1. Agreement, eligibility and authority
1.1 These Terms govern access to the NuclearPath AI website, hosted application and any APIs or related features that expressly incorporate them (the “Service”), operated by XCIS Consulting Inc, operating as XCIS AI (“XCIS,” “we,” “us,” or “our”). You agree to these Terms by selecting the initially unchecked acceptance checkbox when creating an account, or by another express acceptance process we present. They bind you from your actual acceptance, not retroactively merely because of the effective date stated above. The Privacy Policy explains personal-information processing; acknowledging it is not blanket consent to optional processing.
1.2 You must be at least 18 years old and have legal capacity to enter this agreement in your jurisdiction. If you use the Service for an organization, you must be authorized to use it and to submit the information you provide. You bind that organization only if you have authority to do so; otherwise you must not purport to accept an organization-level agreement. Your employer’s ownership of information is not displaced by your account registration.
1.3 “Input” means prompts, questions, files, instructions, annotations and other material submitted to the Service. “Output” means responses or material generated for you. “User Content” means your Input and associated Output, including enabled conversation history, project context and workspace materials. “Source Materials” means third-party regulations, standards, guidance, publications and other reference content. “Public Service” means the generally available hosted offering governed by these Terms, not a separately approved enterprise deployment.
1.4 The initial supported customer markets are Canada and the United States. Access from another location does not establish that the Public Service is offered or suitable there. Applicable mandatory privacy, consumer, language, nuclear-information and export requirements continue to apply regardless of the governing-law clause.
2. Nature and limits of the Service
2.1 NuclearPath AI assists with nuclear regulatory research, navigation, requirement mapping, document review and knowledge organization. Available functions may differ by release, account, jurisdiction or deployment. Project workspaces, OPEX retention, sharing, integrations and agents are covered by these Terms only where enabled. A roadmap, demonstration or presentation does not promise a feature, release date, regulatory outcome or service level.
2.2 The Service is an informational aid. It is not a regulator, certification body, licensed engineering practice, legal adviser or substitute for qualified personnel. No attorney-client, engineering-adviser or other professional relationship is created. XCIS is not acting as your licensing applicant, licensee, operator, authorized regulatory representative or records custodian.
2.3 References to the CNSC, NRC, DOE, CSA or another organization identify sources or subject matter only. They do not imply sponsorship, accreditation, approval or endorsement. A supplier identified or described by the Service is not thereby qualified for your procurement, quality-assurance or safety requirements.
3. Human verification and regulatory reliance
3.1 AI can produce inaccurate, incomplete, fabricated, biased, out-of-date or misleading content, including incorrect citations and requirement mappings. A citation, confidence score or plausible explanation does not establish correctness. Different users may receive similar or inconsistent Output.
3.2 Before relying on Output, you must independently review the authoritative source, exact wording, revision and effective date, jurisdiction, facility and reactor applicability, licence conditions, incorporated standards and relevant exceptions. Distinguish binding requirements from draft rules, guidance, proposed amendments, internal procedures and recommended practice. A search result or missing result does not establish that a requirement applies or does not exist.
3.3 Qualified personnel must review any regulatory submission, engineering analysis, compliance matrix, supplier assessment or operational decision influenced by the Service. You remain responsible for approvals, signatures, quality assurance, independent verification, configuration control, regulatory communications and required record retention. Do not file generated documents without that review. The Service does not guarantee faster approval, compliance, completeness, fitness for licensing or acceptance by an authority.
3.4 Do not use the Public Service to control equipment, perform a credited safety function, replace a safety analysis or protection system, make emergency-response decisions, or provide the sole basis for a decision whose error could cause injury, radiological release, substantial environmental harm or damage to critical infrastructure. Informational research about these topics remains subject to the safeguards and content restrictions below.
4. Accounts and acceptable access
4.1 Register using an accurate business email address and provide accurate, proportionate account information. Protect credentials and any enabled authentication factors; do not share personal accounts; and promptly notify us of suspected compromise at hello@xcis.ai. Do not send passwords, authentication codes or sensitive content in an email report. You are responsible for use you authorize, not for misconduct by XCIS or a breach of our own obligations.
4.2 Subject to these Terms, we permit you to access the Service for lawful research and professional use within published limits. You must not bypass access controls, extract another user’s information, introduce malware, conduct unauthorized penetration testing, evade rate limits, disguise prohibited activity, interfere with availability, or use the Service to facilitate unlawful conduct or nuclear-weapons activity. Report vulnerabilities responsibly through the designated channel without exposing protected information.
