Eurus client terms

1. Who the agreement is with

Eurus is software made and run by FourWinds. Until FourWinds' company is incorporated, FourWinds Digital is a trading name of Oscar Cobbe, and your contract is with him. When the company exists, we will ask you in writing to move this agreement to it, on the same terms.

In these terms "we" and "us" mean FourWinds as described above, "you" means the organisation named in the order form, and "Eurus" means the software and the services we provide with it.

2. What the agreement covers

These terms, the order form and the data processing agreement make up the agreement. The order form says which of these you have ordered:

• The audit (A). A fixed-price assessment over seven working days: the questions that apply to you, every system you run on, one process followed from start to finish, and a written readout with the laws that apply, what to fix and a fixed price for the build.
• The build (B). Connecting your systems to Eurus, setting up the workflows the readout calls for, mapping your controls and switching the checks and evidence on, at the fixed price in the order form.
• Run & Monitor (C). Eurus running for you each month: every connected system watched, the checks and workflows kept working, fixes to workflows and connections, response times by severity, and a monthly assurance report. Reporting and assurance (E) is included.
• Advanced automation (D). A new workflow or connection, priced in the order form, tried in your sandbox first.
• Registers (R). A yearly seat for one organisation that keeps its own registers in Eurus, with no system connected: every register (AI use, privacy, suppliers and the DORA register of information, risks, incidents, policies and continuity), which laws apply to you and what each asks, the legal deadlines with reminders, and the management report. The checks work from what you enter. Connecting systems comes with the audit and the build.

Where the order form and these terms differ, the order form wins for that order. Where the data processing agreement and these terms differ on personal data, the data processing agreement wins.

3. What Eurus does, and what it does not

Eurus reads the systems you connect, checks what happens in them against the controls mapped to the laws and standards that apply to you, keeps each result with a fingerprint, raises issues for your people to decide, and runs the workflows you switch on.

• It explains the law; it does not give legal advice. Each requirement is shown with the text of the law or standard behind it. Where a decision turns on how a law applies to your particular case, a qualified professional should confirm it. You remain responsible for your own compliance decisions.
• It does not certify you. Eurus shows where you stand and keeps the evidence. Certification against a standard such as ISO/IEC 27001 is done by an accredited certification body, and supervision by the regulator that supervises you.
• It works from what it is given. Findings come from your answers, the systems you connect and the records they hold. A system you do not connect, or an answer that is wrong, is not checked.
• People decide. The assistants raise issues; a person in your organisation accepts or dismisses each one. Fixes to access, money or customer data wait for the approver you name.

4. Connections, permissions and sandbox

• Each connection reads, using a read-only key or a sign-in at the vendor's own page. Eurus writes to a system only where you have granted write permission for that one connection, and only for the actions listed for it.
• Every organisation starts in sandbox. Your systems are read, and messages are written to an outbox and not sent. We switch your organisation to live when you ask and the workflows have been tried.
• You can disconnect a system at any time. Disconnecting revokes our access at the vendor and deletes the credentials we stored for it.
• Some reads happen only if you turn them on for a connection. Today that is Watch supplier bank changes, for an accounts connection (off by default): Eurus then reads each supplier's bank details to keep a fingerprint of them (never the account number) and the bills you have paid in the last 180 days, so it can tell you when a supplier was paid to changed details nobody confirmed. Turning it off stops those reads; what was recorded stays as evidence.

5. What you agree to do

• Give us the access the order form needs, and a named person who approves fixes to access, money and customer data.
• Answer the audit's questions as accurately as you can. "Not sure" is an acceptable answer.
• Keep account credentials to named individuals, switch on two-step sign-in, and tell us when someone leaves so their access ends the same day.
• Use Eurus lawfully, and connect only systems and data you are entitled to give us access to.
• Not try to reach another organisation's records, test our security without our written agreement, or copy or resell the software.

6. Ask, the AI assistant

Ask answers questions about your organisation from your own records, using a language model from Anthropic. It is off until your admin switches it on. Its answers cite the records they read; anything it drafts is a draft and waits for a person to approve it. You are responsible for checking what you act on, publish or send. Where Ask is switched on, Anthropic is a sub-processor under the data processing agreement.

