Terms of Service

These Terms of Service ("Terms") govern your access to and use of the Provenance platform ("Service"), operated by Provenance XL, Inc. ("Provenance," "we," "us," or "our"). By creating an account or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

Provenance is sold to organizations. If you use the Service through your employer or another organization, you represent that you are authorized to accept these Terms on its behalf, and "you" means both you and that organization. Where your organization has signed a separate written agreement, order form, or Data Processing Addendum (DPA) with us, that agreement governs and prevails over these Terms where they conflict.

Provenance is a trust layer for financial workflows: version control, review, and AI-assisted checking for Excel models, PowerPoint decks, and the deal documents behind them. Depending on your plan and configuration, the Service includes:

• The Provenance web console, and the Provenance add-ins for Microsoft Excel and PowerPoint.
• Version capture and history, computed differences between versions, cell-level history, and an append-only audit trail.
• Structured review workflows, comments, and recorded review outcomes.
• Deal data rooms, document ingestion and extraction, and links from a model figure back to its source document.
• AI-assisted features, described in Section 5.
• Our API, our Model Context Protocol (MCP) connector, and our Slack and Microsoft Teams apps.

We may add, change, or remove features over time. Section 11 describes how we handle material changes.

To use the Service you must create an account with accurate, current, and complete information, and keep it current. You are responsible for safeguarding your credentials and for activity under your account, and you must notify us promptly of any unauthorized use.

Your organization's administrators control its workspace. They can invite, suspend, and remove members, assign roles, grant and revoke access to individual deals, and view member activity and audit trails. Access in Provenance is granted per deal, not per organization: membership in an organization does not by itself entitle you to any deal's contents. You must not attempt to reach deals, organizations, or data you have not been granted access to.

An organization may also send a review to someone without a Provenance account through a guest review link. Guest recipients are bound by these Terms for that access, which is limited to the specific review it was issued for.

"Customer Content" means the workbooks, decks, documents, versions, notes, comments, review decisions, assistant conversations, and other material you or your organization put into the Service. You retain all ownership of it. We claim no rights in it beyond those you grant here.

You grant us a limited, non-exclusive, worldwide license to host, store, transmit, process, render, and display Customer Content, and to create the derived records the Service exists to produce — versions, computed differences, extracted figures, source links, and audit records — solely to provide, secure, and support the Service for you. This license exists for no other purpose, lasts only as long as we hold the content, and ends when the content is deleted.

We do not use Customer Content to train, fine-tune, or improve any machine learning model, ours or a vendor's. We do not sell it, and we do not use it to develop products for other customers. Our AI vendors are bound to the same restriction by contract. Where we improve the Service using information about how it is used, we use content-free product analytics, as described in our Privacy Policy.

You represent that you have the rights necessary to put Customer Content into the Service and to permit the processing described above, including any consents required from third parties whose information appears in it.

If you send us feedback, feature requests, or suggestions, you grant us a perpetual, royalty-free license to use them to improve the Service, without obligation to you. This does not extend to your Customer Content.

Parts of the Service use artificial intelligence: the Assistant, AI-generated review findings and summaries, document extraction and OCR, suggested version notes, and related features. Our Privacy Policy explains what is sent where, and to which providers. This section explains what these features can and cannot be relied on to do. Please read it.

5.1 AI output will sometimes be wrong

AI models are probabilistic. They do not reason with certainty, and they do not know when they are mistaken. Output from the Service's AI features will sometimes be incomplete, inaccurate, or wrong, including when it is expressed with apparent confidence. Concretely, that includes misreading a figure or a formula, missing a change that did occur, flagging one that did not, attributing a number to the wrong source, misreading a scanned or poorly structured document, summarizing a document in a way that omits something material, and stating something the cited evidence does not actually support. These are known limitations of the technology, not defects we represent we can eliminate.

We design the Service to make checking easy — answers and findings cite the version, cell, or document they came from — but a citation is a pointer, not a guarantee. Verify against the cited source before relying on anything.

5.2 AI output is advisory and decides nothing

AI-generated findings, summaries, and answers are advisory. They do not approve, reject, block, or gate anything in the Service on their own. They do not change a model, submit or decide a review, or alter an audit record. A person always makes the decision, and the record shows who made it. Where a version note or similar record was drafted by AI rather than written by a person, the record says so.

5.3 Your professional judgment is not replaced

The Service is a tool for people who are professionally responsible for their own work. It does not replace your review of your models, your firm's controls, or your obligations to your clients, investors, or regulators. You are responsible for independently verifying any output before relying on it, and for every decision you make using the Service. Do not use AI output as the sole basis for a financial, investment, valuation, accounting, or transaction decision.

5.4 Not professional advice

Nothing the Service produces is investment, financial, legal, tax, accounting, or other professional advice, and no fiduciary or advisory relationship is created by your use of it. Provenance is not a broker-dealer, investment adviser, accounting firm, or auditor, and the Service is not an audit, an attestation, a fairness opinion, or a substitute for any of them.

5.5 What the AI can see

An AI feature only receives content the requesting user is already authorized to read. Per-deal access is enforced in our code before a request is assembled, not by the model.

5.6 Providers and variability

We use third-party AI providers to deliver these features, named in our Privacy Policy, and we may change providers or models to improve quality, cost, or availability. Output is not deterministic: the same question asked twice may return differently worded answers. AI features may be unavailable, degraded, or rate-limited when a provider is.

5.7 Connecting Provenance to an external AI client

If your organization connects Provenance to an external AI client through our MCP connector, that client can read the deal context you are authorized to see, and can save a version. Content read through that connector leaves Provenance and is handled by the operator of that client under their terms, not ours. You are responsible for deciding whether that is appropriate for your data.

