Guardrino Terms and Conditions

Guardrino Cloud and Guardrino Sovereign
HISNLABS CYBER AI - FZCO · IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates

1 About these Terms

1.1These Terms and Conditions ("Terms") govern the use of Guardrino, provided by HISNLABS CYBER AI - FZCO, a company licensed in the IFZA free zone, Dubai Silicon Oasis, Dubai, United Arab Emirates ("HisnLabs", "we", "us").

1.2They apply to the customer named in an order form, and to anyone who uses Guardrino, a trial or a demo ("Customer", "you"). By signing an order form, or by accessing or using Guardrino, you accept these Terms on behalf of yourself and the organisation you represent, and you confirm that you have authority to do so.

1.3If an order form or a signed agreement conflicts with these Terms, the signed document prevails only for the specific point it changes.

1.4Business use only. Guardrino is offered only to businesses, government bodies and other organisations for their professional purposes. It is not offered to consumers, and you confirm that you are not acting as a consumer. Where a law that cannot be excluded by agreement nevertheless treats you as a consumer, the rights it gives you are not affected.

2 Definitions

• Guardrino: the Guardrino security gateway, its models (including Guardrino-t7), rules, signatures, console, APIs, plugins, documentation and updates.
• Guardrino Cloud: Guardrino hosted and operated by HisnLabs, or by a hosting provider it selects, in a data centre in the United Arab Emirates unless agreed otherwise.
• Guardrino Sovereign: Guardrino licensed for installation and operation on infrastructure controlled by the Customer, including on-premises and private-cloud deployments.
• Request: any message, prompt, document, file, tool call, model output or other content that passes through or is checked by Guardrino.
• Decision: Guardrino's result for a Request, such as allow, block, mask, flag, score or label.
• Customer System: the Customer's applications, AI models, agents, tools, data and processes that Guardrino protects or connects to.
• End User: any person who interacts with a Customer System.

3 What Guardrino is, and what it is not

3.1A probabilistic defence layer. Guardrino uses machine-learning models, rules and heuristics to estimate whether a Request is an attack (such as prompt injection or a jailbreak attempt), contains personal data or secrets, or matches a policy. Its Decisions are statistical estimates. They depend on the wording, language, dialect, spelling, context and configuration, and they can change between versions, thresholds and settings.

3.2Errors will occur. Guardrino will make both kinds of error: false negatives (a harmful or malicious Request is allowed) and false positives (a legitimate Request is blocked or altered). Published or measured results, including comparisons on test sets, describe performance on specific data under specific settings. They are not a promise of performance on your traffic.

3.3One layer among several. Guardrino is designed to be one layer of a defence-in-depth approach. It does not replace secure application design, access control, authorisation of agent actions, monitoring, incident response or human review.

3.4Not a crisis, medical, legal or financial safeguard. Guardrino is not designed, tested or certified to detect, prevent or respond to self-harm, suicide, threats to life, medical emergencies, abuse, extremism, fraud or financial loss, and it is not a content-moderation service. Any content-safety feature is supplementary and must not be relied upon for these purposes. You must have your own procedures, staff and services for them.

3.5No sole reliance where people or money are at stake. You must not use Guardrino as the sole or decisive safeguard where a missed or wrong Decision could foreseeably lead to death, personal injury, harm to a person's health or safety, significant financial loss, or the violation of a person's legal rights.

3.6Emerging technology; no compliance by itself. Guardrino uses emerging technology. It is not designed or intended to meet your regulatory, legal or contractual obligations, and using it does not by itself make the Customer System compliant with any law, regulation or standard.

3.7Known limitations. HisnLabs publishes Guardrino's known technical limitations in its documentation, and you must take them into account. They include, at the date of these Terms:

1. detection quality varies by language, dialect, script and writing style, and is lower for languages and dialects Guardrino was not trained on;
2. very short messages, very long messages (only part of which may be analysed) and heavily encoded, encrypted or obfuscated content may not be detected;
3. attacks spread over several messages are only analysed when conversation memory is enabled, and only within its limits;
4. images, audio, video and files are only checked where a feature for them is enabled, and only for the text that can be extracted;
5. thresholds trade missed attacks against blocked legitimate messages: a stricter setting blocks more legitimate Requests, a looser one misses more attacks;
6. scores and Decisions can change when models, rules or signatures are updated, and your thresholds and policies may need to be recalibrated after an update.