4.3 Automated access requires an enabled API or our written approval and compliance with published limits. These hosted-access restrictions do not restrict activities expressly permitted by the applicable open-source licence for separately distributed code, or rights that applicable law does not allow us to restrict.
5. Information permitted in the Public Service
5.1 Except for necessary account, consent and support information about yourself, submit only non-confidential material that you are lawfully entitled to provide for the processing described in these Terms and the Privacy Policy. Where third-party personal information is incidental to an otherwise lawful public document, remove it unless necessary and lawfully authorized. Prefer a public source link over uploading a document where that meets your need.
5.2 Do not submit employer, client, supplier, government or partner confidential information; unpublished plant information; trade secrets; legally privileged material; protected operating experience; personal health or dosimetry records; credentials; government identifiers; precise personal location information; or other sensitive personal information to the Public Service. Purchasing or accessing a document does not necessarily grant permission to upload, index or share it.
5.3 Public availability, absence of a classification marking and an “open-source” label do not by themselves establish permission to upload or disclose material. You must consider contractual confidentiality, privacy, intellectual-property, nuclear-security and export restrictions independently. A user declaration does not legalize processing that is otherwise prohibited.
6. Restricted nuclear information and export controls
6.1 The Public Service must not receive classified information; Restricted Data or Formerly Restricted Data; US Safeguards Information, including SGI-M; Controlled Unclassified Information; Canadian prescribed information; or nuclear technology, technical assistance or other information requiring an authorization that does not cover the specific disclosure and all relevant recipients. These are contractual exclusions for this public offering, even where a different qualified system might lawfully process some of these categories.
6.2 Do not submit non-public physical-protection plans, adversary or vulnerability assessments, security-system configurations, sensitive cyber architecture, protected access arrangements, controlled drawings or technical data, or other information whose disclosure could compromise nuclear security. Legal protection may depend on substance rather than a document label.
6.3 You and XCIS each remain responsible for export, import, sanctions and nuclear-information obligations applicable to your respective conduct. Potentially relevant regimes include US DOE 10 CFR Part 810, NRC requirements, the EAR and ITAR where applicable, US sanctions, Canada’s nuclear import/export controls, Export and Import Permits Act and sanctions laws, and applicable controlled-goods requirements. This list is not a classification determination or export authorization.
6.4 Cross-border processing, overseas support, a foreign-person reviewer, sharing a workspace and a model-provider transfer can each require separate analysis. Neither these Terms nor a data-processing agreement grants a government authorization. Do not submit potentially controlled information until an appropriate specialist has confirmed its status and the deployment is expressly approved in writing. XCIS may limit access by location or other legally relevant criteria and request proportionate verification.
6.5 If restricted material is submitted inadvertently, stop further transmission and send an initial notice to hello@xcis.ai without attaching, quoting or describing the protected substance of the material. We will provide appropriate handling instructions. This mailbox is not an approved channel for transferring restricted information. We may isolate access, stop processing, preserve a restricted incident record, engage designated specialists and make legally required notifications. We will not treat accidental receipt as permission to publish, train on or freely circulate the material. Nothing transfers XCIS’s own statutory duties to the user.
7. Workspaces, administrators and sharing
7.1 Where offered, personal and organization workspaces have the access settings disclosed in the interface. Content is not public merely because the software is open source. We do not publish User Content by default. An organization administrator may manage membership, access, retention and export of organization-workspace information as disclosed before you join that workspace.
7.2 An email address at a company domain does not alone authorize another person to take ownership of your personal workspace. Any account migration or organization claim must use a disclosed, verified process. Organization rules must be communicated separately. An organization administrator cannot authorize XCIS to train on User Content through ordinary workspace administration or account signup.
7.3 Sharing with colleagues, external participants, a community or the public requires an explicit action identifying the material and intended audience. Check that you have permission for every recipient. Recipients may retain or further distribute copies outside XCIS’s control. Revoking a link cannot necessarily retrieve copies already lawfully obtained. Public sharing is separate from using the Service and does not give XCIS permission to train on the shared material.
