Terms of service

1. This agreement

These terms govern your use of the Relynt website and platform. By opening a workspace, or by using one that someone opened for you, you accept them.

Relynt is operated by LAZO Group, a société par actions simplifiée registered in France under SIREN 983 329 442 at the RCS of Evry, whose registered office is at 3 rue Lamartine, 91320 Wissous, France. Throughout these terms "we" and "us" mean that company. You can reach us at support@relynt.io, and the full registration details are on the mentions légales page.

Where we have signed a separate order form or master agreement with your organisation, that document governs and these terms fill the gaps. Nothing here reduces a right you have under mandatory law in your country.

We may update these terms. For a change that materially affects your rights we tell workspace administrators by email at least thirty days before it takes effect, and if you do not accept it you may cancel and receive a refund of the unused part of any prepaid term.

2. What the service is

Relynt is software for managing ICT third-party risk under Regulation (EU) 2022/2554. It holds a provider inventory, vendor qualification records, assessments, evidence, contracts and their Article 30 analysis, a risk register, a resilience testing programme, management body reporting and a Register of Information assembled from those records.

It is a tool that supports your compliance work. It does not perform that work for you, and the next section is the most important one in this document.

3. What the service is not

Relynt does not provide legal, regulatory, audit or accounting advice. It does not determine whether your entity falls within the scope of DORA, whether a function is critical or important, whether a provider is a critical ICT third-party service provider, or whether an arrangement satisfies a regulatory requirement. Those are judgements for you and your advisers.

Nothing the platform produces is a regulatory filing, a legal opinion or a certification. A Register exported from Relynt is your Register, prepared by you, and you are responsible for what you submit to a competent authority.

We are not a party to your relationship with your supervisor, and we do not report on your behalf.

4. Model-assisted review

Where a workspace enables it, the platform uses a language model to read a contract, an assessment response or an evidence document, and to suggest findings. Every suggestion is labelled as model-generated and carries a confidence value.

A suggestion never changes a compliance status by itself. A person accepts or rejects it, and that decision is recorded with their name and the time. You remain responsible for every conclusion recorded in your workspace, whether a model proposed it or not.

Model output can be wrong. It can miss a clause that exists and assert one that does not. Treat it as a reviewer who is fast, tireless and occasionally mistaken, which is why the product is built so that no finding takes effect without a human decision.

An administrator can switch the feature off at any time, in which case review runs a deterministic rule-based pass and no document text is sent to a third party.

5. Accounts and access

A workspace belongs to the organisation that subscribed, not to the individual who opened it. The organisation decides who has access and at what role.

You are responsible for the accounts in your workspace: keeping credentials secure, removing people who leave, and choosing whether to require two-factor authentication. We provide the controls; the decisions are yours.

Tell us promptly at support@relynt.io if you believe an account has been compromised.

6. Plans, trials and limits

Every plan runs a complete DORA programme. Plans differ by the size of the provider portfolio, the number of users and whether model-assisted review is included.

A subscription begins with a fourteen-day free trial. A payment method is taken at checkout and charged when the trial ends. Cancel before then from the billing page and nothing is charged.

Plan limits are enforced when you add a record, never retroactively. If you move to a smaller plan you keep everything you have; you simply cannot add more until you are back inside the limit.

• Essential: 50 ICT providers, 5 users, rule-based review.
• Professional: 100 ICT providers, 15 users, model-assisted review included.
• Enterprise: limits, terms and support agreed in an order form.

7. Payment

Subscriptions are billed in advance, monthly or annually, through our payment processor. Prices are exclusive of VAT, which is added where applicable and calculated from the billing address and VAT number you provide.

If a payment fails, the processor retries on its own schedule and we show a notice in the workspace. Access continues while that is happening. If the subscription ultimately ends unpaid, the workspace becomes read-only: you can still see and export everything, and you cannot add or change records until payment resumes.

Annual subscriptions are not refunded part-way through a term except where these terms or mandatory law say otherwise.

8. Acceptable use

Use the platform for managing your own ICT third-party risk. Do not do any of the following.

• Attempt to access another customer's workspace, or probe the isolation between them, other than through a security test we have agreed in writing.
• Upload malware, or content you have no right to upload.
• Resell, sublicense or provide the platform as a service to a third party, unless we have agreed that in an order form.
• Use the platform to send unsolicited messages, including through the vendor portal.
• Interfere with the service's availability for anyone else, including by automated load beyond ordinary use.
• Remove or obscure notices of ownership in anything we provide.

9. Your data

Your workspace content is yours. We claim no ownership of it, and we use it only to provide the service to you, to keep it secure, and where the law requires.

We do not use customer workspace content to train machine learning models.

We process personal data in that content as your processor, on the terms of our data processing agreement, published at /dpa. It takes effect when a workspace is opened, so it binds us whether or not anyone signs it, and it prevails over these terms in any conflict about personal data. The privacy notice explains the detail.

An administrator can export the whole workspace as a single file at any time, and can delete it permanently. We do not hold your data hostage at the end of a relationship.

10. Availability and support

We aim for the platform to be available at all times, and we do not promise that it will be. There is no uptime commitment on Essential or Professional. An Enterprise order form may include one, together with the remedies that go with it.

We carry out maintenance that can briefly interrupt the service. Where we can foresee it, we give notice to workspace administrators.

Support is by email to support@relynt.io. We aim to respond within one business day.

Security incidents are handled under our published incident response process, including the severity levels and the windows in which we notify affected customers.

11. Changes to the service

We improve the platform continuously, and most changes add to it. If we remove or materially degrade a feature you are relying on, we give workspace administrators at least sixty days' notice, and you may cancel for a pro-rata refund of the unused prepaid term if the change matters to you.

We do not give notice for changes that only affect a feature marked as unavailable or contracted separately.

12. Intellectual property

We own the platform, its software, design and documentation. You receive a non-exclusive, non-transferable right to use it for the term of your subscription, for your own organisation's compliance work.

Feedback you send us is welcome and we may act on it freely, without obligation to you and without it affecting your rights in your own data.

13. Liability

Nothing in these terms excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

Subject to that, neither party is liable for indirect or consequential loss, loss of profit, loss of anticipated savings, or loss of goodwill, and our total liability arising out of or in connection with the agreement in any twelve-month period is limited to the fees you paid us in that period.

We are not liable for a regulatory outcome, a supervisory finding, a penalty or a loss arising from a compliance decision you recorded in the platform. The judgement in that decision is yours, and section 3 explains why.

The platform is provided as it is. We exclude implied warranties to the extent the law allows.

14. Confidentiality

Each of us will keep the other's confidential information confidential, use it only for the agreement, and protect it with at least the care we use for our own. This does not apply to information that is public without a breach, that the receiving party already had, or that the law requires to be disclosed, and in that last case we will tell you where we lawfully can.

15. Term and termination

A subscription runs for the term you chose and renews automatically for the same period unless cancelled beforehand from the billing page.

Either of us may terminate for material breach that is not remedied within thirty days of written notice. We may suspend a workspace immediately where continued use presents a security risk to the service or to other customers, and we will tell you why.

On termination your workspace and its contents are deleted after thirty days. Export first; the button is in Settings and it takes seconds.

16. Governing law

These terms are governed by French law, and the courts of France have exclusive jurisdiction, without prejudice to any mandatory protection available to you in your country of residence.

17. Contact

Questions about these terms, or anything else: support@relynt.io. Our data processing agreement is published at /dpa; if you need an executed copy on your own paper, ask and we will send one.