AI Automation Service Terms

• 1. What this service is

  Agate Cybersecurity ("Agate," "we") provides workflow design, build, and operational care services for AI-assisted business workflows. A workflow connects information between business systems, applies defined logic, and produces a result, with named human approval points where the process calls for judgment.

  Agate is a technology services provider. Agate is not a law firm and does not provide legal advice. Using Agate's services does not create an attorney-client relationship.

• 2. Engagement structure

  Every AI Automation engagement starts with a paid Workflow Opportunity Review. The Review is a scoped, fixed-fee engagement that maps one recurring workflow and produces a written next-step recommendation. A build engagement does not begin, and access to customer systems is not requested, until the Review is complete and the customer has signed a Master Services Agreement and a Statement of Work for the build.

  Care Plans are recurring services that monitor, maintain, and adjust the workflow after launch. Care Plans are required for production workflows. A workflow placed into production without an active Care Plan is not supported by Agate.

• 3. Scope of services

  Agate's standard scope includes workflow design, system integration, defined approval points, exception handling, documentation, launch testing, and ongoing operational care under a Care Plan.

  Current active workflow categories include:

  • Lead response and customer follow-up workflows
  • Tax and accounting document intake workflows
  • Healthcare administration workflows (front desk, scheduling, intake, recall)
  • Security log review and response workflows
  • Document, data, and routing workflows that move information between business systems

• 4. Out of scope

  The following are out of scope for Agate's standard offerings. Engagements involving any of the following will not be accepted under these Terms.

  • Workflows that make or materially influence consequential decisions about individuals, including but not limited to hiring, compensation, credit, insurance eligibility, housing, patient-care eligibility, or government benefits.
  • Video editing or video production work.
  • Marketing creative work, brand work, content writing, or campaign automation.
  • Voice AI systems and phone-agent workflows.
  • Workflows that require integration with software platforms whose vendor does not allow supported integration, or whose terms of service prohibit third-party automation.

• 5. Customer responsibilities

  The customer is responsible for:

  • The accuracy and completeness of information provided to Agate, including system descriptions, data classifications, regulatory context, and workflow requirements.
  • Granting and revoking access to customer systems, accounts, and data.
  • Cooperation of the customer's software vendors, including any required vendor approvals, integration partner enrollments, or vendor-side configuration.
  • Staff participation in approval steps, exception handling, and operational ownership of the workflow.
  • Reviewing, accepting, and operating the workflow as deployed.
  • Determining whether the customer is subject to HIPAA, the FTC Safeguards Rule, the Colorado AI Act, any state privacy or AI law, or any other legal or regulatory requirement, and obtaining counsel where regulatory interpretation is needed.
  • Adopting and maintaining the customer's own information security program, written policies, and staff training as the workflow changes the way information is handled.

• 6. Third-party vendors and integrations

  Agate workflows connect to software, platforms, and services provided by third-party vendors. Those vendors set their own pricing, terms of service, supported APIs, retention behavior, model behavior, support practices, and product roadmap. Agate does not control any of those decisions.

  The customer acknowledges that:

  • A vendor may change an API, deprecate a feature, change pricing, modify retention behavior, or restrict third-party integration at any time.
  • A model provider may update model behavior or output characteristics in ways that affect the workflow.
  • A workflow may require an active Care Plan to remain functional in the face of these changes.
  • Costs charged by third-party vendors (model usage, platform subscriptions, integration partner fees, storage, or other vendor pass-through costs) are the customer's responsibility unless explicitly included in writing in a Statement of Work.

• 7. No regulatory determination

  Agate does not determine the customer's status, obligations, or compliance under any law, rule, regulation, framework, or industry standard. This includes but is not limited to HIPAA, the FTC Safeguards Rule, IRS Publication 4557, the Colorado AI Act, state privacy laws, state AI procurement requirements, and the NIST AI Risk Management Framework.

  The Workflow Opportunity Review, the build engagement, and the Care Plan are operational and technical engagements. They are not legal opinions, legal advice, regulatory audits, security assessments, penetration tests, or business associate agreements. The customer is responsible for obtaining counsel where regulatory interpretation is needed.

• 8. Approval points and human review

  Agate workflows include named human approval points where the workflow design calls for judgment, oversight, or escalation. Approval points are documented at design time. The customer is responsible for staffing those approval points and for the operational outcome of approvals given.

  Agate does not represent or warrant that any workflow will produce error-free output, that no incorrect action will ever occur, or that human reviewers will catch every issue. The workflow is a tool. The customer's staff own the operational decision.

