Version 1.10 · as of 20.10.2026 · The GERMAN version is the authoritative one.
*This English text is a reading aid provided so that no one has to accept terms they cannot read.
It does not constitute a separate contractual version. By accepting, you accept German version 1.10.*
The provider of the "Aigis" platform (aigis.one) is DIAI GmbH, Martinigasse 1, 7537 Neuberg im
Bgld., Austria, registered in the Austrian commercial register under FN 689382Y at the Eisenstadt Regional
Court (E: office@diai.at · diai.at). A VAT identification number has not yet been issued; it will be
announced once granted. These terms govern all use of the platform. The
offering is directed
exclusively at entrepreneurs within the meaning of § 1 KSchG and Art. 2 of Directive 2011/83/EU; no
consumer transaction is established. Deviating terms of the customer apply only upon express
written acknowledgement.
Aigis is a software-as-a-service platform for requirements, compliance and code analysis: capture
and distillation of requirements (documents and text), AI-assisted checks (including contradiction
and document review, code analyses CORE/PULSE/SHIELD), reports, registers and audit evidence.
Individual functions are designed as bookable modules; scope and conditions follow from the
description and price overview displayed in the platform at the relevant time.
Requirements are analysed per project type with a subject-matter focus: CODEX (software), PROJECT
(organisation and projects), LEGAL (contracts and legal texts), HR (human resources), IMMO (real
estate brokerage and management) and INSURE (insurance intermediation). In HR projects, the item
"Résumés and/or application documents"
examines uploaded application documents technically for hidden or manipulated content (precheck
on upload; on request, a chargeable deep analysis) and, on request (chargeable), compares them with
the analysed requirements of the project and the tenant-wide requirements by stating, for each
requirement, whether and where the document contains information on it. Clause 4a applies.
Accounts are personal. The customer warrants that registration details are accurate, that
credentials are kept secret, and that the platform's password requirements and — where required —
two-factor requirements are observed. Accounts unused for a longer period may be blocked
automatically for security reasons; reactivation is handled by the customer's administration.
(1) Purpose. Aigis is an AI-assisted analysis tool for source code and for requirements, contract
and organisational documents. It exposes errors, contradictions and gaps and compares documents with
requirements. Aigis does not assess natural persons. With the exception of the preparatory
functions in human resources described in paragraph 2, Aigis is not intended for the purposes listed
in Annex III of Regulation (EU) 2024/1689, in particular not for biometrics, critical
infrastructure, education and vocational training, access to essential services including the
assessment of creditworthiness as well as risk assessment and pricing in relation to natural persons
in the case of life and health insurance, law enforcement, migration and the administration of
justice; Aigis
takes no decisions on the establishment, content or termination of employment relationships
(paragraph 2).
(2) Human resources (HR). Findings on application documents describe the file (for instance
hidden text, concealed content or instructions directed at an AI system), not the person. They
nevertheless relate to the document of a specific person and are that person's personal data; the
customer, as controller, fulfils the data subject rights (Art. 15 to 22 GDPR), and the provider
supports it in doing so (Annex 1 clause 11). The comparison with the requirements only establishes,
for each requirement, whether and where the document contains information on it, and quotes the
passage — **without assessment, ranking, score, filtering, statement of suitability or
recommendation**. Aigis takes no selection or personnel decision and automates none; every decision
on applicants remains reserved to the customer (clause 6a; Art. 22 GDPR). The functions are designed
so that they do not assess, rank or filter persons. The provider documents their classification
under Art. 6 of Regulation (EU) 2024/1689 per function (deep analysis and comparison separately) and
makes the result available to the customer on request. If a classification or a later reassessment
shows that a function is to be regarded as a high-risk AI system, the provider communicates this
together with the version number; clause 6a no. 6 then applies to the customer.
(3) Real estate (IMMO). Aigis examines the customer's documents, processes and requirements,
including those relating to its due diligence obligations under anti-money-laundering law. It
carries out no valuation of properties, no assessment of creditworthiness or solvency, and no risk
classification, suspicion assessment, identity, PEP or sanctions screening of persons or
transactions, and it does not draw up contracts.
