its own expense with counsel of its choosing
• provide the Indemnifying Party with reasonable cooperation, information, and assistance in the defence of the claim at the Indemnifying Party's expense

16.1 Term of These Terms

These Terms remain in effect for as long as the Client accesses or uses the Platform, or for as long as any SOW between the parties remains in effect, whichever is longer.

16.2 Term of Each SOW

The term of each specific engagement is as set out in the applicable SOW. Unless otherwise stated in the SOW, the SOW continues until completion of the agreed deliverables and any ongoing post-delivery service period, unless earlier terminated in accordance with its terms or this Section 16.

16.3 Termination for Cause

Either party may terminate an applicable SOW by providing thirty (30) days' written notice to the other party if the other party commits a material breach of the SOW or these Terms, provided that:

• the written notice specifies the breach in reasonable detail
• the breaching party fails to remedy the breach within fifteen (15) business days of receiving the notice

Where the breach is incapable of remedy, the non-breaching party may terminate immediately on written notice.

16.4 Termination for Insolvency

Either party may terminate an applicable SOW immediately on written notice if the other party: becomes insolvent or unable to pay its debts as they fall due; makes a general assignment for the benefit of creditors; has a receiver, trustee, administrator, or liquidator appointed over any material portion of its assets; or commences, or has commenced against it, any proceeding under applicable bankruptcy, insolvency, restructuring, or creditor protection legislation that is not dismissed within thirty (30) days.

16.5 Data Extraction and Decommissioning

Upon expiry or termination of any SOW for any reason:

Extraction period

Allegory will provide the Client with a transition period of no less than thirty (30) days from the date of expiry or termination during which the Client may extract all Client Data from the Client Environment in a structured, machine-readable format. Allegory will provide reasonable assistance to facilitate an orderly and complete extraction.

Read-only access

Where the SOW is terminated other than for Allegory's material breach, Allegory will use commercially reasonable efforts to maintain the Client Environment on a read-only basis during the extraction period to allow the Client to continue accessing its data pending transition.

Decommissioning

Following the conclusion of the extraction period, Allegory will securely decommission the Client Environment and provide the Client with written confirmation that all Client Data has been permanently deleted from the Platform, except to the extent that retention of specific data is required by applicable law, regulation, or Allegory's own audit and legal obligations.

AI data

Client Data submitted to the Anthropic API is subject to the Zero Data Retention policy described in Section 8.2 and is not retained by Anthropic beyond the completion of each API response. No additional steps are required at the AI provider level on termination.

16.6 Effect of Termination

Termination does not affect any rights or obligations that have accrued prior to the date of termination. All outstanding payment obligations in respect of services delivered or milestones achieved prior to the termination date remain due and enforceable.

16.7 Survival

The following provisions survive expiry or termination of these Terms and any applicable SOW: Section 1 (Acceptance of Terms, to the extent of accrued rights), Section 7 (Intellectual Property), Section 9 (Data Handling and Privacy, with respect to obligations arising during the term), Section 11 (Confidentiality), Section 12 (Security Obligations and Breach Notification, with respect to incidents occurring during the term), Sections 13.3–13.6 (Disclaimers), Section 14 (Limitation of Liability), Section 15 (Indemnification), Section 16.5 (Data Extraction and Decommissioning), Section 16.6 (Effect of Termination), Section 18 (Dispute Resolution and Governing Law), and Section 19 (General Provisions).

17.1 Business Continuity Commitments

Allegory maintains a Business Continuity and Disaster Recovery Plan (BCDRP) governing continuity of critical services and recovery of Client Environments following a disruptive event. The BCDRP is reviewed and tested at least annually. Key recovery objectives are:

DynamoDB Point-in-Time Recovery (PITR) is enabled on all production tables, allowing restoration to any point within the applicable retention window. AWS managed services — including Lambda, DynamoDB, Cognito, and CloudFront — are designed for multi-availability-zone resilience within ca-central-1.