3.8Intended purpose. Guardrino is intended solely to detect and filter security threats to AI systems, such as prompt injection, jailbreak attempts and the leakage of secrets or personal data in Requests. It is not designed, documented or marketed for any use listed in Annex III of Regulation (EU) 2024/1689 (the "EU AI Act"), or for any comparable use regulated as high-risk elsewhere, such as evaluating the creditworthiness of natural persons, recruitment, access to essential services, or use as a safety component of critical infrastructure. HisnLabs does not place Guardrino on the market as a high-risk AI system. For the purposes of the EU AI Act, HisnLabs is the provider of Guardrino and you are its deployer. If you use Guardrino, or its Decisions, scores or outputs, for any other purpose, in particular to make or materially influence decisions about natural persons, you are responsible for that use, and where that use makes an AI system high-risk, you act as its provider. You will notify HisnLabs in writing before integrating Guardrino into an AI system you classify as high-risk. On request, HisnLabs will enter into the written agreement contemplated by Article 25(4) of the EU AI Act on the information, technical access and assistance reasonably required, on terms and fees agreed in that agreement.

3.9AI literacy and documentation. HisnLabs provides documentation on how Guardrino works and on its known limitations. You are responsible for the AI literacy of your staff and of anyone operating Guardrino for you. On request, HisnLabs will provide the information about Guardrino reasonably required for your AI inventory, risk assessments or regulatory filings.

3.10No decisions about individuals. Decisions concern messages, not people. You must not use a Decision as the sole basis for a decision that produces legal or similarly significant effects for a natural person, and you must keep effective human oversight over any such decision.

4 Shared responsibility

4.1The principle. Protecting an AI system is a shared effort. HisnLabs is responsible for Guardrino itself: building, testing and updating its models, rules and software, and, for Guardrino Cloud, running the service. You are responsible for everything Guardrino protects and for how you use it: your AI models, agents and applications, their answers and actions, your configuration and policies, your End Users, and the safeguards around them. A Decision by Guardrino never transfers your responsibility for the Customer System to HisnLabs.

4.2Who does what.

4.3Where a row says "Customer", HisnLabs has no duty to perform that task, and HisnLabs is not responsible for the consequences of how it is performed or not performed. Where a row says "Shared", each party is responsible for its own part.

5 Your responsibilities

5.1In addition to section 4, you are solely responsible for:

1. the Customer System, its design, configuration and security, and every answer, action, transaction or decision it produces or takes, whether or not Guardrino checked the Request;
2. choosing, testing and monitoring Guardrino's configuration, policies and thresholds, including running it in watch-only mode before enforcing it, and reviewing its Decisions;
3. keeping appropriate human oversight and independent safeguards in place, especially for payments, account changes, personal data, health, safety and vulnerable people;
4. the lawfulness of the Requests you send, including having a lawful basis and giving any notices or obtaining any consents required by applicable data-protection law;
5. your relationship with your End Users, including your own terms, notices, complaint handling and any duty of care you owe them.

5.2Filters and settings. You are solely responsible for your use, non-use or modification of Guardrino's filters, policies and thresholds, including changes HisnLabs makes at your request, and for disregarding Guardrino's documentation or recommendations.

5.3You must not use Guardrino to break the law, to attack or test systems you are not authorised to test, to develop attacks, to build or train a similar or competing product or service, or to reverse-engineer, extract or copy its models, except as allowed by an open-source licence for components released under one.

5.4Authorised testing. You confirm that you are authorised to route, inspect and test all Requests and systems you connect to Guardrino. You will obtain written authorisation from the system owner before any red-team, penetration or adversarial testing of a system you do not own.

6 Guardrino Cloud

6.1HisnLabs operates Guardrino Cloud and processes Requests only to provide, secure and support the service, in accordance with section 12 and the Data Processing Addendum.

6.2Unless an order form states a service-level agreement, Guardrino Cloud is provided on a reasonable-efforts basis and may be unavailable, slow or interrupted, including for maintenance, updates and events outside our control.

6.3HisnLabs may monitor the use of Guardrino Cloud through automated means, to protect the security and integrity of the service and to enforce these Terms.

