Terms of Service

• Oabo is business software. You may use it for your organization’s business, not for personal or household purposes.
• You must be 18 or older. The Service is not directed at children, and accounts must not be created for or by anyone under 18.
• You must be authorized to act for the organization whose workspace you set up or join.
• Account details you give us must be accurate and kept current. We only send an access link to the address that asked for it, so that address must be one you control.

Oabo is a business-to-business System of Record for AI. It records an organization’s AI agents, ingests the usage and spend telemetry those agents emit as well as usage and cost data from vendor accounts the organization chooses to connect, and produces value, governance, and performance reporting backed by an application-maintained, per-organization audit history that links entries in a hash chain. Reporting and figures generated by the Service are management information to support the customer’s own analysis and attestation; they are not financial, legal, tax, audit, or regulatory advice, and the customer is responsible for the representations it chooses to make from them.

Cost figures in Oabo are estimates, not bills. A cost shown for an AI system prices the measured usage at the rates on file; it is not an invoice, and it will not always agree with what your provider charges you. Where the Service labels a figure as an assisted estimate rather than a hardened, evidenced number, that label is part of the output — do not present it as the other kind.

The Service is currently offered ahead of general availability. Features described as rolling out or on the roadmap may change, arrive later than described, or not ship, and the Service itself may change before general availability.

A new workspace may be populated with synthetic sample data so you can see the product working before you connect your own systems. Sample data is illustrative only, does not represent any real organization, and must not be relied upon for any decision. Data backed by the sample seed is labeled as sample data in the interface.

Access to Oabo is requested, not opened. You give us an email address and nothing else. We read every request and decide. We may decline, and we do not have to give a reason. Asking creates nothing: until you use a link we send you, there is no account and no workspace.

If we say yes, we email that address one personal link. The link sets up one workspace for your organization, gives you your own copy of the whitepaper, and opens a read-only sandbox running on invented data. The link is for the person who asked — passing it on hands your access to somebody else. It expires on its own, and we may withdraw it before then.

Setting the workspace up starts a 30-day free trial. It begins empty — every number in it is yours or a named assumption, never hidden sample data. The trial is for using and evaluating the Service on behalf of your organization. Because the trial is offered ahead of general availability, we may change its length, scope, or availability, and we may limit organizations to one trial workspace.

During early access, you may use a workspace with real business data you are authorized to use for Oabo’s intended workflows. This includes AI-system inventory, aggregate or pseudonymous usage, actual spend and value data, risk and evaluation records, supporting evidence, ordinary business-contact details, cost-campaign responses, training-progress records, and authorized connector credentials obtained or submitted only through a dedicated Connections flow for a source Oabo identifies as read-only. Oabo encrypts each stored connector credential. The prohibited-data rules below still apply.

Do not use the Service as the sole authoritative system for a production, financial, audit, compliance, or consequential decision. Do not use it to make automated decisions about people. You remain responsible for reviewing the inputs, evidence, estimates, and outputs you use.

During a trial the Service is provided free of charge, and the disclaimers below apply to it in full. We send a small number of service messages during the trial — a welcome, a reminder as it nears its end, and one message about what happens next.

At the end of the trial, continued use requires a paid subscription under an order form or master services agreement (see “Subscriptions & fees”); otherwise we may suspend access to the workspace. If a trial ends without conversion, the workspace first becomes read-only and then, about a week later, access to it is switched off entirely — signing in no longer reaches it. The data is retained in accordance with our Privacy Policy, which is candid that Oabo does not yet delete data on a schedule. Once access is off, export and deletion are done by hand: write to us and we will carry either out.

• You are responsible for the activity of users under your organization’s account and for keeping credentials secure, including the vendor API keys an administrator connects. Sign-in is by email and password; Oabo does not currently offer Sign in with Google or enterprise SSO.
• When you connect a vendor account, you confirm you are authorized to use that account’s credentials for this purpose. Oabo’s access is read-only and you can disconnect it at any time.
• You must assign roles, segregation-of-duties rules, and business-unit scoping appropriately, and ensure that each user’s access is consistent with their responsibilities.
• You must not submit any of the data listed under “What must not go into Oabo”.
• You must not use the Service to violate any law, infringe third-party rights, transmit malware, probe or breach security or tenant isolation, or attempt to access another organization’s data.
• Cost campaigns email colleagues whose addresses you supply. Use them only for people at your own organization who would expect the request, and only for the purpose the form describes. We apply sending limits, and we may refuse or suspend sending that looks like unsolicited mail.
• You must not scrape or bulk-download the Service, or drive it automatically other than through the ingestion endpoints we document.
• You must not reverse-engineer, resell, or use the Service to build a competing product, except to the extent such restriction is prohibited by law.

Oabo is built to hold metadata about AI systems — what ran, what it cost, who owns it, and what evidence supports a claim. It is not built to hold sensitive personal data, and it does not have the controls that kind of data requires. You must not submit to the Service, in any field, note, description, upload, or connected feed:

• Protected health information (PHI) as defined by HIPAA, or any other patient-identifiable health data. Oabo does not offer this service as a business associate and does not accept PHI. No part of the Service should be used to create, receive, maintain, or transmit PHI.
• Payment card numbers, bank account numbers, or financial account credentials.
• Government identification numbers — Social Security, passport, driver’s licence, or national ID numbers.
• Personal data about anyone under 18.
• Biometric identifiers, precise geolocation, or any special category of data that carries its own statutory regime.
• Passwords, private keys, authentication tokens, or other secrets, except authorized connector credentials obtained or submitted through a dedicated Connections flow for an Oabo connector identified as read-only. Oabo encrypts those credentials before storage.
• Prompts, responses, transcripts, source documents, or free-text fields that contain sensitive personal data.
• Bulk customer or consumer records, or HR, payroll, personnel, employee-performance, or performance-review datasets. Ordinary business contacts, pseudonymous seat usage, cost-campaign responses, and training-progress records described in the Privacy Policy are permitted.
• Anything that a law or a contract you are subject to requires be held under controls beyond those described in our Privacy Policy.