7. Fees and payment

• Fees are as set out in the order form, exclusive of VAT. The audit and the build are fixed prices. Run & Monitor is a monthly fee for each site. Registers is a yearly fee for one organisation.
• The audit is invoiced in full before it starts. The build is invoiced 50% on order and 50% on go-live. Run & Monitor is invoiced monthly in advance, and Registers yearly in advance. Invoices are payable within 30 days of their date.
• We may suspend the service on an account that is materially overdue, after giving you 14 days' written notice.
• We may change the price of Run & Monitor or Registers once a year with 60 days' written notice. You may end it at the end of that notice if you do not accept the change.

8. Service levels

• Support is available 09:00 to 17:30 Irish time on Irish working days.
• With Run & Monitor, we respond to each issue within these working hours of it being raised: critical 4, high 8, medium 16, low 40.
• The app is available at least 99.5% of each calendar month, not counting maintenance announced at least 48 hours ahead. We report availability in the monthly assurance report. No service credit is paid for a miss.
• Each Monday the week's report goes to your admins, with a PDF pack of the week's checks and their fingerprints.

9. Your data and our software

• Your data is yours. Everything Eurus reads from your systems, the records it keeps for you and the readout we deliver belong to you. You can export them at any time while the agreement runs.
• The software is ours. Eurus, its checks, workflows, law catalogue and everything else we bring belong to FourWinds. You have a licence to use Eurus for your own organisation while the agreement runs.
• Feedback. We may use suggestions you give us to improve Eurus, without any obligation to you.
• Aggregate figures. We do not use your records to serve other customers. We may count usage across all customers (for example how many checks ran) in a form that identifies nobody.

10. Confidentiality

Each of us keeps the other's confidential information confidential, uses it only for this agreement, and shares it only with people who need it and are bound to keep it confidential. This does not cover information that is public through no fault of the receiver, that the receiver already had, or that the law or a regulator requires to be disclosed, in which case the receiver tells the other first where the law allows.

11. Security

We protect your records with the measures in Annex 2 of the data processing agreement, including each organisation's records kept apart by the database, keys to your systems sealed with AES-256-GCM, card numbers removed before storage, an append-only record of results chained with SHA-256, and nightly sealed backups. We will not materially reduce the overall level of those measures while the agreement runs. FourWinds' owner can view your organisation in Eurus read-only, as section 3 of the data processing agreement sets out, and every view is on your audit trail.

12. Liability

• Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.
• Subject to that, each party's total liability arising out of or in connection with this agreement is capped at the fees you paid us in the twelve months before the event giving rise to the claim.
• Neither party is liable for loss of profit, loss of business, loss of anticipated savings, or indirect or consequential loss.
• We are not liable for a fine or penalty imposed on you for your own compliance, except to the extent it results from our breach of this agreement.

13. Term and ending the agreement

• The audit ends when the readout is delivered. The build ends when the checks are switched on for live use.
• Run & Monitor starts on go-live and runs for a minimum of 6 months, then month to month until either of us gives one month's written notice.
• Registers starts on the start date in the order form and runs a year at a time. It renews for another year unless either of us gives one month's written notice before the year ends. A year already invoiced is not refunded if you end it early or move to the audit.
• Either of us may end the agreement straight away by written notice if the other commits a material breach and does not put it right within 30 days of being told, or becomes insolvent.
• When it ends: for 30 days you can export your records and the evidence packs, and we will help you do it. We then delete your organisation's records from the live database. Copies in our nightly backups expire with them: the last 35 nights are kept, and the first night of each month for a year, so the last copy is gone within twelve months. Fees for work done up to the end remain payable.

14. General

• Changes to these terms. We will give you at least 30 days' written notice of any change. A change that reduces your rights applies to you only at your next renewal, or earlier if you agree.
• Assignment. Neither of us may transfer this agreement without the other's written consent, except that we may move it to FourWinds' company once incorporated, on the same terms.
• Things outside our control. Neither of us is liable for a delay caused by events outside its reasonable control, provided it tells the other and does what it reasonably can to limit the effect.
• Notices are given by email to the addresses in the order form.
• The whole agreement. This agreement replaces anything said or written before it about the same subject.
• Law. This agreement is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction.

Schedule: for financial entities under DORA

Where you are a financial entity under Regulation (EU) 2022/2554 (DORA), Article 30 requires certain terms in your contracts with ICT third-party service providers. This schedule gives them, and wins over the rest of the agreement where they differ.

Where Eurus supports one of your critical or important functions, Article 30(3) also applies, at the standard price:

Changes

• Version 1.1, 8 November 2026. Section 11 says that FourWinds' owner can view your organisation in Eurus read-only, with every view on your audit trail (data processing agreement, section 3).