6.4We may suspend access to protect the service, other customers or third parties, or if fees are overdue, with notice where reasonably possible.

6.5Hosting location. HisnLabs offers Guardrino Cloud in a cloud region in your country, or, where none is available, in the nearest available region. The location is stated in your order form; where the order form states none, it is the United Arab Emirates. Requests are stored and processed only in that location, in a data centre operated by a hosting provider listed in the sub-processor list. HisnLabs will not move Request storage or processing to another country without at least ninety (90) days' prior written notice. If the move would breach a legal or regulatory requirement that applies to you, you may terminate the affected service without penalty before the change takes effect. Guardrino Cloud hosted outside your country is not a substitute for in-country hosting where your law or regulator requires it (see section 17). Where your AI models run, and where Guardrino forwards Requests after checking them, is your choice and your responsibility.

7 Guardrino Sovereign

7.1Guardrino Sovereign runs on infrastructure you control. HisnLabs has no access to it or to its Requests unless you grant access for support.

7.2HisnLabs is not responsible for results caused by your environment, by versions you have not updated, or by changes not made by HisnLabs.

7.3You must protect Guardrino's software, models and weights against unauthorised access and copying, and notify HisnLabs without undue delay of any unauthorised access to them, with the details known and the measures taken.

7.4Guardrino Sovereign is licensed, not sold. Subject to payment and these Terms, HisnLabs grants you a non-exclusive, non-transferable licence to install and use it for your internal business purposes during the subscription term, on the deployments stated in the order form.

7.5Support access. HisnLabs accesses Guardrino Sovereign only when you initiate and authorise it, for the period you set, using access you control and log. Support may be provided from the United Arab Emirates. Where your law or regulator requires support to be provided from within your country, or prohibits remote access, you must tell us before granting access, and the order form will state how support is provided.

7.6Vulnerability handling. HisnLabs maintains a coordinated vulnerability-disclosure policy and provides security updates for each supported version of Guardrino Sovereign during the support period stated in the documentation, which is not less than five (5) years from a version's release or the length of your subscription, whichever is shorter. HisnLabs meets its reporting obligations as a manufacturer under Regulation (EU) 2024/2847 (the Cyber Resilience Act) where it applies. You will report suspected vulnerabilities to [email protected] and install security updates within the time stated in the advisory.

8 Trials, demos and open models

8.1Trials, demos, previews and features marked as beta are provided for evaluation only, "as is", free of charge unless agreed otherwise, without any service level, and may be changed, suspended or withdrawn at any time without notice. Unless agreed in writing, you should not use them to process personal data or data subject to regulatory requirements.

8.2Models and code that HisnLabs publishes under an open-source licence (for example on Hugging Face or GitHub) are governed by that licence. They are provided "as is", without warranty, and these Terms do not add any warranty or support obligation to them.

9 No warranties

9.1To the fullest extent permitted by applicable law, Guardrino is provided "as is" and "as available". HisnLabs makes no warranty, representation or guarantee, whether express, implied or statutory, including any warranty that Guardrino will detect or block every attack, harmful message, piece of personal data or policy violation; that it will not block legitimate Requests; that it will be uninterrupted or error-free; or that it is fit for a particular purpose.

9.2Nothing said in marketing material, demos, presentations, test results or comparisons is a warranty unless it is written into a signed agreement as a warranty.

10 Limitation of liability

10.1Nature of the service. You acknowledge that Guardrino is a probabilistic tool and that Decisions will sometimes be wrong (section 3). A false negative (a harmful or malicious Request that is allowed) or a false positive (a legitimate Request that is blocked or altered) is not, in itself, a breach of these Terms by HisnLabs, whatever its consequences for you, your End Users or any other person. HisnLabs is in breach only if it fails to perform an obligation that these Terms or an order form expressly give it.

10.2Excluded losses. Subject to section 10.4, and to the extent permitted by the law applicable to these Terms, HisnLabs is not liable under or in connection with these Terms for:

1. loss of profit, revenue, business, contracts or anticipated savings;
2. loss of goodwill or reputation;
3. loss or corruption of data, except the cost of restoring it from your last backup where the loss was caused by HisnLabs's breach;
4. fraudulent or unauthorised transactions carried out by or through the Customer System;
5. fines or penalties imposed on you, except to the extent the law allows them to be recovered and they result from HisnLabs's breach of section 12 or the Data Processing Addendum; and
6. indirect or consequential loss.

