1. Agreement and definitions
These terms apply between Veris EHS (“we”, “us” or “our”) and the enterprise organisation accepting them (“Client”). They are effective from 1 July 2026. The client’s signed commercial arrangement sets the subscription term, fees, enabled modules, deployment scope and service levels. Specific terms expressly agreed in writing govern where they differ from these general terms.
“Platform” means the Veris EHS software and its agreed EHS, ESG and risk management modules. “Authorised Users” are the employees, contractors and other personnel the Client permits to use it. “Client Data” means information entered by or on behalf of the Client. “Hosting Region” is the agreed geographic location of the hosting environment.
By activating or authorising access to the Platform, the Client accepts these terms through an authorised representative. The contractual relationship is with the Client; individual users receive access through the Client. A client-specific or white-labelled product name does not change the underlying service or these terms.
2. Services and deployment
Veris EHS provides configurable tools for safety observations, incident management, audits, inspections, corrective actions, compliance reporting, ESG and risk management, to the extent included in the Client’s subscription. Enabled modules, integrations, implementation services and development commitments are defined in the commercial arrangement.
Deployment may be SaaS/hosted, private cloud, public cloud or on-premises/local. Infrastructure ownership, administration, support, security, updates, backups and access responsibilities are set out for the chosen deployment. Client-managed infrastructure is not transferred to Veris EHS by these terms.
Deployments can be configured to the local regulatory environment. The Client remains responsible for determining its legal obligations and required configurations. Veris EHS does not replace the Client’s professional safety, compliance or legal judgement.
3. Access and acceptable use
The Client manages user onboarding and deprovisioning, credentials, permissions and administrative configuration, and is responsible for its Authorised Users’ actions. Access is limited to the Client’s internal business operations within the agreed subscription.
Veris EHS may suspend affected access where it reasonably believes prohibited use has occurred, notifying the Client as soon as practicable. Access is reinstated promptly when remediation is confirmed. Suspension does not remove payment obligations.
- Do not use the Platform unlawfully, fraudulently or contrary to the agreed scope.
- Do not reverse engineer, decompile or extract the Platform’s source code, except where applicable law permits otherwise.
- Do not access underlying infrastructure beyond permissions expressly agreed for your deployment.
- Do not introduce malicious code, disrupt availability or perform penetration testing without written consent.
- Do not share, resell or sublicense access to third parties outside the subscription.
- Do not use exported data beyond the Client’s internal operational and compliance requirements without the required authority and written consent.
4. Client data and privacy
Client Data remains the Client’s property. Veris EHS receives only the limited permission necessary to provide, maintain and improve the agreed service, under documented Client instructions. This does not permit data brokering, advertising or unrelated commercial use of Client Data.
The Client is the data controller for personal data introduced into its deployment. Veris EHS acts as data processor within the agreed service responsibilities. The Privacy Policy and general Data Policy describe our handling practices; any separately signed Data Processing Agreement defines specific contractual processing obligations and takes precedence on processing matters.
The Client must establish lawful processing and transfers, provide appropriate notices, minimise personal information and secure administrative access. Sensitive-data and AI-related processing must be within the agreed scope and applicable law.
5. Hosting regions and migration
The Hosting Region is agreed at deployment. A region change requires a written request specifying the target region, compliance requirements and desired date. Veris EHS acknowledges a request within five business days and confirms feasibility. Migration normally begins no earlier than 30 calendar days after written confirmation.
The migration window and estimated downtime are agreed in writing at least 14 days in advance. Users may be unable to access the Platform during this window. Planned migration downtime is excluded from service availability calculations under the agreed service-level schedule.
For migrations managed by Veris EHS, a verified backup is retained in the source region, data integrity is checked in the target region, and rollback is used if validation fails. Source infrastructure is not decommissioned until the Client confirms successful migration in writing.
Regional hosting prices, migration costs and any multi-availability-zone configuration are agreed separately in writing. Regional subscription changes apply from successful migration. Multi-zone changes within one region do not themselves constitute a region change, but may require maintenance.
6. Intellectual property and licence
Veris EHS retains rights in the Platform’s software, architecture, design, workflow logic, modules, interfaces, documentation and branding. No Platform intellectual property is transferred to the Client.
During the subscription, the Client receives a non-exclusive, non-transferable, non-sublicensable and revocable licence to use the Platform for its internal operations, subject to these terms and the commercial arrangement.
Veris EHS may incorporate Client feedback into the Platform and owns the resulting implementation. The Client retains ownership of demonstrably pre-existing proprietary business processes and methodologies.
