Keyholder Terms of Service

These terms cover the use of Keyholder, software that Fulkerson Advisors LLC builds and runs. In these terms, the client is the company that engages us under a signed engagement agreement and approves Keyholder’s access to its Microsoft 365. The engagement agreement includes any statement of work signed under it.

The client accepts these terms by signing an engagement agreement that refers to them, or by letting its people use Keyholder. Each person who signs in agrees to follow them. If you do not agree, do not use Keyholder.

The engagement agreement comes first. Where it and these terms conflict, the engagement agreement prevails. On how Keyholder handles data, the Keyholder Privacy Statement prevails over these terms. Our website terms apply to Keyholder only where these terms point to them.

Keyholder helps a buyer learn what a company’s departing owner knew. With the client’s approval, it reads the company’s Microsoft 365 mail and builds a map of the outside companies the company deals with, along with a set of checked facts, each tied to its evidence. Keyholder is used only within an engagement that we run. No one can sign up for it on their own.

Operators are Fulkerson Advisors staff assigned to the engagement. The client’s people use Keyholder by invitation, with the Leadership or Team role the client chooses for each of them, as the privacy statement describes. The client may ask us to add or remove anyone at any time.

Each person signs in as themselves and is responsible for what is done under their sign-in. The client is responsible for how the people it invites use Keyholder.

Keyholder depends on the client setting up the engagement properly. The client is responsible for:

• Having the authority to let us read the company's Microsoft 365, and making sure the person who approves Keyholder's access may approve it for the company. That person must not be the departing owner.
• Placing holds on the mailboxes in scope before collection starts and confirming the date. Coverage runs from that date. Mail removed before then may be gone, and we record what is missing as a gap.
• Telling each mailbox's people before Keyholder reads its message bodies, giving us the date and a copy of what they were told, and making sure that notice meets the law where they work.
• Having the owner's deal counsel and the buyer's counsel give us the addresses, domains and people whose mail must stay out, telling us at once when that list changes, and having counsel decide each held thread.
• Granting Keyholder only the Microsoft 365 access its setup script makes. A mail permission granted across the whole organization would undo the limit on which mailboxes Keyholder can read.

By approving Keyholder’s access, the client confirms that each of these is true and will stay true while Keyholder reads its mail. If one stops being true, the client must tell us at once, and we will pause collection until it is put right.

The client will not give Keyholder protected health information, or other data that may be shared only under a special agreement such as a business associate agreement, unless the engagement agreement provides for it in writing.

Use Keyholder only for the engagement it was set up for. Do not:

• Share your sign-in or passkey, or let anyone else use your account
• Try to reach a workspace you were not invited to, or another client's data
• Try to see facts your role does not allow, or facts held for counsel
• Test, probe or work around Keyholder's security, or put an unreasonable load on it
• Copy, resell or reverse engineer Keyholder
• Use Keyholder to build a product that competes with it
• Use Keyholder in a way that breaks the law or another person's rights
• Give Keyholder content you have no right to give us

The company’s mail, and the facts and quotes Keyholder draws from it, are client content, and they belong to the client. The client lets us copy, store and process client content only to carry out the engagement, and only for as long as the privacy statement says we keep it. We do not sell it.

We do not use client content to train AI models, and we send it only to AI providers whose terms bar them from training on it. What our operators learn in review may help us improve Keyholder’s templates and prompts, but those changes carry no client content.

We may keep usage data about how Keyholder runs, such as counts, costs and error rates, in a de-identified and aggregated form that identifies neither the client nor any person. We use it to run and improve Keyholder.

Keyholder itself, including its code, templates and methods, remains ours, as our other materials do under our website terms. If you suggest an improvement to Keyholder, we may use the suggestion freely, with no duty to you. We will not name you or the client as its source.

We work to keep Keyholder running for as long as an engagement needs it, but we do not promise that it will always be available or free of errors. We may pause it to maintain it or to fix a problem, and a job stops when it reaches the spending limit set for the engagement. Keyholder also depends on Microsoft 365, Cloudflare, OpenRouter and TypeSafe, whose outages are outside our control.

Keyholder uses AI models to screen mail and to find the passages a fact rests on. Each fact is written from a fixed template filled with words copied from the source, and a person at Fulkerson Advisors checks it before anyone at the client can see it.

Even so, a checked fact can be wrong or incomplete, and screening can make mistakes in either direction. Some of what an owner knows leaves no trace in mail at all. Treat each fact as evidence to weigh against its source. Keyholder does not give legal, tax or financial advice. The client is responsible for the decisions it makes using Keyholder’s facts.

We keep all client information confidential, as our website terms say, and the engagement agreement’s confidentiality terms apply to Keyholder as well. Within Fulkerson Advisors, only the operators assigned to the engagement can open the client’s workspace. You agree to treat as confidential anything you learn about how Keyholder works that is not public.