You agree not to:

• Use the Service unlawfully, or in violation of securities, market-conduct, data-protection, sanctions, or export laws.
• Upload content you lack the rights to upload, or that infringes third-party intellectual property rights.
• Attempt to access accounts, organizations, deals, or systems you have not been granted access to, or to circumvent any access control, deal boundary, or rate limit.
• Probe, scan, or test the vulnerability of the Service without our written permission, or interfere with its integrity, availability, or performance.
• Reverse-engineer, decompile, or disassemble the Service, except where that restriction is unenforceable by law.
• Use the Service, or its output, to build or train a competing product or machine learning model.
• Attempt to manipulate AI features into producing unlawful content, or into revealing data the requesting user is not authorized to see.
• Present AI-generated output as independently verified human work product, whether to your firm, your clients, or a regulator.
• Share credentials, or resell or provide the Service to third parties except as your agreement permits.

We may suspend access to investigate a suspected violation, a security incident, or a risk to other customers. Where practical we will tell you first.

Deal information handled in Provenance is frequently material non-public information (MNPI). We treat Customer Content as your confidential information, disclose it only as described in our Privacy Policy, and enforce access per deal.

You are responsible for your own side of that boundary: for who in your organization is granted access to a deal, for protecting data you export or download, and for your own obligations under insider-trading laws, wall-crossing procedures, and client confidentiality. The Service supports your controls; it does not discharge them.

You may connect the Service to third-party services — Google Drive, Microsoft OneDrive or SharePoint, Dropbox, Box, Slack, Microsoft Teams, or an external AI client. Connecting is your choice, is authorized through OAuth, and can be revoked at any time. Those services are operated by others under their own terms and privacy policies. We are not responsible for them, for their availability, or for what they do with data you direct to them.

Some features require a paid subscription. Pricing, billing period, and any usage limits are presented at purchase or in your order form. Payments are processed by Stripe; full card numbers never reach our servers.

• Renewal. Subscriptions renew automatically at the end of each billing period at the then-current price, until cancelled.
• Cancellation. You may cancel at any time from Plan & billing, or as your order form provides. Cancellation takes effect at the end of the current billing period: your access continues until then, and the subscription does not renew.
• Refunds. Fees already paid are non-refundable, and cancelling mid-period does not produce a prorated refund, except where required by law or stated otherwise in your order form.
• Price changes. We will give at least 30 days' notice before a price change takes effect for your subscription. You may cancel before it does.
• Taxes. Fees exclude taxes, which you are responsible for, other than taxes on our income.
• Non-payment. We may suspend or downgrade access to paid features if fees are overdue.

Our Privacy Policy describes what we collect, why, where it is stored, who else processes it, and how long we keep it. Our security practices are described at provenancexl.com/security. Where we process personal data contained in Customer Content, we act as processor on your organization's instructions; a DPA is available on request and, once signed, governs that processing.

We work to keep the Service available and will give reasonable notice of material adverse changes to features you rely on. Except where a separate written service level agreement applies, we do not guarantee uninterrupted or error-free operation. The Service depends on third-party infrastructure and AI providers and may be affected when they are. We may perform maintenance, and may modify, suspend, or discontinue features.

These Terms apply for as long as you use the Service. You may stop at any time. We may suspend or terminate access for material breach of these Terms, for non-payment, or where required by law; where practical we will give notice and an opportunity to cure.

On termination your right to use the Service ends. For 30 days afterward we will, on request, make your Customer Content available for export or return, after which we delete it in line with the retention periods in our Privacy Policy. Provisions that by their nature should survive — including Sections 4, 5, 7, 13, 14, 15, and 16 — survive termination.

To the maximum extent permitted by law, the Service is provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

We do not warrant that the Service will be error-free, that it will detect every change, error, inconsistency, or risk in a model or document, or that AI-generated output will be accurate, complete, or fit for your purpose. Its checks and comparisons are aids to review, not a guarantee that a model is correct. You accept that risk and remain responsible for verifying your own work.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost business opportunity, or lost or inaccurate data, arising out of or related to these Terms or the Service, even if advised of the possibility.

Our total aggregate liability for all claims arising out of or related to these Terms or the Service will not exceed the amount you paid us in the twelve months preceding the event giving rise to the claim.

These limits do not apply to liability that cannot be limited by law. They allocate risk between us and are reflected in our pricing.

You will defend and indemnify Provenance and its officers, directors, employees, and agents against third-party claims, and resulting liabilities, damages, and reasonable expenses, arising from Customer Content you put into the Service, your use of the Service in breach of these Terms or applicable law, or your violation of third-party rights. We will notify you of any such claim and let you control its defense, provided any settlement releases us fully and imposes no obligation on us.

These Terms are governed by the laws of the State of Delaware, without regard to its conflict of law rules. The parties will first try in good faith to resolve any dispute informally by contacting the other. If that fails, the dispute will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, seated in Delaware, before a single arbitrator. Either party may seek injunctive or equitable relief in a court of competent jurisdiction to protect its intellectual property or confidential information.

These Terms, together with any order form, DPA, or other written agreement between us, are the entire agreement on their subject. You may not assign them without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. If a provision is held unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver of it. Nothing here creates a partnership, agency, or employment relationship.

We may update these Terms. We will post the revised Terms and update the "Last updated" date, and for material changes we will give reasonable advance notice through the Service or by email. Continued use after the changes take effect constitutes acceptance. If you do not accept them, stop using the Service and, if you have a paid subscription, cancel it.

Questions about these Terms: support@provenancexl.com.