8. Your rights in content and our processing permission
8.1 You retain the rights you hold in Input. As between you and XCIS, XCIS assigns to you any rights it may have in Output generated specifically for you, to the extent transferable, excluding Source Materials, XCIS software and other pre-existing rights. This does not promise that Output is copyrightable, exclusive, original, patentable or non-infringing, or grant rights that XCIS does not hold.
8.2 You authorize XCIS and its contracted service providers to receive, transmit, host, copy, parse, index, create embeddings from, retrieve, display and otherwise process User Content only as reasonably necessary to deliver your requested features, maintain security, resolve your support requests, comply with law and implement your authorized sharing. This permission is limited by the Privacy Policy, retention schedule and any applicable written data-processing agreement.
8.3 This service-delivery permission is not a licence to sell your documents, publish your conversations, train our or a provider’s models on User Content, or use it for unrelated research. Continuing retention after deletion or termination is limited to the disclosed deletion process and narrowly justified legal, security or agreement-record obligations.
9. No customer-content training; limited aggregation
9.1 We do not use User Content, including prompts, responses, uploaded files, workspace context, extracted text and embeddings, to train or fine-tune models, build reusable evaluation or benchmark datasets, or develop general-purpose model improvements for XCIS, other users or third parties. Customer-content model-improvement contributions are not offered under these Terms. There is no training opt-in at signup.
9.2 Processing User Content to answer your request, create embeddings or indexes for your authorized workspace, apply safety checks, investigate a specific security issue or resolve your support request is service delivery, not permission for the secondary activities prohibited by section 9.1. We do not authorize our contracted AI providers to independently train on User Content.
9.3 Account creation, an ordinary feedback message, an organization administrator’s action, sharing content or accepting an updated version of these Terms does not grant a training licence. Any future proposal to use customer content for a different purpose would require a separately described lawful arrangement and any necessary express consent or rights-holder authorization before that use. A revised policy cannot retroactively supply that permission.
9.4 We may derive and retain genuinely anonymous, non-confidential aggregate statistics for service operation, capacity planning and ecosystem reporting, including total searches, documents generated or reviewed, usage volumes and appropriately supported estimates of time saved. Published statistics will not identify a person, organization, project or facility. Retaining aggregate counts does not permit keeping deleted prompts, files or other identifiable content, or using User Content for model training. Pseudonyms, hashed identifiers and embeddings are not assumed to be anonymous.
10. Source Materials and third-party rights
10.1 Source Materials remain subject to their owners’ rights, applicable publication terms and any relevant licence. A standard referenced in regulation is not automatically free of copyright or freely redistributable. Output may include quotations or references that require separate permission for your intended use. We may limit excerpts, access, indexing or export of licensed materials and remove sources when rights are uncertain.
10.2 You must not remove attribution, circumvent a paywall or licence restriction, or use the Service to reconstruct or distribute a protected publication. XCIS’s branding and third-party marks are not licensed for endorsement or misleading use. Inclusion of a supplier, product or source does not establish fitness, certification or freedom to operate.
10.3 Report claimed infringement or other unlawful content to hello@xcis.ai or by mail to XCIS Consulting Inc, operating as XCIS AI, 21-1640 Grandview St North, Oshawa, ON, L1K 0S6, Canada, identifying the work or right, the specific material and location, your contact information, authority and a good-faith explanation. Do not include controlled material in the notice. We may restrict material while investigating and provide an appropriate response or counter-notice process where applicable. No statutory safe-harbour status is represented by this clause.
11. Open-source software and community contributions
11.1 Hosted access, source-code licensing and data publication are distinct. XCIS-authored code that we expressly release as NuclearPath AI open-source software is distributed under the MIT License included with the applicable release. The licence file and notices accompanying that release govern the software rights granted. This does not license unreleased code or imply that every component, model, reference document or dataset is MIT-licensed. Information about an available release can be requested at hello@xcis.ai.
11.2 These Terms do not amend an applicable open-source licence or impose additional field-of-use restrictions on rights it grants. Third-party components have their own notices and licences. A source-code licence does not grant access to hosted infrastructure, customer information, protected reference publications or XCIS trademarks.
11.3 A self-hosted instance is operated by its own administrator. The Privacy Policy describes XCIS’s processing, not that of an independent operator. Connections from a self-hosted instance to XCIS-hosted services are governed by the terms for those services; optional telemetry and its destination must be disclosed by the applicable deployment.
