Third-Party Services Policy

Asiyst uses and integrates with third-party services to provide, operate, secure, maintain, and enhance the Services.

This Policy explains:

• The role of third-party services.
• Customer responsibilities.
• Third-party integrations.
• Third-party AI providers.
• Payment providers.
• Infrastructure providers.
• Data processing.
• Third-party credentials.
• Availability and security limitations.
• Applicable third-party terms.

This Policy applies to third-party services that:

• Support Asiyst infrastructure.
• Process information on behalf of Asiyst.
• Are integrated into Asiyst products.
• Are connected by customers.
• Provide functionality used through Asiyst.
• Are required for particular features.

Not every third-party service used by Asiyst is necessarily a Subprocessor.

A “Third-Party Service” means a service, software, platform, API, infrastructure provider, website, technology, or other resource operated or controlled by an entity other than Asiyst.

Asiyst may use or integrate with third-party services for:

• Cloud infrastructure.
• Databases.
• Storage.
• AI model processing.
• Authentication.
• Payments.
• Email.
• Analytics.
• Monitoring.
• Security.
• Content delivery.
• Communications.
• Customer support.
• Data processing.
• Developer tooling.
• Other operational functions.

The third-party providers used by Asiyst may change over time.

Provider selection may depend on:

• Security.
• Reliability.
• Availability.
• Functionality.
• Pricing.
• Compliance.
• Geographic requirements.
• Technical requirements.

Some third-party services operate independently from Asiyst.

Such providers may establish their own:

• Terms of service.
• Privacy policies.
• Security practices.
• Data retention practices.
• Pricing.
• Usage restrictions.
• Availability commitments.

Asiyst may allow customers to connect external services to their Asiyst account, project, assistant, website, or application.

Examples may include:

• Websites.
• E-commerce platforms.
• Content-management systems.
• AI providers.
• Databases.
• Business applications.
• Developer platforms.
• Communication platforms.

You are responsible for ensuring that you have authority to connect a third-party service to Asiyst.

You must not connect:

• Accounts you do not control.
• Services without authorization.
• Data sources you are not permitted to access.
• Credentials belonging to another person without permission.

Where Asiyst allows customers to connect third-party credentials, you are responsible for maintaining those credentials and ensuring that their use is authorized.

Credentials may include:

• API keys.
• OAuth tokens.
• Access tokens.
• Secret keys.
• Service-account credentials.
• Other authentication information.

You must protect third-party credentials from unauthorized access.

You should not intentionally expose credentials through:

• Public repositories.
• Client-side code where inappropriate.
• Public websites.
• Logs.
• Screenshots.
• Public documentation.
• Other insecure locations.

You may be able to revoke a third-party connection through Asiyst, the relevant third-party service, or both.

Revoking authorization may prevent associated Asiyst functionality from operating.

Your use of a third-party service may be subject to the third party's terms.

Where applicable, you are responsible for reviewing and complying with those terms.

Third-party providers may collect and process information according to their own privacy policies.

Asiyst does not control independent providers' privacy practices.

A third-party service may process information necessary to provide the functionality for which it is used.

The nature of processing depends on:

• The service.
• Your configuration.
• The information supplied.
• The requested functionality.
• Applicable agreements.

Where a third-party provider processes Personal Data on behalf of Asiyst's customers and qualifies as a subprocessor, it may be governed by Asiyst's applicable Subprocessors Policy and Data Processing Agreement.

Not every third-party service qualifies as a Subprocessor.

Asiyst may use third-party AI providers to process AI requests.

Depending on the configuration, AI providers may process:

• Prompts.
• AI responses.
• Context.
• Knowledge-source content.
• Uploaded content.
• Other information required to generate or process an AI response.

Certain Asiyst features may allow customers to connect their own AI provider accounts.

In these situations, the customer's relationship with the AI provider may be independent of Asiyst.

The provider may apply its own:

• Data processing terms.
• Privacy policy.
• Model restrictions.
• Usage limits.
• Billing.
• Retention practices.

AI functionality may depend on the availability of third-party model providers.

An AI provider may experience:

• Outages.
• Rate limits.
• Capacity restrictions.
• Model changes.
• Service degradation.
• API changes.
• Policy restrictions.

Such events may affect Asiyst functionality.

Third-party AI providers may modify:

• Models.
• Model versions.
• APIs.
• Input requirements.
• Output behavior.
• Pricing.
• Availability.
• Safety controls.

Asiyst may modify its integrations in response to such changes.

Asiyst may use third-party payment processors to process transactions.

Payment providers may process:

• Payment information.
• Transaction information.
• Billing information.
• Fraud-prevention information.
• Refund information.

Payment processing is subject to applicable payment-provider terms and privacy practices.

Payment functionality may be unavailable when the relevant payment provider experiences an outage or service interruption.

Asiyst does not control independent payment-provider infrastructure.

Asiyst may rely on third-party cloud and infrastructure providers for:

• Compute.
• Databases.
• Storage.
• Networking.
• Backups.
• Content delivery.
• Security infrastructure.

The availability of the Services may therefore depend partly on third-party infrastructure.

Asiyst may use third-party authentication or identity services.

Authentication failures caused by an independent provider may affect account access.

Asiyst may use third-party email delivery providers for:

• Account emails.
• Security notifications.
• Transactional communications.
• Support communications.
• Other permitted messages.

Email delivery depends partly on the applicable provider and recipient infrastructure.

Asiyst may use analytics or measurement services to understand:

• Service usage.
• Performance.
• Reliability.
• Feature adoption.
• Errors.
• Product behavior.

The specific information collected depends on the applicable configuration.

Asiyst may use third-party services for:

• Monitoring.
• Error detection.
• Security monitoring.
• Fraud prevention.
• Logging.
• Incident detection.
• Infrastructure observability.

