Customer bill of rights
Promises without enforcement are marketing. Every right below is backed by a contractual mechanism, a server-enforced control, or an independent reviewer — and a place on this site where the evidence lives.
Rights enumerated
12
Reviewed annually by Customer Advisory
Server-enforced
8 of 12
Quorum · kill-switch · isolation · keys
Independently reviewable
4 of 12
Ombudsman · auditor · escrow agent
Contractual
All 12
In every MSA, no negotiation needed
Your funds are your funds. We do not lend against them, commingle them with operating cash, or earn float on them without disclosing it on /trust-budget.
Remedy
Withdrawal SLA in MSA · service credits per /sla-credits · independent escrow agent named in DPA.
Evidence
/financial-statements · /trust-ledger · /independence
Full export of your workspace — budgets, decisions, audit trail, signed manifests — in open formats, on demand, in under 24 hours.
Remedy
MSA termination clause with 90-day continuity window · source escrow on /exit-plan.
Evidence
/data-portability · /exit-plan
Every policy, pacer, payout, or model change that affects your workspace is logged with diff, author, and reviewer.
Remedy
Right to revert from /budget-versions within 30 days · pre-announcement on /change-notice-policy.
Evidence
/policy-diffs · /trust-ledger · /audit-trail-search
Money-moving actions on your workspace require two of three named approvers from your organisation. We cannot override this.
Remedy
Server-enforced quorum · attempted bypass paged and logged.
Evidence
/payouts · /segregation-of-duties · /decision-rights
Subscription pricing changes are announced 90 days in advance with the right to lock the prior tier for 12 months.
Remedy
Lock-in option · auto-prorated refunds · published on /pricing-changes.
Evidence
/price-list · /pricing-philosophy
Every customer-visible incident gets a blameless post-incident review within 72 hours. No edits to history, ever.
Remedy
Public summary on /transparency · unredacted PIR on request under MSA.
Evidence
/incident-replay · /breach-notification
AI agents acting on your workspace are bounded by your /policies, your /budget-locks, and your approvers. They never act outside.
Remedy
Hard kill-switch on /kill-switches · /agent-actions log auditable end-to-end.
Evidence
/responsible-ai · /model-cards · /policy-tests
Your data is encrypted with per-tenant keys; cross-tenant access is impossible by construction, not policy.
Remedy
Continuous adversary-tenant tests · independent assurance on /attestations.
Evidence
/tenant-isolation · /residency · /security-engineering-handbook
When we compare you to your cohort, the methodology is published and reproducible.
Remedy
Methodology disclosed on /methodology · cohort definitions on /benchmark-cohorts.
Evidence
/proof · /research
Customer Advisory shapes the roadmap; veto rights are real, not advisory theatre.
Remedy
Standing seats on /customer-advisory · published meeting minutes · roadmap input on /open-roadmap.
Evidence
/customer-advisory · /investor-updates
If we fail you, you do not have to argue with us. An independent ombudsman reviews and decides within 10 business days.
Remedy
Binding for service credits up to one quarter of fees · named ombudsman on /independence.
Evidence
/independence · /trust-principles
Every Scale and Enterprise workspace has a named DRI. No tickets to a queue, no bots gating support, no escalation theatre.
Remedy
Pod DRI named in MSA · response SLAs on /service-levels.
Evidence
/implementation-team · /on-call · /customer-promise