11.4 Contributions intended for code or other public release require a separate contribution notice identifying the material, destination, licence, attribution and authority. Contributors must clear employer, publisher, patent, privacy and export rights before submission. Ordinary use or sharing of the Service is not an open-data publication licence. We do not promise to accept or publish contributions.
12. Integrations and agentic features
12.1 Enterprise-account connectors and corporate single sign-on are not currently provided. External web search, where made available, is initiated in response to a user request rather than independent background monitoring of users. Stored search results are associated with the relevant prompt. Privacy section 5 and Schedule P1 explain the disclosure conditions for any outbound search or website retrieval. A third-party connection requires disclosure of its recipient, requested permissions and information transferred before activation. Disconnecting stops future access but does not necessarily delete copies lawfully retained by an independent recipient.
12.2 Where agents can draft documents, complete forms, share information or invoke tools, you must specify permitted scope and verify the proposed action. External submissions, consequential changes and disclosure outside the workspace require an authorized human confirmation. The Public Service is not authorized to autonomously file with regulators, execute engineering changes or control plant systems. Instructions embedded in a retrieved document are not your authorization to perform an action.
13. Privacy, safeguards and confidentiality boundaries
13.1 We process personal information as described in the Privacy Policy. Its security, provider and retention disclosures describe the relevant safeguards and processing boundaries. We do not promise absolute security, zero retention, exclusive Canadian or US processing, air-gapped operation or a certification unless expressly stated in an applicable written agreement and supported by the deployment.
13.2 The Public Service’s input restrictions do not excuse us from safeguarding information we receive or complying with law. Nevertheless, this public offering is not an approved confidential nuclear workspace. Such a deployment requires separate scope, security, data-processing, location and regulatory assessments before the relevant information is accepted.
13.3 The Public Service uses shared Microsoft Azure infrastructure in Canada and the United States and includes Azure OpenAI Global deployments. The Public Service does not provide user-selected geographic isolation or a guarantee that AI processing stays in Canada, the United States or North America. See Privacy section 9. If you require a specified storage or processing region, contact hello@xcis.ai before submitting information. A geographically restricted or local deployment is subject to feasibility, separate written terms and implementation; contacting us or opening an account does not establish one.
14. Availability, fees and changes
14.1 The Public Service is currently offered free of charge, subject to published capacity and usage limits. Unless a separate written agreement says otherwise, it has no guaranteed uptime, support response, user-restoration service or regulatory update schedule. We may maintain, change or discontinue features and remove unsafe or unlicensed sources. This does not override the data-handling and deletion commitments in the Privacy Policy.
14.2 We will not start charging you merely because you accepted these Terms. Paid access requires a separate, clearly presented order or checkout identifying charges, taxes, term, renewal and cancellation rules. Any service-level commitment must be expressly agreed.
14.3 We will provide reasonable notice of a material planned service reduction where practicable, except where immediate action is necessary for law, security or third-party rights. A feature change does not authorize a new purpose for personal information without the notice and legal basis required by the Privacy Policy.
15. Suspension, closure and records
15.1 You may request account closure or deletion at hello@xcis.ai or through an available deletion control in the Service. On a valid request, we will promptly restrict access, search and sharing of the affected content and permanently remove the relevant active account and content data within 30 days, sooner where required by law. Residual backups, narrowly justified legal records and independently held copies are addressed in Privacy section 10 and Schedule P2. Soft deletion or marking information inactive alone does not complete that commitment.
15.2 Where lawful and technically available, we will give a reasonable opportunity to retrieve permitted content before a planned termination. This does not require returning malware, restricted information or material we cannot lawfully disclose. You must maintain your own authoritative copies and regulated records outside the Public Service.
15.3 Termination ends permission to use the hosted Service. It does not revoke rights already granted by an applicable open-source licence. Content rights, accrued payment obligations, applicable liability provisions and other provisions intended to survive remain effective, subject always to deletion and privacy obligations.
15.4 We may make an account dormant after 360 days without login. Dormancy is not permanent deletion and does not replace your right to request deletion. We may suspend or terminate access for material breach, prohibited use, security risk, legally required action or discontinuation. We will explain the reason and an available review route where lawful and practicable; immediate protective action may precede notice. Contact hello@xcis.ai to request review.
16. Warranties and disclaimers
16.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE PUBLIC SERVICE AND OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” XCIS DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING, TO THE EXTENT THEY MAY LAWFULLY BE DISCLAIMED.