(3a) Insurance intermediation (INSURE). Aigis examines contracts, insurance terms and conditions,
templates and forms for the documentation of advice and client meetings, information documents,
guidelines and processes of the customer as an insurance intermediary against the customer's
requirements and the legal sources it has introduced, including those relating to its due diligence
obligations under anti-money-laundering law. In relation to natural persons, it carries out no risk
assessment, no premium or price calculation, no acceptance or rejection decision, no assessment of
suitability or appropriateness, no assessment of creditworthiness and no suspicion assessment under
anti-money-laundering law; it recommends no insurance product and no insurer, ranks no tariffs or
products, takes no decision on cover or benefits and gives no advice in individual cases.
(4) Repurposing use. Any use of the results for a purpose listed in Annex III of Regulation (EU)
2024/1689 that goes beyond paragraph 2 is the customer's sole responsibility (Art. 25 of the
Regulation). The obligations under clause 6a no. 2 apply to results from all project types.
(5) Marking. AI-generated content of the platform, including the findings and comparison results
in HR projects, is machine-readably marked as such pursuant to Art. 50 of the Regulation; the
customer shall not remove this marking when processing it further. Where the customer publishes
AI-generated texts to inform the public, the customer is subject to its own disclosure obligations
(Art. 50(4) of the Regulation), unless human editorial responsibility exists.
The platform's results (findings, guidelines, conflict lists, reports) are produced using large
language models. They are analysis aids and replace neither legal, tax nor other professional
advice, nor the customer's own review. Where the customer's requirements collide with one another,
Aigis exposes the decision space but makes no decision as to which requirement prevails — that
decision and the responsibility for it remain with the customer. AI results may be incomplete or
erroneous; recognised limits (e.g. sources read only in truncated form) are disclosed by the
platform.
In order to perform the analyses, the customer's content (requirement texts, documents, source
code; in HR projects also application documents including embedded images and page images) is
transmitted to commissioned AI providers or to systems controlled by the provider and
processed there. The data processing agreement pursuant to Art. 28 GDPR (Annex 1) and the
list of sub-processors (Annex 2) form part of these GTC; by accepting these GTC the customer
accepts both. Both annexes are available at any time, publicly and within the application
(aigis.one/api/avv-html, aigis.one/api/subverarbeiter-html). Changes to Annex 2 are announced under
the procedure of Annex 1 clause 7. The customer may additionally protect its content with a key of
its own (clause 10a).
The customer uploads only content to which it holds the necessary rights, and no content whose
processing would violate applicable law. Malicious code may be introduced solely for the purpose of
analysis within the framework provided for that purpose. The customer designates internal
responsible persons (roles) truthfully; actions performed under an account are attributed to the
account holder.
The customer is the controller within the meaning of the GDPR for the data it introduces in HR, IMMO,
LEGAL and INSURE projects; the provider processes them as processor under Annex 1. The customer
1. introduces personnel, application, real estate, insurance and legal documents only if it has a
legal basis
for doing so under Art. 6 GDPR and — for special categories contained therein — an exception under
Art. 9(2) GDPR (for data under Art. 10 GDPR, a basis under Art. 10 GDPR and § 4(3) DSG); for
application documents, it informs the data subjects pursuant to Art. 13 and 14 GDPR about the
technical examination of their documents, about the comparison with the requirements, about the
use of an AI system and about the recipients (the provider as processor and the sub-processors
under Annex 2); it informs third parties named in the documents, such as referees, to the extent
Art. 14 GDPR requires;
2. derives no score, ranking or pre-selection of persons from findings and comparison results and
uses them neither as the sole nor as the decisive basis of a decision about a person; every
decision is taken by a human who examines the document personally and is empowered to decide
otherwise. A technical finding (for instance hidden text or unusual metadata) does not prove that
the person introduced or intended it; templates, conversion and application portals can cause it.
