Legal: restore verbatim wording to match the source drafts

A clause-by-clause review against the CEO's source drafts found a few places where the rendered copy had strayed from the originals beyond the intended cleaning (token fills + stripping internal [COUNSEL]/[MATT]/ [Connor:] markers). Restoring exact wording: - DPA C5: keep as operative prose (not the source's editorial "publish a page" bracket) but match the original phrasing exactly — "as independent controller", "Claude/embedding models — receives ...", comma-separated list — and re-add the dropped "(verified against the signed provider agreements, Jul 10, 2026)". - EULA intro: re-add the dropped substantive text, including "For customers under a signed Stirling Enterprise Agreement, that agreement controls." - MSA intro: revert to the source's "incorporated by reference" (drop the added "to the extent stated in Section 9.1" qualifier). - Restore bold emphasis on MSA 1.3 and DPA C1/C5/C6 sentences. - SLA: "MSA Section 5.2" -> "MSA §5.2"; Order Form menu: "included as elected" -> "include as elected". No clause, number, price, or obligation changed — this only realigns prose the review flagged as non-verbatim. Still DRAFT, attorney review required before execution.
2026-07-15 11:07:01 +01:00
parent 1ce4f81b0c
commit c99c7d9fc7
5 changed files with 9 additions and 7 deletions
@@ -167,7 +167,7 @@ public class AgreementAssembler {
        row(sb, "Standard terms", "SSO, SCIM, RBAC, and audit logs included.");

        sb.append(
-                "\n**Itemized services menu (included as elected):** Self-hosted deployment $12,000/yr"
+                "\n**Itemized services menu (include as elected):** Self-hosted deployment $12,000/yr"
                        + " · Air-gapped deployment $36,000/yr · Dedicated SE/CSM $30,000/yr · Enhanced IP"
                        + " Protection (patent coverage, Section 7.3) 5% of committed processing fees ·"
                        + " Onboarding & training $7,500 one-time · Quarterly business reviews $8,000/yr."
@@ -4,7 +4,7 @@ This DPA forms part of the Agreement and applies where Provider processes Person

 ### C1. Roles; scope; instructions

-Customer is the controller (or a processor on behalf of its own controllers); Provider is a processor (or subprocessor, as applicable). Provider processes Personal Data only on Customer's documented instructions — including processing initiated by Customer's users, policies, pipelines, and API calls — unless required by law (in which case Provider informs Customer unless legally prohibited). Provider will inform Customer without undue delay if, in Provider's opinion, an instruction infringes the GDPR, UK GDPR, or other applicable data-protection law. Customer is responsible for the lawfulness of the Personal Data it submits and the instructions it gives; Customer's rights under this DPA include instruction, audit (C9), objection to subprocessors (C5), assistance (C6), and return or deletion of data (C10).
+Customer is the controller (or a processor on behalf of its own controllers); Provider is a processor (or subprocessor, as applicable). Provider processes Personal Data only on Customer's documented instructions — including processing initiated by Customer's users, policies, pipelines, and API calls — unless required by law (in which case Provider informs Customer unless legally prohibited). **Provider will inform Customer without undue delay if, in Provider's opinion, an instruction infringes the GDPR, UK GDPR, or other applicable data-protection law.** Customer is responsible for the lawfulness of the Personal Data it submits and the instructions it gives; Customer's rights under this DPA include instruction, audit (C9), objection to subprocessors (C5), assistance (C6), and return or deletion of data (C10).

 ### C2. Details of processing

@@ -20,11 +20,11 @@ Encryption in transit (TLS 1.2+) and at rest (AES-256); zero-standing-access wit

 ### C5. Subprocessors

-Customer generally authorizes the subprocessors listed at {{subprocessor_url}}: cloud infrastructure (Amazon Web Services); payment processing (Stripe, acting as an independent controller for payment data); email delivery (Google); account infrastructure (Supabase); product telemetry (PostHog, EU-hosted; pseudonymous usage events, never file content); and AI model providers — **Anthropic** (Claude models, which receive prompts and queries only) and **Voyage AI** (embedding models, which receive extracted text excerpts solely to generate embeddings where Customer enables Ingestion/RAG features). **Customer files are never transmitted to any AI provider,** and neither AI provider trains on Customer data. Provider gives thirty (30) days' notice of new subprocessors; Customer may object on reasonable data-protection grounds, and if unresolved, may terminate the affected Services with a pro-rata refund. Provider imposes data-protection obligations on each subprocessor by written contract that are at least as protective as this DPA, and remains fully responsible to Customer for each subprocessor's performance.
+Customer generally authorizes the subprocessors listed at {{subprocessor_url}}: cloud infrastructure (Amazon Web Services), payment processing (Stripe, as independent controller for payment data), email delivery (Google), account infrastructure (Supabase), product telemetry (PostHog, EU-hosted; pseudonymous usage events, never file content), and AI model providers: **Anthropic** (Claude models — receives prompts and queries only) and **Voyage AI** (embedding models — receives extracted text excerpts solely to generate embeddings where Customer enables Ingestion/RAG features). **Customer files are never transmitted to any AI provider.** Neither AI provider trains on Customer data (verified against the signed provider agreements, Jul 10, 2026). Provider gives thirty (30) days' notice of new subprocessors; Customer may object on reasonable data-protection grounds, and if unresolved, may terminate the affected Services with a pro-rata refund. **Provider imposes data-protection obligations on each subprocessor by written contract that are at least as protective as this DPA, and remains fully responsible to Customer for each subprocessor's performance.**