The client lets us send its content to the processors listed in the privacy statement, so that Keyholder can screen mail and draw facts from it. Sending content to them for that purpose does not breach these terms or the engagement agreement’s confidentiality terms.

We may disclose client information when a law, court or regulator requires it. Where the law allows, we will tell the client first so it can object, and we will disclose only what is required.

We will not name the client or the buyer, or describe the acquisition, in our marketing or anywhere else in public without the client’s written permission.

We protect client content with the safeguards the privacy statement describes, and we will not make them materially weaker during an engagement. If we learn that someone has reached client content without permission, we will tell the client without unreasonable delay and share what we know. We will also help the client meet any duty it has to tell others.

Keyholder is provided as is and as available. Apart from what the engagement agreement promises, we make no warranty, express or implied, including any warranty of merchantability, fitness for a particular purpose, accuracy or non-infringement. We do not promise that Keyholder will run without interruption or error, or that it will find everything the company depends on.

We will defend the client against any claim by a third party that Keyholder, as we provide it, infringes that party’s intellectual property rights. We will pay the damages and costs finally awarded against the client on that claim, or agreed in a settlement we approve.

We have no such duty where the claim arises from client content, from a change to Keyholder that we did not make, from using Keyholder with something we did not provide, or from use that breaks these terms. If Keyholder is, or we think it may become, the subject of such a claim, we may get the client the right to keep using it, change it so that it no longer infringes, or end the client’s use and refund any fees paid for the part of the engagement not yet carried out. These are our only duties for claims that Keyholder infringes.

The client will defend us against any claim by a third party arising from client content, or from the client’s failure to meet its responsibilities in section 04 for authority, holds, notice to employees, counsel’s list or scoped grants. The client will pay the damages and costs finally awarded against us on that claim, or agreed in a settlement the client approves. This does not cover a claim to the extent our own breach of these terms caused it.

The party asking for a defense must tell the other promptly in writing, let it control the defense and any settlement, and give reasonable help, which the defending party pays for. A late notice reduces the duty to defend only as far as the delay causes harm. No settlement may admit fault for the protected party, or require it to act, without its written consent, which it will not unreasonably withhold. The protected party may take part with its own lawyer at its own cost.

Neither Fulkerson Advisors nor the client is liable to the other for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill, data or business opportunities, arising out of these terms or the use of Keyholder.

For all claims arising out of these terms or the use of Keyholder, Fulkerson Advisors and the client are each liable to the other, in total, for no more than the fees paid or payable under the engagement agreement in the 12 months before the event that gave rise to the claim.

These limits do not apply to fraud or willful misconduct, to the client’s duty to pay what the engagement agreement requires, or to either side’s duties under section 12. Where the engagement agreement sets different limits, its limits apply. Nothing here limits liability that the law does not allow to be limited.

Use of Keyholder ends when the engagement agreement says it does, or when that agreement is terminated. The client’s Microsoft 365 administrator can also withdraw Keyholder’s access at any time, and Keyholder then reads nothing more. We may suspend a person’s access if they break these terms or put client content at risk, and we will tell the client when we do. We may also pause collection if we believe that going on would break the law or the client’s instructions, for example when a hold or a notice that section 04 requires is missing.

When the engagement ends, we delete the staged mail and destroy the key that encrypts it. Within 30 days after it ends, we also delete the record, and we confirm in writing what was erased and how long backups last. Until the record is deleted, the client may ask us for an export of it. The privacy statement says what the record holds and how long deleted data survives in backups.

The parts of these terms on data ownership, AI output, confidentiality, security, warranty, indemnities, liability, deletion, governing law and general terms continue after use of Keyholder ends.

The engagement agreement sets the law that governs these terms and where any dispute is heard.

These terms are an agreement between Fulkerson Advisors and the client. No one else may enforce them, including the departing owner, the buyer where it is not the client, and the people whose mail Keyholder reads. This does not take away any right the law gives them.

Neither we nor the client is responsible for a delay or failure caused by events beyond reasonable control, such as a natural disaster, war, a government order, or an outage at Microsoft, Cloudflare, OpenRouter or TypeSafe. This does not excuse a payment the engagement agreement requires.

If a court finds part of these terms unenforceable, the rest still applies. Choosing not to enforce a term at one time does not waive it.

Fulkerson Advisors and the client are independent of each other. Neither is the other’s agent, partner or employee.

The client confirms that neither it nor anyone it invites is named on a US sanctions list or located in a country under US embargo. Do not use Keyholder in breach of US export control or sanctions laws.

Send notices under these terms by email to legal@fulkersonadvisors.com. We send ours to the address the engagement agreement gives for the client.

We may change these terms. We will tell clients of a material change at least 30 days before it takes effect, and the date at the top of this page will change with it. Using Keyholder after a change takes effect means accepting it.

For questions about these terms:

Email: legal@fulkersonadvisors.com
Address: PO Box 410127, Cambridge, MA 02141