7. Confidentiality
Each party must protect the other’s non-public information and use it only to perform the agreement or exercise rights under it. Disclosure is limited to authorised employees or advisers with a genuine need to know and equivalent confidentiality obligations, or with prior written consent.
These duties do not cover information made public without fault, independently developed without confidential information, or required to be disclosed by law. Where legally permitted, the receiving party provides prompt notice of a compulsory disclosure.
The Platform’s non-public architecture, workflow logic and infrastructure design are Veris EHS confidential information and may not be replicated or used as the basis of a competing product.
8. Security and incidents
Within its agreed responsibilities, Veris EHS maintains encryption in transit and at rest, role-based access, separation of client environments, secure configuration, patch management, monitoring and logging. The Client secures its users’ credentials, configured permissions and any client-managed infrastructure, and promptly reports suspected compromise.
Veris EHS notifies the designated Client contact without undue delay and no later than 72 hours after confirmation of an incident affecting Client Data under its responsibility. Where a breach is reasonably suspected but not confirmed, a preliminary notification is issued within 24 hours. Notifications include available details and remediation steps, with further updates as needed.
9. Availability, support and changes
Veris EHS uses commercially reasonable efforts to meet the service levels specified in the Client’s commercial arrangement. These terms do not create a separate uptime guarantee. Planned maintenance is notified reasonably in advance and excluded from availability calculations, together with agreed region-migration downtime.
Changes materially reducing existing functionality are notified at least 30 days in advance. New modules are provided according to the active subscription. Documented integrations are maintained with backward compatibility where technically feasible. ESG and risk features may evolve according to agreed delivery commitments.
10. Liability
To the extent permitted by law, neither party is liable to the other for indirect, incidental, consequential, special or punitive loss, including lost profits, revenue, data or business interruption.
Veris EHS’s total cumulative liability is limited to fees paid by the Client in the 12 months immediately preceding the event giving rise to the claim. This cap does not apply to a material breach of an agreed Data Processing Agreement resulting in a confirmed personal data breach, a material breach of confidentiality, or Veris EHS’s infringement of third-party intellectual property directly affecting the Client.
The Client indemnifies Veris EHS for claims, damages, fines, penalties and costs arising from misuse of the Platform, failure to comply with applicable data protection, employment or privacy laws, or unauthorised access caused by failure to secure administrative credentials.
Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or liability that cannot lawfully be excluded or limited under UAE law.
11. Term and termination
The service continues for the subscription term in the commercial arrangement. Either party may terminate for convenience with at least 90 days’ written notice unless a different period is expressly agreed.
Either party may terminate for a material breach not remedied within 30 days after written notice, or where the other becomes insolvent or subject to comparable proceedings.
On termination, ordinary use licences and access end, subject to the Client’s transition right to export data. For data held by Veris EHS, an export period of at least 30 days is provided, followed by deletion from production within 90 days after that period, subject to mandatory legal retention. Deletion confirmation is available on request. Backups follow the protected rotation arrangements in the Data Policy.
Ownership, confidentiality, accrued obligations, liability, data return and deletion, and dispute-resolution provisions survive termination to the extent needed to give them effect.
12. Governing law and disputes
These terms are governed by the laws of the United Arab Emirates. Mandatory local legal requirements applicable to a deployment are addressed in good faith through an agreed written amendment where required.
Senior representatives meet within 15 business days after written dispute notice to seek resolution. If negotiation fails, either party may refer the dispute to mediation in the UAE, with mediation costs shared equally. If mediation does not resolve the matter within 60 days of referral, either party may pursue it before the competent UAE courts.
13. General provisions and contact
These terms, the signed commercial arrangement, referenced schedules and any signed Data Processing Agreement constitute the parties’ agreement. Contractual amendments require a written instrument signed by authorised representatives, not informal chat or correspondence.
The Client may not assign the agreement without prior written consent. Veris EHS may assign it to a successor following a merger, acquisition or restructuring if the successor assumes its obligations. An unenforceable provision does not invalidate the remaining terms, and failure to enforce a right does not waive it.
Neither party is liable for delay or non-performance caused by events beyond its reasonable control, provided it promptly notifies the other and makes reasonable mitigation efforts. Formal notices are delivered to agreed contacts by email with read receipt or registered post.
Before executing an enterprise agreement, both parties provide and confirm their full registered legal names, registration details, addresses and jurisdictions. This page does not replace that exchange or a signed commercial arrangement.
For questions about these terms, contact Veris EHS at contact@verisehs.ai.