The terms behind every engagement.

1Introduction & acceptance

These Terms of Service ("Terms") govern every engagement, quote, statement of work, and use of software or deliverables provided by Pallisade ("Pallisade", "we", "us", "our") to a client ("Client", "you"). Pallisade is a founder-led studio based in Cape Town, South Africa, operating as Pallisade Data (Pty) Ltd (registration number 2026/328426/07), trading as Pallisade.

By signing a Statement of Work ("SOW"), quote, or order form that references these Terms, or by instructing Pallisade to begin work, you accept these Terms in full. Where a signed SOW or Master Services Agreement conflicts with these Terms, the signed document takes precedence for that engagement. Where these Terms are followed by a signed Data Processing Agreement ("DPA") between Pallisade and the Client, that DPA governs all matters concerning the processing of personal information for that engagement, and takes precedence over paragraph 8 of these Terms to the extent of any inconsistency.

If you do not agree to these Terms, do not engage Pallisade’s services.

2Services

Pallisade designs and ships bespoke AI and software systems for financial-industry clients — asset and investment managers, hedge funds, private equity and venture capital firms, family offices, and insurers. Engagements are scoped, quoted, and delivered under one of three models:

2.1 Consult

A fixed-fee, 2–4 week engagement addressing a specific question — AI strategy, tooling review, build-vs-buy, or a data-architecture audit — concluding in a written recommendation.

2.2 Automate

A fixed-quote, 4–8 week engagement that rebuilds a discrete workflow (for example, IC memo generation, research synthesis, or diligence Q&A) around AI and deploys it into the Client’s own stack.

2.3 Build

A phased, fixed-scope-per-phase engagement delivering full bespoke software around the Client’s workflow, with weekly demonstrations against real data and ongoing engineering support against an agreed service level, as set out in a Service Level Schedule where applicable.

The specific deliverables, timeline, fees, and acceptance criteria for each engagement are set out in the applicable SOW or quote, which forms part of these Terms once signed or otherwise accepted.

3Engagement process, fees & payment

Every engagement begins with a scoping consult. Pallisade will provide a written quote or SOW, typically within one business day of that consult, setting out the fixed fee (Consult, Automate) or phased fee structure (Build).

Pallisade does not operate open-ended, unscoped retainers for new engagements — all work is scoped and quoted before it begins. Change requests outside the agreed scope will be quoted separately before work proceeds.

4Client responsibilities

To deliver on schedule, and to enable Pallisade to meet the AI transparency and regulatory-compliance obligations described in paragraphs 8 and 9, Pallisade relies on the Client to:

• provide timely access to the systems, data, personnel, and feedback reasonably required for the engagement;
• ensure it holds all necessary rights, consents, and lawful basis to share any data (including personal information) it provides to Pallisade for the engagement;
• designate a point of contact with authority to approve scope, review deliverables, and sign off on phases or milestones;
• designate, for any engagement producing AI-generated output used in a business, investment, underwriting, or regulatory decision, a qualified professional responsible for reviewing that output before it is relied upon or disseminated, consistent with paragraph 9.3; and
• use deliverables in accordance with the licence granted under paragraph 6 and any documented limitations (for example, model limitations, jurisdictional scope, or data-freshness constraints).

Delays caused by the Client’s failure to meet these responsibilities may extend timelines and are not treated as a breach by Pallisade.

5Fees, quotes & scope changes

Quotes are valid for 30 days from issue unless stated otherwise. Scope is fixed at signature; material changes in requirements, data volume, or integration complexity discovered mid-engagement will be raised with the Client and, where they materially affect cost or timeline, quoted as a change order requiring written approval before work continues.

Fees are as stated in the applicable quote or SOW and are exclusive of VAT unless stated otherwise. Unless the SOW specifies different terms, invoices are payable within 14 days of the invoice date.

Where a build fee may be paid in monthly instalments, the instalment schedule will be set out in the SOW; instalments remain payable even if the Client pauses the engagement, unless Pallisade agrees otherwise in writing. Where an engagement includes an ongoing retainer (for example, covering API and dependency updates, model upgrades, monitoring, and hosting management), the retainer is billed monthly in advance and continues until either party terminates under paragraph 13.

Late payments may attract interest at the maximum rate permitted under the Prescribed Rate of Interest Act, and Pallisade may suspend work on any active engagement until overdue amounts are settled, on no less than 5 business days’ written notice.

6Intellectual property

6.1 Pallisade’s platform IP

Pallisade retains ownership of its pre-existing tools, frameworks, libraries, prompt architectures, and generic (non-Client-specific) code and know-how used to deliver engagements ("Platform IP"), whether created before, during, or after an engagement, except to the extent expressly assigned in a signed SOW.

