Terms of Service

1. Acceptance & scope of these terms

These Terms of Service ("Terms") are a legal agreement between you and TraceHold B.V. ("Tracehold", "we", "us"), formerly Verifia, established in the European Union at Werfkade 25, 1033 TA Amsterdam, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 97572896, VAT number NL868118278B01.

These Terms govern your access to and use of this website and of the free Tracehold browser extension (together, the "Service").

The paid Insight and Governance plans, including the product components delivered with them, are not governed by these Terms. They are governed by the EULA and by the offer or order you sign with us, which set the price, payment, duration and renewal. If you are an organisation customer, a separately signed agreement or Data Processing Agreement prevails over these Terms where they conflict.

By installing, accessing or using the Service, you confirm that you have read and agree to be bound by these Terms and by our Privacy Policy. If you do not agree, do not use the Service.

If you use Tracehold on behalf of an organisation, you confirm that you are authorised to accept these Terms for that organisation, and "you" includes that organisation.

2. The Service and plans

Tracehold is an AI-native data loss prevention (AI DLP) tool. It detects sensitive data, such as passwords, API keys, source code, personal data and confidential documents, in the browser, or on the endpoint for the endpoint agents, before it is sent to AI tools, and can warn, redact or block according to the active policy. It covers more than 300 AI tool domains with more than 1,600 detection rules.

Free extension

The free extension needs no account and no console. It makes limited, pseudonymous requests to Tracehold servers for usage statistics, as the Privacy Policy describes; apart from the reports you choose to send, the content of your prompts, messages and files is not sent. It is provided at no charge and on an "as is" basis (see section 8).

Paid plans

Our paid plans add centralised management, audit and compliance reporting for organisations:

• Insight: detection, Shadow AI discovery, console, block, warn and redact policies, file scanning and alerts.
• Governance: everything in Insight, plus compliance reporting, multi-tenant spaces and the LLM classifier (beta).

Both plans are priced per user and quoted for your team; we do not publish prices. In managed deployments, detection still runs in the browser or on the endpoint, and the console receives event data as the Privacy Policy describes. With the Governance plan, reports and evidence are mapped to GDPR, EU AI Act, DORA, NIS2, ISO 27001 and SOC 2 controls; they support your audits and are not legal advice or a certification. There is no service level (availability or response times) unless it is agreed in writing in your order.

3. Accounts & eligibility (business use)

The Service is a workplace security tool for professional use, intended for organisations and professionals. It is not directed to consumers or to anyone under 16, and you must be capable of entering into a binding contract to use it.

The free extension does not require an account. Paid plans require an account, which an organisation typically provisions and manages, including sign-in through its own identity provider (OIDC or LDAP/AD). You are responsible for keeping account credentials confidential, for activity under your account, and for ensuring that the people you grant access are authorised. Notify us promptly of any suspected unauthorised use.

4. The free extension licence

Subject to these Terms, we grant you a limited, revocable, non-exclusive, non-transferable and non-sublicensable licence to install and use the free Tracehold browser extension on devices you control, for your own internal data-loss-prevention purposes.

This licence does not transfer any ownership in the Service. You may not:

• copy, modify, translate or create derivative works of the extension, except as permitted by applicable mandatory law;
• reverse engineer, decompile or disassemble it, except to the limited extent such restriction is prohibited by law;
• rent, lease, sell, sublicense or redistribute it, or make it available to third parties as a service;
• remove or alter any proprietary notices, or circumvent any technical limitations or signature/verification mechanisms.

We may update, change or discontinue the free extension at any time, and we may revoke this licence if you breach these Terms. The free extension is provided without a paid subscription and without any service-level commitment.

5. Acceptable use

You agree to use the Service lawfully and only for its intended purpose. You must not:

• use the Service in violation of any applicable law or third-party right;
• interfere with, disrupt, overload or attempt to gain unauthorised access to the Service, its infrastructure, or other users' data;
• probe, scan or test the vulnerability of the Service except under a permission we have given in writing;
• use the Service to build a competing product, or to scrape, harvest or replicate its detection rules or content;
• misrepresent the Service's behaviour, or rely on it as a sole or complete safeguard against data loss (it is one layer among the controls your organisation should maintain).

We may suspend or limit access to protect the Service, its users, or to comply with the law.