Where the customer bases an adverse decision on such a finding, it first gives the person an
opportunity to comment. It does not pass results on to systems that assess, rank or select persons
automatically;
3. is responsible for the content of its requirements, in particular their compatibility with equal
treatment law. Since the comparison draws on all analysed requirements of the project and the
tenant-wide requirements, the customer uses the comparison only if these requirements are not
linked to a characteristic protected under the Equal Treatment Act (GlBG) or the Disability
Employment Act (BEinstG), unless a statutory exception justifies the requirement; it does not use
comparison results relating to such requirements to the detriment of the person;
4. observes the participation rights of the employees' representation where applicable (in
particular §§ 96, 96a ArbVG);
5. introduces special categories of personal data (Art. 9, 10 GDPR) only to the extent they are
contained in personnel, application, real estate, insurance or legal documents and it is itself
permitted to process them (Annex 1 clause 4);
6. ensures, in accordance with Art. 4 of Regulation (EU) 2024/1689, that persons using HR functions
have a sufficient level of AI literacy. Where a function is to be regarded as a high-risk AI
system under clause 4a(2), the customer, as deployer, fulfils the obligations under Art. 26 of the
Regulation, in particular human oversight by competent persons, informing the employees'
representation and the affected employees before use, using the provider's information for the
data protection impact assessment, and informing the data subjects; the provider makes the
information required for this available (Annex 1 clause 11);
7. enters as responsible persons for the item "Résumés and/or application documents" only persons
who are involved in the application procedure (Annex 1 clause 9), and uses file and project names
without names of persons for application documents and HR projects where knowledge of those names
by the provider is to be excluded (clause 10a);
8. deletes application documents together with findings and comparison results as soon as it no
longer needs them for the selection procedure and for the defence of legal claims; the provider
does not delete them on its own initiative during an ongoing project (clause 12);
9. uses results from INSURE projects neither for risk assessment, premium calculation or acceptance
decisions in relation to natural persons nor as the sole basis of advice or a recommendation in an
individual case; advice, the identification of demands and needs, the assessment of suitability
or appropriateness and their documentation under the rules of professional conduct and practice
applicable to it remain with the customer. Completed insurance applications containing health or
risk information, completed advice records, claims documents and comparable documents about
individual persons are not subject matter of the examination: the analysis derives no
requirements from them, but processes them like any other document introduced (Annex 1
clause 9.9); if the customer nevertheless introduces them, no. 1 and no. 5 apply.
If the customer culpably breaches an obligation under this clause or uses results contrary to
clause 4a(4), it shall indemnify and hold the provider harmless against claims of third parties, in
particular of data subjects under Art. 82 GDPR, and against the reasonable costs of their defence, to
the extent that the provider has not contributed to causing the damage through its own breach of
duty as processor (Art. 82(2) and (5) GDPR). Clause 14 remains unaffected.
The customer's content remains the customer's property; the provider receives the simple right of
processing required to render the service. Analysis results and reports belong to the customer. All
rights in the platform, its prompts, procedures and presentations remain with the provider.
The provider renders the service with reasonable care but owes **no particular or uninterrupted
availability** and no particular service level unless separately agreed in writing. Maintenance
windows, further development and disruptions of third parties (in particular AI providers, hosting
and network connectivity) may temporarily restrict use. The platform is provided "as is";
fitness for a particular purpose, the accuracy, completeness or usability of the AI-assisted
results, and any particular commercial success are not warranted. Statutory warranty is
excluded vis-à-vis entrepreneurs to the extent permitted by law; § 924 ABGB (presumption of
defectiveness) is contracted out, and the burden of proof lies with the customer from handover
onwards. The customer shall examine the service without delay and give written notice of defects
within the meaning of § 377 UGB without delay, at the latest within seven days; otherwise the
service is deemed approved.
Chargeable modules and quotas are governed by the price overview displayed in the platform in the version valid at the time of booking. Default in
payment entitles the provider, after a reminder, to block chargeable functions.