6.2 Bespoke deliverables

Subject to full payment of all fees due, Pallisade grants the Client a perpetual, exclusive (as against other Pallisade clients), royalty-free licence to use, run, and modify the bespoke configuration, workflows, and Client-specific code produced under the engagement ("Bespoke Deliverables") for the Client’s own business purposes. Where a specific SOW provides that the Client owns the code outright (as is typical for Build engagements), that SOW governs and the Client holds the IP in the Bespoke Deliverables, excluding any Platform IP embedded in them, which remains licensed to the Client for use as part of the deliverable.

6.3 Client data

The Client owns all of its data at all times — inputs, outputs, and anything the Client’s use of a Pallisade-built system generates or stores. Pallisade claims no ownership interest in Client data. See the Privacy Policy and, where applicable, the DPA for how Client and personal data is handled.

6.4 Model Outputs

Subject to Pallisade’s intellectual property rights in its Platform IP (including underlying algorithms, prompt architectures, and methodologies), any insight, prediction, classification, score, recommendation, or report generated by a Pallisade-built system from Client data ("Model Outputs") is owned by the Client, consistent with paragraph 6.3.

6.5 Limited, restricted use of anonymised learnings

Pallisade may use fully de-identified, aggregated learnings derived from an engagement, containing no Client-identifying detail and presenting no reasonable risk of re-identification, to improve its Platform IP. This does not extend to using Client-specific prompts, architectures, fine-tuning data, or Model Outputs to train, fine-tune, or benchmark any model or system offered or intended to be offered to another client, and does not extend to disclosing such learnings to any third party in a manner that could reveal the Client’s identity or confidential business information. Where the Client requires a stricter position for a specific engagement, this may be varied in the applicable SOW.

The principle governing this paragraph is simple: Pallisade owns the tool it reuses across engagements, within the limits above; the Client owns its data, its Model Outputs, and, per the applicable SOW, the bespoke work built specifically for it.

7Confidentiality

Each party will keep the other’s confidential information (including business, technical, and financial information not publicly known) confidential, and will use it only to perform its obligations under the engagement. This obligation survives termination of the engagement for a period of 3 years, except for information that constitutes a trade secret or personal information subject to POPIA, which remains protected for as long as required by law.

Where a party is compelled by law, regulation, or a competent court or regulator to disclose the other party’s confidential information, it will, unless prohibited from doing so, give the other party reasonable prior written notice so that the other party may seek a protective order or other appropriate remedy.

This paragraph does not restrict Pallisade’s use of anonymised, aggregated learnings within the limits described in paragraph 6.5, or from referencing the existence and general nature of an engagement (e.g. in a client list) with the Client’s prior written consent.

8Data processing, AI use & transparency

8.1 Roles

Where an engagement involves processing personal information on the Client’s behalf, Pallisade acts as an operator (as defined in POPIA) and the Client as responsible party, and the parties will enter into a written Data Processing Agreement covering the security safeguards, sub-operator flow-down, breach notification, and data-export terms described in that DPA and in Pallisade’s Privacy Policy, available at pallisadedata.com/privacy. The DPA is incorporated into these Terms by reference for all matters concerning the handling of personal information.

8.2 Named AI providers

Pallisade builds engagements using third-party large language models, including Anthropic’s Claude, accessed via API. Pallisade’s current sub-processor register (maintained under the DPA) names each model provider used in a given engagement. Personal information is protected in transit to these providers through the tokenisation and data-residency architecture described in the Privacy Policy; where an engagement requires processing that architecture does not yet cover (for example, identity or other document images that must be read by a model before any identifier within them can be tokenised), Pallisade will disclose that specific processing path, its retention terms, and the safeguards applied, in the applicable SOW or DPA, rather than relying on the general architecture description to cover it.

8.3 High-risk use disclosure and review

Where an engagement produces AI-generated content bearing on a financial, investment, credit, or insurance decision (a "High-Risk Output"), consistent with the high-risk use categories in the applicable AI provider’s usage policy, the Client must: (a) have the High-Risk Output reviewed by a qualified professional before it is relied upon, finalised, or disseminated; and (b) disclose to any person who will rely on the High-Risk Output that AI was used to help produce it. Pallisade will design deliverables to support this review-and-disclosure discipline (for example, by surfacing confidence indicators or source citations), but the Client remains responsible for the review and disclosure itself, consistent with paragraph 10.6.

8.4 Compliance with AI provider terms

The Client will not use any Pallisade-built system, or instruct Pallisade to use any AI provider, in a manner that would breach the usage policy of the applicable AI provider. Pallisade will notify the Client of any usage restriction it becomes aware of that is directly relevant to the Client’s use case.