10.3Cap. Subject to section 10.4, each party's total aggregate liability arising out of or in connection with these Terms in any twelve-month period is limited to the fees paid and payable for Guardrino in the twelve (12) months before the event giving rise to the claim. This cap does not apply to your obligation to pay fees. For trials, demos and other free use, HisnLabs's total liability is limited to one thousand US dollars (USD 1,000), to the extent permitted by applicable law.

10.4Unlimited matters. Nothing in these Terms excludes or limits:

• (a) liability for fraud, deceit or wilful misconduct;
• (b) liability for gross negligence, which in these Terms means a serious and conscious disregard of an obvious risk, going well beyond a failure to exercise reasonable care;
• (c) liability for death or personal injury caused by a party's own negligence or wrongful act;
• (d) liability for a harmful act (tortious liability) to the extent the applicable law does not allow it to be excluded or limited; or
• (e) any other liability that cannot be excluded or limited under the applicable law.

Where the law allows a limitation only in part, it applies to the maximum extent allowed.

10.5Allocation of risk. These limits reflect the probabilistic nature of Guardrino, the fees, the responsibilities allocated in sections 4 and 5, and your ability to protect yourself through configuration, human oversight and insurance. The parties negotiated them as an essential basis of the bargain.

11 Indemnities

11.1By you. You will indemnify HisnLabs against third-party claims, and against fines a regulator imposes on HisnLabs, to the extent they arise from:

• (a) the Customer System and its answers, actions, transactions or decisions;
• (b) Requests you or your End Users submit in breach of these Terms or of applicable law;
• (c) your use of Guardrino contrary to sections 3.5, 3.8, 3.10 or 5.3; or
• (d) your breach of data-protection law as controller.

11.2By HisnLabs. HisnLabs will indemnify you against third-party claims that Guardrino, as provided by HisnLabs and used in accordance with these Terms, infringes that third party's intellectual property rights, and against claims and fines to the extent they arise from HisnLabs's breach of section 12 or the Data Processing Addendum.

11.3Exceptions and procedure. Neither party must indemnify the other to the extent the claim results from the other party's breach, negligence or wilful misconduct. The indemnified party must notify the claim promptly, let the indemnifying party control the defence, and cooperate reasonably. Indemnities for fines apply only where the law allows them. Section 11.2 is subject to section 10.3; section 11.1 is not.

12 Data and confidentiality

12.1You keep all rights in your Requests and data. HisnLabs does not use Requests or Customer data to train or improve its models, or for any purpose other than providing, securing and supporting Guardrino for you, unless you opt in under section 12.7.

12.2Each party keeps the other's confidential information confidential and uses it only to perform these Terms, except where disclosure is required by law.

12.3Data processing. Where HisnLabs processes personal data in Requests on your behalf, you are the controller (or a processor acting for your client) and HisnLabs is your processor (or sub-processor), within the meaning of UAE Federal Decree-Law No. 45 of 2021, the Saudi Personal Data Protection Law (Royal Decree M/19, as amended), Qatar Law No. 13 of 2016, Bahrain Law No. 30 of 2018, Oman Royal Decree 6/2022, Regulation (EU) 2016/679 (GDPR), the UK GDPR, and any other applicable data-protection law. The HisnLabs Data Processing Addendum ("DPA") forms part of these Terms. HisnLabs processes such data only on your documented instructions, including those given through your configuration; keeps it confidential; protects it with the security measures in the DPA; uses only the sub-processors on the published list, with thirty (30) days' notice of changes and a right to object; helps you respond to data-subject requests and carry out impact assessments; and deletes or returns it at the end of the service. Where these Terms and the DPA conflict on personal data, the DPA prevails.

12.4International transfers. Where personal data subject to the GDPR, the UK GDPR or the Saudi Personal Data Protection Law is sent to Guardrino Cloud hosted outside the country or region where that law requires a transfer mechanism, the standard contractual clauses in the DPA apply (EU Commission Decision (EU) 2021/914, Module 2 or 3; the UK Addendum; or the SDAIA standard contractual clauses), without modification, and prevail over these Terms to the extent of any conflict. You are responsible for any transfer impact or risk assessment and for any consent, approval or permit required for the transfer. HisnLabs will give you the information reasonably needed for that assessment.