 ### C6. Data subject requests; assistance

-Taking into account the nature of the processing, Provider provides reasonable assistance (including through the Processor's search, redaction, and audit tools) for Customer's obligations under GDPR Articles 32–36: security of processing, breach notification to authorities and data subjects, data protection impact assessments, and prior consultations with supervisory authorities, as well as responses to data subject requests. Provider forwards requests received directly to Customer and does not respond except as legally required. Provider makes available to Customer all information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, per Section C9.
+Taking into account the nature of the processing, Provider provides reasonable assistance (including through the Processor's search, redaction, and audit tools) for Customer's obligations under GDPR Articles 32–36: security of processing, breach notification to authorities and data subjects, data protection impact assessments, and prior consultations with supervisory authorities, as well as responses to data subject requests. Provider forwards requests received directly to Customer and does not respond except as legally required. **Provider makes available to Customer all information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, per Section C9.**

 ### C7. Breach notification

@@ -1,6 +1,6 @@
 # Stirling Enterprise Agreement

-One signature executes all three parts of this Agreement: the Master Services Agreement (Part A), the Order Form (Part B), and the Data Processing Addendum (Part C). The Stirling EULA & Commercial Terms is incorporated by reference to the extent stated in Section 9.1.
+One signature executes all three parts: the Master Services Agreement (Part A), the Order Form (Part B), and the Data Processing Addendum (Part C). The Stirling EULA & Commercial Terms is incorporated by reference.

 ## Part A — Master Services Agreement

@@ -12,7 +12,7 @@ This Master Services Agreement (the "Agreement") is entered into as of {{effecti

 1.2 **License grants.** Provider grants Customer, for the Term: (a) a non-exclusive, non-transferable right to access and use the Processor for Customer's internal business operations, up to the Committed Volume; and (b) a non-exclusive right to deploy and distribute the Editor to Customer's authorized users without limit on user count. Open-source components of the Editor remain governed by their own licenses, which control for those components.

-1.3 **Deployment.** The Services are delivered via the deployment stated in the Order Form (Stirling Cloud, Self-hosted, or Air-gapped). Self-hosted deployments validate their license and report metering data online; Air-gapped deployments verify a signed activation bundle offline and reconcile usage periodically as described in the Documentation. Customer shall not disable, circumvent, or falsify license validation or usage metering. The metered rate does not vary by deployment; deployment-specific services are priced as line items in the Order Form.
+1.3 **Deployment.** The Services are delivered via the deployment stated in the Order Form (Stirling Cloud, Self-hosted, or Air-gapped). Self-hosted deployments validate their license and report metering data online; Air-gapped deployments verify a signed activation bundle offline and reconcile usage periodically as described in the Documentation. Customer shall not disable, circumvent, or falsify license validation or usage metering. **The metered rate does not vary by deployment**; deployment-specific services are priced as line items in the Order Form.

 1.4 **Restrictions.** Customer shall not: resell or provide the Services to third parties as a service bureau; reverse engineer non-open-source components; use the Services to violate law; or exceed the scope of the Order Form other than through Overage (Section 3.4).

@@ -1,5 +1,7 @@
 # Stirling EULA & Commercial Terms

+This document fills the EULA slot the website Terms of Service §5 already contemplates ("If a separate end-user license (EULA) accompanies software, that license governs to the extent of any conflict"). It carries the commercial terms of the actual product: the PDF Process meter, spend limits, prepaid capacity, the free allotment, trials, self-hosted licensing, and AI features. For customers under a signed Stirling Enterprise Agreement, that agreement controls.
+
 **Effective:** {{version_date}} · **Version:** {{version}}

 ## 1. Agreement; precedence
@@ -1,6 +1,6 @@
 # SLA Exhibit — Stirling Enterprise Agreement

-Referenced by the Order Form's service-level row and MSA Section 5.2. One document, three tiers; the Order Form's tier selection determines the applicable column. Uptime is a target, not a credited commitment: no service credits apply at any tier. Tiers differentiate support response, channels, and people.
+Referenced by the Order Form's service-level row and MSA §5.2. One document, three tiers; the Order Form's tier selection determines the applicable column. Uptime is a target, not a credited commitment: no service credits apply at any tier. Tiers differentiate support response, channels, and people.

 ## 1. Availability