9Regulatory compliance

9.1 Applicable Law

In this paragraph, "Applicable Law" means any statute, regulation, or binding guidance in force in South Africa or any other jurisdiction applicable to the Client’s business, including without limitation POPIA, the Financial Sector Regulation Act 9 of 2017, the Financial Advisory and Intermediary Services Act 37 of 2002 ("FAIS"), the Insurance Act 18 of 2017, the Cybercrimes Act 19 of 2020, and any applicable guidance issued by the Information Regulator, the Prudential Authority, or the Financial Sector Conduct Authority ("FSCA"), together with, where relevant to the Client’s own regulatory footprint, equivalent EU, UK, or US financial-services and data-protection requirements.

9.2 Client’s regulatory responsibility

The Client remains solely responsible for: (a) its own licensing, registration, and conduct obligations under Applicable Law; (b) ensuring that its use of any Pallisade-built system in connection with a regulated activity complies with Applicable Law; (c) maintaining its own governance, risk management, and internal controls over its use of AI and machine learning tools, including the review and disclosure discipline described in paragraph 8.3; and (d) any disclosures it is required to make to regulators, investors, policyholders, or other stakeholders regarding its use of AI-assisted systems.

9.3 Pallisade’s support

Pallisade will provide the Client, on reasonable request, with documentation reasonably necessary for the Client to demonstrate to a regulator or internal audit function how a Pallisade-built system operates, including the categories of data processed, the AI providers used, and the safeguards described in paragraph 8, details of which are set out more fully in the DPA.

9.4 Not advice

Nothing in this paragraph, and nothing Pallisade provides under it, constitutes regulatory, legal, actuarial, investment, or other professional advice.

10Warranties & disclaimers

Pallisade warrants that it will perform services with reasonable skill and care, consistent with good industry practice, and that deliverables will materially conform to the specification agreed in the applicable SOW for a period of 30 days following delivery or go-live (the "warranty period"), during which Pallisade will remedy material non-conformities at no additional charge.

Except as expressly stated in this paragraph, all services and deliverables are provided "as is" and Pallisade disclaims all other warranties, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement, to the maximum extent permitted by law.

10.1 AI outputs are probabilistic

Where an engagement produces AI-generated content (for example, investment-committee memos, research summaries, or risk flags), that output is a drafting and analysis aid. It may contain errors and does not constitute investment, legal, tax, actuarial, or other professional advice.

10.2 AI and machine learning limitations

The Client acknowledges and agrees that: (a) any Pallisade-built system may utilise artificial intelligence and machine learning technologies that are inherently probabilistic and may produce outputs that are inaccurate, incomplete, biased, or otherwise require professional review; (b) such models are typically trained on historical data and may not accurately reflect current market conditions, regulatory requirements, or risk factors; (c) the Client is solely responsible for reviewing, validating, interpreting, and, where appropriate, stress-testing all Model Outputs before relying on them for any business, investment, regulatory, or reporting purpose, and for the review and disclosure discipline described in paragraph 8.3; (d) Pallisade does not warrant that any system it builds is free from algorithmic bias, and the Client shall implement appropriate governance, testing, and monitoring to identify and mitigate any such bias in its own use; and (e) a Pallisade-built system is not intended to replace professional judgment, and all material decisions should be reviewed by an appropriately qualified professional. The Client remains solely responsible for reviewing, verifying, and deciding whether and how to rely on any AI-generated output before using it in a business, investment, or regulatory decision.

11Indemnification

11.1 Client indemnity

The Client will indemnify and hold Pallisade harmless against any losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or relating to: (a) the Client’s breach of these Terms or the applicable SOW; (b) the Client’s use of a Pallisade-built system or Model Outputs in breach of paragraphs 8.3 or 8.4 (the AI-provider transparency and usage-policy obligations); (c) any decision made by the Client in reliance on Model Outputs without the review required by paragraph 8.3; (d) the Client’s breach of Applicable Law, including POPIA or any financial-services regulation referred to in paragraph 9.1; or (e) any claim by a data subject, investor, policyholder, or other third party arising from the Client’s own processing of personal information or conduct of its business. This indemnity survives termination of these Terms.

11.2 Pallisade indemnity

Pallisade will indemnify the Client against any third-party claim that a Bespoke Deliverable, as delivered by Pallisade and used in accordance with these Terms, infringes that third party’s intellectual property rights in South Africa, except to the extent the claim arises from (a) modification of the deliverable other than by Pallisade, (b) combination with materials not provided by Pallisade, or (c) use outside the scope of the applicable SOW. This is Pallisade’s sole obligation, and the Client’s sole remedy, in respect of any such claim.

11.3 Process

The indemnified party will give the indemnifying party prompt written notice of any claim, allow the indemnifying party to control the defence and settlement of the claim (provided any settlement does not impose liability on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s expense.

12Limitation of liability

To the maximum extent permitted by law, neither party’s aggregate liability arising out of or relating to an engagement will exceed the total fees paid or payable by the Client to Pallisade under the applicable SOW in the 12 months preceding the event giving rise to the claim.