The provider treats customer content as confidential and protects it by technical and
organisational measures oriented towards ISO/IEC 27001 (including encryption of data at rest
and in transit, role-based access, two-factor protection of privileged actions, audit-proof
logging, anomaly detection, regular access review). No certification is thereby warranted.
10a.1 Subject. In addition to the measures under clause 10, the customer may protect its content
with a key of its own ("data sovereignty"). When the customer activates this function, the platform
encrypts the customer's content at rest with a key derived from a passphrase chosen by the customer:
the uploaded files (source code, requirement documents) as well as the results derived from them in
the database (findings, summaries, distillates, notes, register entries, assessment findings). The
provider's backup copies likewise contain this content only in encrypted form.
10a.2 Not covered is data the provider needs for operation and billing: account and login data,
memberships and roles, project and file names, status, time and quantity information, usage and
invoicing data, and the audit log. Clause 10 applies to them. For application and personnel
documents, file names frequently contain names of persons; if the protection under clause 10a.1 is
also to cover these names, the customer names such files and projects without names of persons.
10a.3 Key sovereignty. The passphrase and the recovery code displayed once upon activation are
known to the customer alone. The provider stores the key exclusively in encrypted (wrapped) form and
can neither derive nor restore it without the passphrase or the recovery code. At rest, the provider
therefore cannot read the encrypted content and cannot hand it over in plain text either.
10a.4 Processing. To use the content (analyses, display, export), the customer opens the vault
with its passphrase. The key then resides in the platform's working memory for a limited time —
currently at most eight hours or until the vault is closed; during that time the content is
processed in plain text on the provider's systems and transmitted to the commissioned AI providers
in accordance with clause 5. The measures under clause 10 apply during that time. While the vault is
closed, the content is accessible to no one, not even to the customer's users; the tenant area of
the platform is then locked until it is opened. Individual functions that modify source files in
place are not available while encryption is active; the platform indicates this.
10a.5 Custody and loss. Safe custody of the passphrase and the recovery code is the customer's
responsibility; the provider recommends depositing the recovery code outside the platform in a
protected place (for instance with a notary or in the company's key custody). If both the passphrase
and the recovery code are lost, the encrypted content becomes permanently unreadable; the provider
cannot restore it and — to the extent permitted by law — is not liable for this. Clause 13.5 applies
accordingly; the customer's duty to keep its own backups applies with particular weight while
encryption is active.
10a.6 Deactivation and deletion. The customer may deactivate the function at any time while the
vault is open; the content is then protected solely under clause 10 again. If a tenant is deleted
under clause 12 or 14, the key material is deleted as well; any encrypted copies still existing
afterwards (for instance in backups within their retention period) are permanently unreadable
without the key.
The privacy policy on aigis.one applies. The provider processes personal data in accordance with
the GDPR; data subject rights (Art. 15–21 GDPR) may be addressed to office@diai.at; complaints to
the Austrian Data Protection Authority (dsb.gv.at).
12.1 No archive. The provider is not a custodian. Customer content is not kept beyond the
purpose of the contract; archiving does not take place and is not offered.
12.2 Three months for handover. When a project is closed, the customer is asked to download all
evaluations, reports and registers of that project. The platform's exports are available for this
(PDF, Excel, Markdown, CSV, PowerPoint). The period is three months from closure. It is stated
to the customer at closure and displayed in the platform for as long as it runs.
12.3 Deletion after the period. Once the three months have elapsed, the provider deletes the
content and evaluations of the closed project from the platform. A deletion certificate is issued
on request. An active legal hold takes precedence over deletion.
12.4 Exception in case of payment default. If the customer is in default on a due payment, the
provider may retain the affected content beyond the period, to the extent and for as long as it is
needed to prove the service rendered. This retention serves that purpose alone: the content is
not processed further, not evaluated and not made accessible to anyone. It is deleted as soon as
the claim has been settled or conclusively resolved.