12.5Security incidents. HisnLabs will notify you without undue delay, and in any event within twenty-four (24) hours of becoming aware, of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your data processed by HisnLabs. The notice will include the information then available: the nature of the incident, the categories and approximate volume of data affected, likely consequences, and measures taken or proposed. HisnLabs will update you as more information becomes available, so that you can meet your own deadlines to notify regulators and individuals. Notifying regulators and data subjects is your responsibility as controller, unless the law places it on HisnLabs.

12.6Regulated customers. If you are a bank, insurer or other financial institution, a government entity, an operator of critical infrastructure, or an entity subject to Regulation (EU) 2022/2554 (DORA) or Directive (EU) 2022/2555 (NIS2), HisnLabs will agree to its Regulated Customer Addendum. That addendum provides, as your regulator requires:

• (a) access, audit and inspection rights, including on-site visits, for you, your auditors and your regulators (including the Central Bank of the UAE, the Saudi Central Bank (SAMA), the Qatar Central Bank, the Central Bank of Bahrain and EU competent authorities) and their appointed agents;
• (b) cooperation with those regulators and provision of the information they require;
• (c) prior approval of subcontracting that involves your confidential data, and flow-down of these obligations;
• (d) data ownership, unrestricted access to your data during the term and on termination, and secure return or destruction at exit;
• (e) service locations and notice of changes;
• (f) incident assistance, business continuity and testing, including participation in threat-led penetration testing where required; and
• (g) exit and transition assistance for a period stated in the order form.

You are responsible for obtaining any regulatory approval, non-objection or notification that applies to you before using Guardrino.

12.7Model improvement (opt-in).

• (a) Off by default. HisnLabs uses Requests to train, evaluate or improve its models only if you opt in, through a signed order form or a setting in the console that only an administrator can change. Every change of that setting is recorded in the audit log. You may withdraw at any time, with effect for Requests shared after the withdrawal.
• (b) What is shared. Only the Requests you choose to share are used, such as reviewed false positives and missed attacks. You can review them before they are shared. With Guardrino Sovereign, nothing is sent automatically: the console prepares an export file that you review and send yourself.
• (c) Safeguards. Before use, HisnLabs removes or masks personal data and secrets it can detect, keeps the shared Requests apart from other customers' data, uses them only to improve Guardrino's detection, never sells them or shares them with third parties other than its sub-processors, and never publishes them. Models trained with them contain no Request in readable form, and HisnLabs does not use them to identify you or your End Users.
• (d) Your responsibility. You confirm that you have a lawful basis, and any notice or consent your law requires, before you share Requests that may contain personal data. Opting in does not change your other rights under these Terms or the DPA.

12.8Service metrics. HisnLabs may collect and use aggregated technical metrics about the operation of Guardrino Cloud, such as request counts, latency, error rates, Decision counts by category and model version, to operate, secure, bill, support and improve the service, and to publish aggregated statistics that do not identify you or any End User. These metrics never contain the text of a Request or personal data. With Guardrino Sovereign, metrics are sent to HisnLabs only if you enable it.

13 Intellectual property

HisnLabs and its licensors own Guardrino, including its models, weights, rules, signatures, software and documentation, the names "Guardrino" and "HisnLabs", and their logos. Except for the rights expressly granted in these Terms or an open-source licence, no right is transferred. HisnLabs may use any feedback you give freely.

14 Fees, term and termination

14.1Fees, the subscription term and payment terms are set out in the order form. Fees exclude VAT and other taxes, which you pay where applicable.

14.2Either party may terminate for material breach not remedied within thirty (30) days of written notice. On termination you stop using Guardrino and, for Guardrino Sovereign, uninstall it and confirm this in writing.

14.3Sections 3, 4, 5, 9, 10, 11, 12, 13, 15, 16 and 17 survive termination.

15 Governing law and disputes

15.1These Terms are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, unless section 17 or the order form provides otherwise.

15.2Any dispute arising out of or in connection with these Terms will be finally resolved by arbitration under the Arbitration Rules of the Dubai International Arbitration Centre (DIAC), by a sole arbitrator, seated in Dubai, in the English language, unless section 17 or the order form provides otherwise.