17.2 Force Majeure

Neither party will be in breach of these Terms or any SOW, or liable for any delay or failure to perform its obligations (other than payment obligations already due and payable), to the extent that such delay or failure is directly caused by circumstances beyond that party's reasonable control, including: acts of God; natural disasters; acts of war, terrorism, or civil unrest; governmental actions or regulatory orders; pandemic or epidemic events declared by a public health authority; major internet or telecommunications infrastructure failures; or material outages of third-party cloud infrastructure (including AWS service events) that are outside Allegory's reasonable ability to mitigate or work around.

17.3 Force Majeure Procedure

A party seeking to rely on force majeure must:

• notify the other party in writing promptly upon becoming aware of the relevant event, describing the nature of the event, its anticipated duration, and its expected impact on the party's ability to perform
• use commercially reasonable efforts to mitigate the impact of the event and to resume full performance as soon as reasonably practicable

17.4 Prolonged Force Majeure

If a force majeure event continues for more than thirty (30) consecutive calendar days and materially prevents the affected party from performing its material obligations, either party may terminate the applicable SOW on written notice without liability to the other party, subject to:

• the Client's obligation to pay for all services delivered and milestones achieved prior to the date of termination
• Allegory's obligation to cooperate with the Client's data extraction as set out in Section 16.5, to the extent technically feasible given the nature of the force majeure event

18.1 Governing Law

These Terms and all applicable SOWs are governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to any conflict of law principles that would require the application of the laws of any other jurisdiction.

18.2 Jurisdiction

Each party irrevocably submits to the exclusive jurisdiction of the courts of Ontario, Canada for the final resolution of any dispute arising out of or related to these Terms or any applicable SOW that is not resolved through the informal resolution or mediation process set out in Section 18.3.

18.3 Staged Dispute Resolution

Before commencing formal court proceedings, the parties agree to attempt to resolve any dispute through the following staged process:

Written notice

Either party gives written notice to the other identifying the dispute in reasonable detail and specifying the relief sought

Senior representative negotiation

Within ten (10) business days of the notice, senior representatives of both parties — with authority to settle the dispute — will meet in person or by video conference and attempt in good faith to resolve the dispute

Mediation

If the dispute remains unresolved after twenty (20) business days from the initial written notice, either party may refer the matter to non-binding mediation administered by a mediator agreed between the parties within five (5) business days, or, failing agreement, appointed by the ADR Institute of Canada upon request by either party

Litigation

If mediation does not resolve the dispute within thirty (30) days of the mediator's appointment, or if the other party fails to participate in good faith in any step of this process, either party may commence litigation before the courts of Ontario

18.4 Costs

Unless a court orders otherwise, each party will bear its own legal costs in connection with any dispute resolution process under this Section 18.

18.5 Urgent Relief

Nothing in this Section 18 prevents either party from seeking urgent injunctive, interim, or other equitable relief from a court of competent jurisdiction at any time where necessary to prevent irreparable harm, including in connection with a threatened or actual breach of confidentiality obligations, intellectual property rights, or data security obligations. The pursuit of urgent relief does not waive the obligation to follow the staged dispute resolution process for the underlying dispute.

19.1 Entire Agreement

These Terms, together with the Privacy Policy at allegoryos.com/privacy-policy and all applicable SOWs and their appendices, constitute the entire agreement between the parties with respect to the subject matter hereof. They supersede all prior proposals, representations, letters of intent, scope documents, correspondence, and agreements — whether written or oral — relating to that subject matter, except that any mutual non-disclosure agreement executed between the parties remains in full force and effect and is incorporated by reference into the applicable SOW.