This is about the content of the data, not your industry. Health systems, banks, and insurers use Oabo to govern their AI — measuring a clinical assistant’s cost and hours saved needs no patient record in the system.

You are responsible for what your people type into the Service. Oabo does not inspect the content of your fields, so this rule is one you enforce, not one we can enforce for you. If you find that prohibited data has been submitted, tell us at adam@oaboscorecard.com and we will work with you to remove it. We may remove or suspend access to content we reasonably believe breaks this section.

As between the parties, your organization retains all rights to the data it submits to the Service, including the telemetry its agents emit and the data Oabo ingests on its behalf from connected providers (“Customer Data”). You grant Oabo a limited license to process Customer Data solely to provide and support the Service. You represent that you are authorized to connect each provider you connect and to allow Oabo to ingest the associated data; connections are read-only, Oabo does not write back to your source systems, and your use of any connected provider remains subject to that provider’s own terms.

Where Customer Data contains personal data, your organization is the controller and Oabo is the processor. This section sets the processing terms. If you have signed a separate data processing agreement, master services agreement, or order form with us, that document controls over this section.

• Instructions. We process Customer Data only to provide and support the Service, as described in these Terms, your order form, and the Privacy Policy — and where the law requires something of us. If a law requires us to process your data differently, we will tell you first unless the law forbids telling you.
• Confidentiality. We treat Customer Data as confidential. Access by our people is limited to those who need it to run or support the Service.
• Security. We maintain the measures described under “How we protect data” in the Privacy Policy, and we will not materially weaken them while your subscription is running. That section is candid about what is not in place yet; read it as part of these Terms.
• Subprocessors. We use the providers listed in the Privacy Policy, each for the function named there. We will keep that list current and tell customers through the Service or by email when it changes. If you object to a new subprocessor, tell us — if we cannot resolve it, you may end your subscription for the affected service.
• Incidents. If we confirm unauthorized access to your Customer Data, we will tell you without undue delay and no later than 72 hours after confirming it, with what we know at the time, what we are doing, and who to contact. We will keep you updated as we learn more.
• Helping you answer your people. We will help you respond to access, correction, deletion, and portability requests from individuals, and to reasonable security questionnaires, within the limits the Privacy Policy describes — full export and deletion are manual work today, not a button.
• Return and deletion. When your subscription ends, write to us and we will export your data to you or delete it within 30 days. Audit records we are required to keep are the exception; we will tell you what is retained and why.
• Audit. We will answer reasonable written questions about our security and share the documentation we have. We do not offer on-site audits today, and we make no certification claim: Oabo has not completed a SOC 2 audit or any equivalent.

The 30-day free trial is offered for evaluation. Paid use of the Service is governed by a separate order form or master services agreement that sets out the subscription scope, fees, billing cycle, and term. In the event of a conflict between that agreement and these Terms, that agreement controls. Except as required by law or expressly stated in your order form, fees are non-refundable.

The Service ingests the telemetry your agents emit from whatever platforms they run on, interoperates with the sources you choose to connect for usage and spend ingestion (Anthropic Enterprise Analytics, OpenAI Enterprise Cost, OpenRouter, LiteLLM, and Azure OpenAI Cost Management today), and relies on the subprocessors listed in the Privacy Policy to operate. A QuickBooks Online accounting connection exists in the codebase but is not enabled in this deployment; it will appear only if Oabo configures its Intuit application credentials. Each connection is read-only with respect to source business data; an authentication service may issue or rotate a credential as part of connecting or refreshing access. We are not responsible for the availability, accuracy, or practices of third-party services, and your use of them is governed by their respective terms.

Oabo and its licensors own all rights in the Service, including its software, design, and documentation, excluding Customer Data. No rights are granted except the limited right to use the Service under these Terms or an applicable order form. Feedback you provide may be used to improve the Service without obligation to you.

Any free evaluation access is provided “as is” and “as available”, without warranties of any kind, express or implied. To the maximum extent permitted by law, Oabo is not liable for any indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, or data, arising from use of the Service. For paid subscriptions, the parties’ liability is as set out in the applicable order form or master services agreement.

Nothing in this section limits liability that cannot be limited by law, and nothing in it displaces the commitments we make in “How we handle Customer Data for you”.

You may stop using the Service at any time. We may suspend or terminate access that violates these Terms, poses a security risk, or is required to be suspended by law. Provisions that by their nature should survive termination — including ownership, disclaimers, limitation of liability, the prohibited data section, and governing law — survive.

Each version of these Terms carries a version number and an effective date at the top. A change in substance moves the first number; a correction or wording change moves the second. Material changes will be communicated through the Service or by email, and continued use after a change constitutes acceptance. Earlier versions are available on request.

Version 3.2 — 2026-08-26. This version permits real authorized business data for Oabo’s intended workflows, retains the prohibited-data and early-access no-sole-reliance rules, and corrects the audit-trail description: application writes are recorded in a per-organization hash chain, but Oabo does not claim database-enforced immutability. It retains business-use eligibility, the requested-access model, the processor terms, and the no-PHI and no-certification positions. It states the narrower service posture: Oabo does not offer this service as a business associate and does not accept PHI.

These Terms are governed by the laws of the United States and the State of Delaware, without regard to conflict-of-laws principles, unless a signed agreement specifies otherwise.

Questions about these Terms can be sent to adam@oaboscorecard.com. Existing customers may also use the contact channel provided in their Oabo account or customer agreement.