Neither party will be liable for indirect, incidental, consequential, special, or punitive damages, or for loss of profits, revenue, data, or goodwill, even if advised of the possibility of such damages.

These limitations do not apply to: (a) a party’s confidentiality obligations under paragraph 7; (b) a party’s indemnification obligations under paragraph 11 or set out in the applicable SOW; (c) either party’s gross negligence or wilful misconduct; or (d) liability that cannot be limited or excluded under South African law. For the avoidance of doubt, a data breach or Security Compromise arising from Pallisade’s failure to implement the safeguards it has documented under the DPA is not, of itself, gross negligence, and remains subject to the general cap in this paragraph unless the circumstances otherwise meet that standard.

13Term & termination

Each engagement runs for the term stated in its SOW. Retainer arrangements continue month-to-month until terminated by either party on 30 days’ written notice.

Either party may terminate an engagement for the other party’s material breach that remains uncured 14 days after written notice of the breach.

On termination, the Client remains liable for fees for work performed and expenses reasonably incurred up to the effective date of termination.

On termination or expiry, Pallisade will, on request, provide the Client with an export of its data in an open, portable format within the window agreed in the applicable DPA, and will securely delete Client data from Pallisade-managed infrastructure thereafter, subject to any retention required by law.

14Continuity

For Build and Automate engagements, the SOW may provide for source-code and infrastructure escrow, releasing to the Client on defined triggers (such as Pallisade ceasing operations or an uncured material breach) so that the Client is never left without a working system or its data. Where continuity is material to the Client, Pallisade will discuss escrow arrangements as part of scoping rather than leaving this to be raised only if requested; the specific terms are set out in the applicable SOW or continuity agreement.

15Force majeure

Neither party will be liable for any failure or delay in performing its obligations (except for payment obligations) where such failure or delay is due to circumstances beyond its reasonable control, including acts of God, natural disaster, war, civil unrest, strikes, pandemic, governmental action, or interruption of telecommunications, power, or a third-party cloud infrastructure or AI provider on which a Pallisade-built system depends ("Force Majeure Event").

The affected party will promptly notify the other of a Force Majeure Event and use reasonable efforts to mitigate its impact and resume performance. If a Force Majeure Event continues for more than 60 days, either party may terminate the affected engagement on written notice, without liability for that termination beyond obligations already accrued.

16Notices

Notices under these Terms must be in writing and sent by email to the addresses set out in the applicable SOW or, for Pallisade, to hello@pallisadedata.com. A notice sent by email is deemed received on the date of dispatch, unless the contrary is proved. Either party may change its notice address by written notice to the other.

17Anti-bribery & corruption

Each party will comply, and will procure that its personnel, agents, and subcontractors comply, with all applicable anti-bribery and anti-corruption laws, including the Prevention and Combating of Corrupt Activities Act 12 of 2004, and, where applicable to the Client’s operations, the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act. Neither party will offer, give, request, or accept any bribe or improper advantage in connection with an engagement, and each will promptly notify the other of any known or suspected breach of this paragraph.

18General

18.1 Independent contractor

Pallisade performs services as an independent contractor. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the parties.

18.2 Subcontracting

Pallisade may use subcontractors or sub-processors to perform parts of an engagement, provided it remains responsible for their performance and, for any sub-processor handling personal information, ensures they are bound by equivalent data-protection obligations, consistent with the DPA.

18.3 Assignment

Neither party may assign these Terms without the other’s prior written consent, except that Pallisade may assign them in connection with a merger, acquisition, or sale of substantially all its assets, on written notice to the Client.

18.4 Dispute resolution

If a dispute arises under these Terms, a party wishing to resolve it will give the other written notice, and each party’s designated representative will attempt in good faith to resolve the dispute by negotiation within 20 business days. If the dispute is not resolved within that period, either party may refer it to arbitration under the rules of the Arbitration Foundation of Southern Africa ("AFSA"), seated in the city agreed between the parties or, failing agreement, Cape Town, or, if the SOW does not provide for arbitration, to the courts of South Africa having jurisdiction. Nothing in this paragraph prevents a party from seeking urgent interim relief from a court of competent jurisdiction pending resolution of the dispute.

18.5 Governing law

These Terms are governed by the laws of the Republic of South Africa.

18.6 Entire agreement

These Terms, together with the applicable SOW(s), the Privacy Policy, and any signed DPA or continuity agreement, constitute the entire agreement between the parties for the relevant engagement and supersede all prior discussions or proposals on that subject matter.

18.7 Changes to these Terms

Pallisade may update these Terms from time to time for services generally; changes will not apply retroactively to reduce the Client’s rights under an already-signed SOW without the Client’s written consent. The current version is available at pallisadedata.com.

19Contact

Questions about these Terms can be directed to hello@pallisadedata.com, or to the Pallisade contacts named in your engagement: emil@pallisadedata.com (Founder).