• 9. No guarantees of outcome

  Workflow time savings, accuracy, error reduction, revenue impact, customer-experience impact, and operational outcomes depend on the customer's processes, the customer's data quality, the systems involved, the customer's approval requirements, staff participation, third-party vendor behavior, and many other factors outside Agate's control.

  Customer-approved before-and-after results may be published where the customer has given written permission. Those results describe the specific workflow and the specific customer's operating environment. They are not promises of similar results in any other engagement.

  Agate does not guarantee any specific time saved, dollar saved, hours reduced, accuracy level, response time, uptime, security outcome, or regulatory outcome.

• 10. Workflow Opportunity Review

  The Workflow Opportunity Review is a paid, scoped engagement. It includes process mapping of one recurring workflow, system and information inventory at a high level, integration feasibility check against the customer's vendors' supported APIs, identification of approval points and exception paths, and a written next-step recommendation with a budget class.

  The Review fee ($1,500 USD as of the date of these Terms) is credited toward a subsequent build engagement if the customer signs a build Statement of Work within thirty (30) days of the Review deliverable.

  The Review is not legal advice, not a security assessment, not a penetration test, not a determination of regulatory status, and not a guarantee that the workflow can be built. The Review fee is non-refundable once the Review begins.

• 11. Care Plans

  Care Plans are recurring monthly services that include workflow monitoring, periodic health checks, connector and access review, exception handling, customer-initiated change requests within the included hours of the plan tier, periodic logic review, and a customer-owned operational contact.

  Care Plans are not "always-on" support contracts. Specific response windows, change-request hours, and supported workflow count vary by plan tier and are documented in the Statement of Work. Agate uses best-effort response within the engagement's documented scope and does not publish guaranteed response-time SLAs unless explicitly included in a written Statement of Work.

  Care Plans may be cancelled by the customer with written notice. Upon cancellation, the workflow continues to run as last deployed. Monitoring, support, and updates stop. Agate is not responsible for workflow degradation, drift, breakage, or failure after cancellation.

• 12. Data handling

  For each workflow, Agate reviews the data flow, the categories of information involved, access requirements, retention, and approved service providers before launch. For workflows involving protected health information, business associate considerations are reviewed before any production use.

  Agate does not make universal claims about whether customer data is or is not used to train models, retained by third parties, accessible by support personnel, or stored in any specific way. Those facts are workflow-specific, vendor-specific, and configuration-specific. They are described in the Statement of Work for the workflow.

  The customer is responsible for any business associate agreement, data processing agreement, or similar contract required between the customer and any third-party vendor that processes customer information through the workflow.

• 13. Master Services Agreement and Statement of Work

  Each build engagement is governed by a written Master Services Agreement ("MSA") and a workflow-specific Statement of Work ("SOW"). The MSA and SOW define scope, exclusions, assumptions, customer responsibilities, acceptance criteria, payment terms, change process, intellectual property, confidentiality, limitation of liability, and termination.

  These Terms describe the general scope and boundary of AI Automation engagements. The MSA and SOW govern the specific engagement. Where these Terms and the MSA or SOW conflict, the MSA or SOW controls.

• 14. Limitation of liability

  To the maximum extent permitted by law, Agate's total cumulative liability arising out of or relating to any AI Automation engagement is limited to the amount paid by the customer to Agate for the specific engagement during the twelve (12) months preceding the claim. Agate is not liable for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits, lost revenue, lost data, regulatory fines, or penalties, even if Agate has been advised of the possibility of such damages.

• 15. Acceptable use

  Agate workflows and deliverables are licensed for the customer's own business use. The customer may not resell, redistribute, or repackage Agate's deliverables as a competing product or service. The customer may not use Agate's deliverables to make or materially influence consequential decisions about individuals, regardless of whether such use is disclosed to Agate.

• 16. Changes to these Terms

  Agate may update these Terms as services, market conditions, vendor relationships, or applicable laws change. The version of these Terms in effect on the date the customer signs an MSA or SOW applies to that engagement.

• 17. Governing law

  These Terms are governed by the laws of the State of Colorado, without regard to conflict-of-law rules. Disputes arising out of or relating to these Terms shall be resolved in the state or federal courts located in Denver, Colorado.

Software, not legal advice. Agate Cybersecurity LLC, 801 Wyandot Street, Denver, Colorado 80204. For questions about these Terms, contact Agate through the Contact page. For security reports, see the Security and Vulnerability Disclosure page.