16.2 We do not warrant uninterrupted operation, error-free results, completeness of a corpus, regulatory acceptance, an approval timetable or suitability for safety-critical use. These disclaimers do not override express written commitments, mandatory consumer protections, statutory privacy obligations, or liability that cannot lawfully be excluded.
17. Limitation of liability
17.1 Subject to section 17.3, neither party is liable to the other under these Terms for indirect, special or consequential loss, lost anticipated profit, lost opportunity or loss of goodwill arising from the Public Service, to the extent that exclusion is lawful. This does not reclassify a legally recoverable direct loss as indirect simply because it involves data or incident response.
17.2 Subject to section 17.3, XCIS’s aggregate liability arising from the Public Service and these Terms in any twelve-month period will not exceed the greater of (a) USD 1,000 and (b) the fees you paid to XCIS for the Public Service during the twelve months immediately preceding the event giving rise to the claim. Related claims do not multiply this cap. A separate enterprise agreement may establish different limits.
17.3 Nothing excludes or limits liability for fraud, fraudulent misrepresentation, intentional misconduct, gross negligence where non-excludable, death or personal injury where non-excludable, or any liability or remedy that applicable law does not permit the parties to limit. Nothing limits a regulator’s powers or your non-waivable privacy, consumer or other statutory rights. Local mandatory law prevails over inconsistent provisions.
18. Organization indemnity
18.1 If you accept on behalf of an organization, that organization will defend XCIS against a third-party claim to the extent caused by its unlawful Input, infringement of a third party’s rights in material it supplied, or its knowing submission of prohibited content, and pay damages and reasonable external defence costs finally awarded or approved in settlement. This obligation does not apply to ordinary individual consumers or to a claim caused by XCIS’s unauthorized processing, modification or misconduct.
18.2 XCIS must promptly notify the organization, allow it to control a competent defence, and provide reasonable cooperation at its expense. No settlement may impose an admission, non-monetary obligation or unreimbursed payment on XCIS without consent, not unreasonably withheld. The parties’ respective responsibility must be assessed where both contributed to a loss. Any enterprise indemnity and its relationship to liability limits require separate agreement.
19. Governing law and disputes
19.1 Subject to mandatory law, these Terms are governed by the laws of Ontario and the federal laws of Canada applicable in Ontario. Disputes may be brought before the competent courts of Ontario, Canada. This choice does not deprive a consumer or other protected person of mandatory protections or access to a court available under applicable law.
19.2 Before filing an ordinary commercial claim, the parties should attempt good-faith resolution through hello@xcis.ai. This does not delay a statutory deadline, regulatory complaint or application for urgent relief. These Terms do not impose mandatory arbitration, a class-action waiver or a jury waiver.
20. Notices, amendments and general provisions
20.1 We will post a dated version and provide appropriate notice of material changes through the Service or your verified email. Where renewed agreement or consent is required, we will obtain it before the relevant change takes effect. A new term will not retroactively authorize use of previously collected information for model training or other incompatible purposes.
20.2 Electronic acceptance records may establish the version accepted and choices made. You may download these Terms and request a copy of your recorded acceptance. Accessible and, where required, translated versions will be made available before contracting. A language-selection clause does not waive mandatory language rights.
20.3 These Terms and specifically incorporated documents govern the Public Service. An executed order or enterprise agreement controls only the matters it expressly changes; an executed data-processing agreement controls covered personal-data processing; an applicable open-source licence controls the software rights it grants; and mandatory law always prevails. The Privacy Policy limits rather than expands general content-processing permissions. An unsigned enterprise addendum is not accepted by ordinary public signup.
20.4 A failure to enforce a provision is not a waiver. An invalid provision is severed only to the extent lawful, leaving the remainder effective. Neither party may assign this agreement to avoid existing privacy or other obligations. XCIS may assign it in a lawful corporate reorganization or business transfer subject to notice and continuation of applicable protections. There are no intended third-party beneficiaries except where expressly agreed or required by law.
20.5 Questions, legal notices, privacy requests and complaints may be sent to hello@xcis.ai or to XCIS Consulting Inc, operating as XCIS AI, 21-1640 Grandview St North, Oshawa, ON, L1K 0S6, Canada. Address privacy correspondence to the Privacy Officer. For a potential nuclear-information incident, make safe initial contact only; do not attach restricted information without an approved secure procedure.