6. Intellectual property

The Service, including the extension, the agents, the website, the detection rules, software, designs, text, graphics and the Tracehold and Verifia names and logos, is owned by TraceHold B.V. or its licensors and is protected by intellectual-property laws. Except for the limited licence in section 4, no rights are granted to you, whether by implication, estoppel or otherwise.

You retain all rights in your own data and content. You grant us only the limited rights needed to provide the Service to you, for example processing event data in a managed deployment as described in our Privacy Policy. If you send us feedback or suggestions, you grant us a non-exclusive, perpetual, royalty-free licence to use them to improve the Service, without obligation to you.

7. Third-party and AI tools: disclaimer

The Service helps you manage what is sent to AI tools and other third-party services (such as ChatGPT, Claude, Gemini and Copilot), and it can integrate with third-party systems, for example identity providers (OIDC, LDAP/AD), SIEM (Splunk HEC or CEF over HTTPS), alerting (Slack, Microsoft Teams), and deployment via Microsoft Intune or standard MDM.

Those third-party tools and services are operated by others under their own terms and policies, over which we have no control and for which we are not responsible. We do not endorse them, and your use of them is at your own risk and subject to their terms. AI tools can change behaviour, interfaces and outputs without notice; we cannot promise that the Service will detect every possible disclosure across every tool, or that a given integration will remain available. You are responsible for verifying outputs of any AI tool and for your own compliance obligations.

8. Disclaimer of warranties

To the maximum extent permitted by law, the Service is provided "as is" and "as available", without warranties of any kind, whether express, implied or statutory, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement.

We do not warrant that the Service will be uninterrupted, error-free or secure, that it will detect or prevent all sensitive-data disclosures, or that defects will be corrected. The Service is one safeguard among the controls you should maintain; it does not replace your own security, governance and compliance measures. Regarding certifications: Tracehold does not currently hold ISO 27001, SOC 2 or any equivalent certification; its reports and evidence are mapped to ISO 27001 and SOC 2 controls to support your audits, and are not legal advice or a certification. Nothing on this site states that Tracehold holds a certification. Nothing in these Terms excludes liability or warranties that cannot lawfully be excluded under mandatory law.

9. Limitation of liability

To the maximum extent permitted by law:

• we are not liable for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data, goodwill or business, arising out of or relating to the Service, even if advised of the possibility;
• for the website and the free extension, which are provided at no charge, we have no liability except for damage caused by our wilful misconduct or gross negligence; and
• for paid plans, our liability is governed by the EULA and the signed order; unless they provide otherwise, our total aggregate liability arising out of or relating to the paid service is limited to the amount you paid us for it in the 12 months before the event that gave rise to the claim.

Nothing in these Terms limits or excludes liability that cannot be limited or excluded by law, including liability for wilful misconduct or gross negligence, for death or personal injury, for fraud, or under mandatory provisions of applicable law. These allocations of risk reflect the basis on which we make the Service available.

10. Term & termination

These Terms apply for as long as you use the Service. You may stop using it at any time; for the free extension, by uninstalling it. The term, renewal and cancellation of a paid plan are governed by the signed order and the EULA.

We may suspend or terminate your access if you breach these Terms, if required by law, or to protect the Service or its users. On termination, the licence in section 4 ends and you must stop using the Service. Provisions that by their nature should survive, including intellectual property (section 6), disclaimers (sections 7 and 8), limitation of liability (section 9), governing law (section 11) and this sentence, survive termination.

11. Governing law & jurisdiction

These Terms are governed by the laws of the Netherlands, without regard to conflict-of-laws rules, and subject to any mandatory protective laws of your place of residence that cannot be derogated from by agreement.

The Amsterdam District Court (Rechtbank Amsterdam) has jurisdiction over any dispute arising out of or relating to these Terms or the Service, without prejudice to any non-waivable right you may have to bring proceedings, or have proceedings brought against you, in the courts of your place of residence.

12. Changes to these terms

We may update these Terms as the Service and the law evolve. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice (for example, on this page or within the Service). Your continued use of the Service after changes take effect means you accept the updated Terms; if you do not agree, you should stop using the Service.

13. Contact

Questions about these Terms?

• General & legal: hello@tracehold.com
• Privacy enquiries: privacy@tracehold.com
• Data protection contact: dpo@tracehold.com
• Post: TraceHold B.V., Werfkade 25, 1033 TA Amsterdam, Netherlands (KvK 97572896, VAT NL868118278B01)

Related pages: Security, Privacy, DPA and Subprocessors.