15.3Where a party is a government entity that, under the law applicable to it, may agree to arbitration only with a prior approval it has not obtained, the dispute will instead be decided by the competent courts identified in section 17 for that party's country, or failing that by the courts of Dubai.

15.4Each party may seek urgent interim relief from any competent court.

16 General

16.1Changes. We may update these Terms. We will give at least thirty (30) days' notice of material changes for paid subscriptions; continued use after that date means acceptance.

16.2Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control.

16.3Entire agreement, severability, assignment. These Terms and the order form are the entire agreement on their subject. If a provision is held invalid, the rest remains in force and the invalid provision is applied to the maximum extent permitted. You may not assign these Terms without our written consent.

16.4Language. These Terms are written in English. Where the law applicable to a party requires a contract to be in Arabic, or where a government entity requires it, the parties will sign an Arabic version, and that version prevails to the extent the law requires. Otherwise, translations are for convenience, and the English version prevails to the extent permitted by law. The parties agree that, where the procedure allows, any proceedings may be conducted in English.

16.5Notices. Notices must be in writing to the addresses in the order form, or, for HisnLabs, to its registered address above.

16.6Export control and sanctions. Each party will comply with the export-control and sanctions laws that apply to it, including those of the United Arab Emirates (including Cabinet Resolution No. 74 of 2020 and Federal Decree-Law No. 43 of 2021), the United Nations Security Council, the Kingdom of Saudi Arabia, the State of Qatar (including Law No. 27 of 2019), the European Union and its Member States, the United Kingdom and, where applicable, the United States (including regulations administered by OFAC and the Export Administration Regulations). You represent that neither you, nor any person owning or controlling you (individually or in aggregate, 50 percent or more), nor any End User you authorise, is designated or blocked under those laws, or located, organised or ordinarily resident in a country or territory subject to comprehensive sanctions. You will not access, use, export, re-export or transfer Guardrino in breach of those laws, or for any military or other end use or end user they prohibit. HisnLabs may suspend or terminate with immediate effect, without liability, if it reasonably believes that continuing would breach those laws or expose it to sanctions.

17 Regional terms

17.1Application. This section applies in addition to the rest of these Terms where you are established in, or send Requests containing personal data of individuals in, the country concerned. It prevails to the extent of any conflict. Nothing in it reduces protections that the law of that country makes mandatory.

17.2United Arab Emirates.

• (a) HisnLabs processes personal data as your processor under Federal Decree-Law No. 45 of 2021 and notifies personal-data breaches under section 12.5.
• (b) Guardrino Cloud does not change the obligations you have under any banking, health, government or free-zone rules that exclude or add to that Decree-Law. If you are licensed by the Central Bank of the UAE, the Regulated Customer Addendum applies, and you are responsible for any non-objection required for material outsourcing and for keeping your confidential data and master system of record in the UAE. You must not send health data relating to health services provided in the UAE to Guardrino Cloud hosted outside the UAE, except under an exception permitted by law. If you are a Dubai Government or semi-government entity, or an entity designated under the UAE Information Assurance Regulation, Guardrino Cloud will be hosted only in a UAE data centre meeting the hosting requirements that apply to you, as stated in the order form.
• (c) If you are a federal or local government entity whose agreement to arbitrate requires prior approval, section 15.3 applies until the approval is obtained.

17.3Kingdom of Saudi Arabia.

• (a) Processor terms. For personal data subject to the Saudi Personal Data Protection Law, you are the controller and HisnLabs the processor; HisnLabs will not engage a sub-processor without your prior approval given under the DPA, and notifies breaches within twenty-four (24) hours under section 12.5 so that you can notify SDAIA within the time required.
• (b) Data location. Guardrino Cloud is hosted in the location stated in your order form (section 6.5); where that location is outside the Kingdom, transfers to it are made under section 12.4 using the SDAIA standard contractual clauses. Where Saudi law or your regulator requires data to be stored or processed in the Kingdom, you will use Guardrino Sovereign deployed in the Kingdom, or a Kingdom-hosted deployment offered in an order form.
• (c) Government and classified data. You must not send to Guardrino Cloud hosted outside the Kingdom any data of a Saudi government entity, data classified above Public under the national data-classification rules, or data your regulator requires to be kept in the Kingdom. Remote support of Guardrino Sovereign for such customers takes place only under section 7.5, from a location the order form permits.
• (d) SAMA-supervised customers. If you are supervised by the Saudi Central Bank, the Regulated Customer Addendum applies, including SAMA access and audit rights, approval of subcontracting, no secondary use of data and exit assistance. You are responsible for any SAMA no-objection.
• (e) Governing law and disputes. Where you are a Saudi government entity, or the order form so states, sections 15.1 and 15.2 are replaced as follows: these Terms are governed by the laws of the Kingdom of Saudi Arabia, and disputes are resolved by arbitration under the Rules of the Saudi Center for Commercial Arbitration, seated in Riyadh, where any approval required by law has been obtained, and otherwise by the competent courts of the Kingdom.
• (f) Arabic. Where you are a Saudi government entity, an Arabic version will be signed and will prevail.
• (g) Liability. Nothing in sections 10 or 11 excludes or limits liability for fraud, deceit, gross negligence, wilful misconduct or a harmful act where the Saudi Civil Transactions Law does not allow it.