12.5 Deletion on request. Irrespective of the period, the customer may request the deletion of
individual content or of an entire project at any time. Clause 12.4 remains unaffected.
12.6 Billing data is not covered. Invoice and accounting data do not fall under this clause. It
contains no customer content but the type, scope and time of the service obtained, and is subject
to the statutory retention obligation (§ 132 BAO, seven years).
This contractual relationship is a business-to-business transaction; the following limitations
apply comprehensively to the extent permitted by law. Parts that reach impermissibly far are
reduced to the permissible extent without affecting the remaining limitations.
13.1 Unlimited liability exists only where mandatory: for intent, for damage arising from injury
to life, body or health, under the Product Liability Act, and for fraudulently concealed defects or
expressly warranted characteristics given in writing.
13.2 Gross negligence: For property and financial loss caused by gross negligence the provider
is liable limited in amount to the net fees actually paid for the affected service in the twelve
months preceding the damaging event.
13.3 Slight negligence: For damage caused by slight negligence the provider is liable **only for
breach of a material contractual obligation** (an obligation whose fulfilment makes the proper
performance of the contract possible in the first place and on whose observance the customer may
regularly rely), and even then only limited to the damage typically foreseeable at conclusion of
the contract, at most to the amount under clause 13.2. Otherwise liability for slight negligence is
excluded.
13.4 Excluded — outside clause 13.1 and to the extent permitted by law — is in particular
liability for lost profit, savings not realised, business interruption, loss of production,
indirect damage and consequential damage caused by defects, third-party claims, reputational damage,
and damage arising from the failure, delay or malfunction of commissioned third parties (AI
providers, hosting, network) and from events of force majeure.
13.5 Loss of data: Liability for the loss of data is limited to the effort that would have been
required for restoration given proper customer-side data backup in line with the state of the
art. The customer is itself responsible for backing up its content regularly.
13.6 AI results and compliance decisions: The provider is not liable for damage arising from
reliance on AI-assisted results (findings, guidelines, conflict lists, reports, comparison results)
or from decisions made by the customer on that basis, in particular from personnel and selection
decisions (clause 4a(2), clause 6a); the results are analysis aids and not a binding statement
(cf. clause 4). Where requirements collide, the customer makes the decision and bears the
responsibility for it.
13.7 Limitation and assertion: Claims for damages against the provider become time-barred, to
the extent permitted by law, within twelve months of knowledge of the damage and of the party
causing it, at the latest within the statutory maximum periods; they must be asserted in writing
within that period. The limitations of this clause also apply in favour of the provider's vicarious
agents and legal representatives.
Unless agreed otherwise, use may be terminated at any time with effect from the end of the month.
The provider may block accounts in the event of serious breaches of these terms after prior notice,
and immediately where there is imminent danger. Clause 12 applies accordingly to content after the
end of the contract.
Amendments are announced in the platform together with a version number. Continued use after such
announcement, as well as any renewed acceptance at sign-in, is deemed acceptance; material
amendments are submitted for separate consent. If a customer does not consent to a material
amendment, the previous version continues to apply to it; functions that are agreed only with the
new version are then not available to it. The platform requests consent at the next sign-in.
Austrian law applies, excluding the UN Convention on Contracts for the International Sale of Goods
and its conflict-of-law rules. The place of jurisdiction is the court with subject-matter
jurisdiction in Güssing. Should individual provisions be invalid, the remainder of the contract
remains effective; the invalid provision is replaced by the effective rule that comes closest to
its economic purpose.
The customer may transfer rights and obligations under this contract only with the provider's prior
written consent. The provider may transfer this contract in the course of a universal succession, a
corporate reorganisation or a transfer of the business to a legal successor. The provider will notify the
customer in text form. In that case the customer may terminate the contract extraordinarily within
four weeks of receiving the notification; until then the contract continues unchanged. The
obligations arising from the processing of personal data (clause 11) pass to the legal successor
unchanged.