19.2 Order of Precedence

In the event of any conflict or inconsistency between the documents forming the agreement between the parties, the following order of precedence applies:

19.3 Amendment

No amendment to these Terms or any SOW is effective unless made in writing and executed by authorized representatives of both parties. Allegory may update these Terms from time to time to reflect changes in its services, Platform capabilities, or applicable legal requirements. Material updates to these Terms will be communicated to Clients with reasonable advance notice before taking effect. Continued use of the Platform after the effective date of any update constitutes acceptance of the updated Terms.

19.4 Waiver

A party's failure to enforce any provision of these Terms or any SOW on any occasion, or any delay in exercising any right or remedy available to it, does not constitute a waiver of that provision, right, or remedy or of the right to enforce it on any subsequent occasion. A waiver is only effective if made in writing and signed by the waiving party.

19.5 Severability

If any provision of these Terms is found by a court of competent jurisdiction to be invalid, unlawful, void, or unenforceable in any respect, that provision will be deemed modified to the minimum extent necessary to make it valid and enforceable, or severed from these Terms if modification is not possible. The invalidity or unenforceability of any provision does not affect the validity or enforceability of any remaining provision, which continues in full force and effect.

19.6 Notices

All notices, requests, consents, and other communications required or permitted under these Terms or any SOW must be in writing and addressed to the party contacts specified in the applicable SOW or, absent a SOW, to the addresses in Section 20 of these Terms. Notices are effective:

• upon personal delivery
• one (1) business day after deposit with a recognized overnight courier, with tracking confirmation
• upon confirmed receipt by the receiving party, where delivered by email

19.7 Electronic Signatures

These Terms and any SOW may be executed electronically. Electronic signatures are legally binding and have the same legal effect as original handwritten signatures for the purposes of these Terms and applicable Canadian law.

19.8 Counterparts

Any SOW may be executed in one or more counterparts, each of which constitutes an original and all of which, taken together, constitute one and the same agreement. Delivery of an executed counterpart by electronic means is as effective as delivery of a manually executed counterpart.

19.9 Independent Contractors

The parties are independent contractors. Nothing in these Terms or any SOW creates, or is intended to create, a partnership, joint venture, agency, employment, or fiduciary relationship between the parties. Neither party has authority to bind the other party or to incur obligations on the other party's behalf.

19.10 Subcontracting

Allegory may engage subcontractors to assist in the delivery of services under any SOW, provided that:

• Allegory remains fully responsible to the Client for the performance of all subcontractors as if Allegory had performed the relevant services directly
• all subcontractors with access to Client Data are bound by written confidentiality obligations no less protective than those in Section 11 of these Terms and the applicable NDA
• no subcontractor is given access to Client Data beyond what is strictly necessary for the delivery of the relevant services
• Allegory discloses the identity of any subcontractor with access to Client Data to the Client upon written request

19.11 Assignment

Neither party may assign, transfer, or novate its rights or obligations under these Terms or any SOW without the prior written consent of the other party, such consent not to be unreasonably withheld or delayed. Notwithstanding the foregoing, either party may assign these Terms and any applicable SOW without consent to a successor entity in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided that:

• the assignee assumes in writing all of the assigning party's obligations under these Terms and the applicable SOW
• the non-assigning party is notified in writing of the assignment promptly and in any event no later than thirty (30) days following its completion

Any purported assignment in violation of this provision is void and of no legal effect.

19.12 No Third-Party Beneficiaries

These Terms are entered into for the sole benefit of the parties and their respective permitted successors and assigns. Nothing in these Terms, express or implied, is intended to or does confer upon any other person or entity any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of these Terms.

19.13 Language

The parties have agreed that these Terms and all related documents be drafted in English. Les parties ont convenu que les présentes conditions et tous les documents connexes soient rédigés en anglais.

For questions or concerns about these Terms, to report a prohibited use or security concern, or for general legal and commercial inquiries:

Legal inquiries

counsel@allegoryos.com

Platform support

hello@allegoryos.com

Security incidents and breach notification

security@allegoryos.com

Privacy inquiries

privacy@allegoryos.com