17.4State of Qatar.

• (a) Processor terms. For personal data subject to Law No. 13 of 2016, HisnLabs, as your processor, takes the precautions required by Article 13, notifies you of any breach or risk within twenty-four (24) hours, and gives you the information and assistance reasonably needed to verify and monitor its compliance under Article 11, including for a privacy impact assessment before processing outside Qatar. You must not send personal data of a special nature unless you hold any permit required under Article 16. If you are established in the Qatar Financial Centre, the QFC Data Protection Regulations and the DPA apply instead.
• (b) Data location. Where a law, regulation or regulator's instruction requires data to be processed or stored in Qatar, including the Qatar Central Bank cloud computing regulation and the national cloud policy, you must use Guardrino Sovereign deployed in Qatar, or a Qatar location agreed in an order form.
• (c) QCB licensees and government entities. If you are licensed by the Qatar Central Bank or are a government entity, the Regulated Customer Addendum applies, and HisnLabs will provide the documentation reasonably needed for your AI register, risk assessments and any QCB approval. You are responsible for obtaining any approval required.
• (d) Arabic. Where you are a ministry, government body, public institution or state-financed institution, an Arabic version will be signed and will prevail to the extent Law No. 7 of 2019 requires.
• (e) Arbitration. Section 15.2 applies only if any approval required by Article 2(2) of Law No. 2 of 2017 has been obtained; otherwise these Terms are governed by Qatari law and disputes go to the competent courts of Qatar.
• (f) Liability. Nothing in sections 10 or 11 excludes or limits liability for fraud or gross negligence, or liability for an unlawful act to the extent Article 259 of the Civil Code does not allow it.

17.5Kingdom of Bahrain.

• (a) HisnLabs acts as your processor under Law No. 30 of 2018 and notifies breaches under section 12.5.
• (b) You are responsible for confirming that the United Arab Emirates remains on the list of countries the Personal Data Protection Authority recognises as providing adequate protection.
• (c) If you are licensed by the Central Bank of Bahrain, the Regulated Customer Addendum applies. Where the CBB Rulebook requires encryption keys to remain under your control, you will use Guardrino Sovereign or the key-management arrangement stated in the order form.
• (d) The parties agree that proceedings before the courts of Bahrain or the Bahrain Chamber for Dispute Resolution may be conducted in English, to the extent permitted.

17.6State of Kuwait and Sultanate of Oman.

• (a) You must not send to Guardrino Cloud data that Kuwaiti rules require to be hosted in Kuwait, including Level 3 and 4 data of government bodies, the state oil sector or the Central Bank of Kuwait. For such data you will use Guardrino Sovereign.
• (b) For personal data subject to Oman's Personal Data Protection Law (Royal Decree 6/2022), you are responsible for meeting the conditions for transfer outside Oman, including any risk assessment and consent. HisnLabs will provide reasonable information to support your assessment.

17.7European Union and United Kingdom. Sections 3.8 to 3.10, 7.6, 12.3 to 12.6 and the DPA apply. Where you are subject to DORA or NIS2, the Regulated Customer Addendum includes the contractual provisions required by Article 30 of Regulation (EU) 2022/2554 and the supply-chain measures under Article 21 of Directive (EU) 2022/2555.

Guardrino™ is a trademark of HISNLABS CYBER AI - FZCO.