These services may process technical information necessary for their functions.

Asiyst may use third-party support or communications platforms.

Information submitted through support channels may be processed by those providers as necessary to deliver support.

Asiyst may use third-party developer tools, software libraries, package repositories, hosting systems, and other development infrastructure.

Such services may be governed by their own terms and licenses.

The Services may include or depend on open-source software.

Open-source components may be governed by their respective licenses.

Where required, those licenses apply to the relevant component.

Certain third-party software, fonts, models, images, libraries, or other assets may be subject to separate licenses.

You are responsible for complying with applicable license requirements when you use or redistribute such materials.

The Services may retrieve, display, process, or reference content originating from third parties.

Asiyst does not necessarily verify:

• Ownership.
• Accuracy.
• Completeness.
• Legality.
• Availability.
• Suitability.

of third-party content.

The Services may contain links to external websites.

External websites are controlled by their respective operators.

Asiyst is not responsible for:

• External website content.
• External privacy practices.
• External security.
• External availability.
• External transactions.

Customers may connect external websites, documents, databases, or other knowledge sources to Asiyst.

Customers are responsible for ensuring that they have the necessary rights and authorization to use those sources.

Information received from third-party services may be incomplete, outdated, incorrect, or unavailable.

Asiyst does not guarantee the accuracy of third-party information unless expressly stated otherwise.

A third-party provider may restrict or terminate access to its service.

Such restrictions may affect the corresponding Asiyst functionality.

Asiyst may not be able to prevent or reverse an independent provider's decision.

Third-party APIs may change without Asiyst's control.

Changes may require Asiyst to:

• Modify integrations.
• Disable functionality.
• Replace a provider.
• Introduce technical changes.
• Update documentation.

Third-party providers may change their pricing.

Where such changes affect Asiyst's costs or product structure, Asiyst may adjust pricing, functionality, or provider relationships subject to applicable contractual requirements.

Third-party service availability is not necessarily included in Asiyst's own availability commitments.

Where an SLA applies, third-party dependency exclusions are governed by the applicable SLA or written agreement.

Asiyst may evaluate third-party providers using appropriate risk-management processes.

However, Asiyst does not control the internal security practices of independent providers.

If Asiyst becomes aware of a third-party security incident affecting the Services or Customer Data, Asiyst may take appropriate measures based on the circumstances.

Measures may include:

• Investigation.
• Containment.
• Provider coordination.
• Credential rotation.
• Temporary service restrictions.
• Customer notification where required.
• Remediation.

Customers remain responsible for securing their own third-party accounts and integrations.

This includes:

• Strong authentication.
• Appropriate permissions.
• Credential protection.
• Access reviews.
• Revocation of unused connections.
• Monitoring connected services.

Where supported, customers should configure third-party integrations using the minimum permissions necessary to perform the intended function.

Where Asiyst uses OAuth or similar authorization mechanisms, the third-party provider may issue tokens that permit specified access.

Customers should review requested permissions before authorizing a connection.

API-based integrations may require credentials with specific permissions.

Customers are responsible for selecting appropriate credentials and permissions.

Some integrations may create charges directly with the third-party provider.

Unless otherwise stated, those charges are separate from Asiyst charges.

Asiyst is not responsible for charges imposed directly by independent third-party providers.

Customers should review third-party pricing before enabling services that may incur external charges.

If a third-party provider suspends or terminates an account connected to Asiyst, associated functionality may stop operating.

Connecting a third-party account does not transfer ownership of that account to Asiyst.

Ownership and administration remain subject to the third-party provider's applicable terms.

Customers are responsible for determining whether their use of an integration complies with applicable:

• Laws.
• Regulations.
• Contracts.
• Provider terms.
• Licenses.
• Privacy requirements.

Information transmitted to a third-party service may become subject to that provider's data-processing practices.

Customers should review applicable provider documentation before transmitting sensitive or regulated information.

Customers should carefully evaluate whether a third-party integration is appropriate for sensitive information.

Customers should not transmit sensitive information to a third-party provider unless authorized and legally permitted to do so.

Third-party providers may process information in countries or regions different from the customer's location.

Applicable transfer mechanisms and contractual safeguards may apply where required.

Certain third-party services may not be available in all countries or regions.

Asiyst may restrict integrations where required by law, provider requirements, or operational considerations.

Customers remain responsible for determining whether their use of third-party services satisfies industry-specific or regulatory requirements applicable to them.

If third-party terms conflict with Asiyst's Terms of Service, the third-party terms generally govern the customer's direct relationship with that provider.

They do not automatically modify the customer's contractual relationship with Asiyst.

The availability of an integration or reference to a third-party provider does not necessarily constitute an endorsement, partnership, sponsorship, or recommendation by Asiyst.

Asiyst does not guarantee that an independent third-party service will:

• Remain available.
• Remain compatible.
• Remain secure.
• Maintain its functionality.
• Maintain its pricing.
• Maintain its policies.

Asiyst may replace third-party providers where reasonably necessary for:

• Security.
• Reliability.
• Availability.
• Compliance.
• Product development.
• Business continuity.
• Operational requirements.

Asiyst may discontinue support for an integration where:

• The provider discontinues its service.
• The provider changes its API.
• Security requirements cannot be satisfied.
• Legal requirements change.
• The integration becomes technically unsupported.
• The provider relationship ends.

Where reasonably appropriate and required by applicable law or contract, Asiyst may provide notice of material third-party integration changes.

When a third-party connection is disconnected, Asiyst may delete associated connection information according to its Data Deletion Policy and applicable technical requirements.

Information retained by the third-party provider is governed by that provider's policies.

Information may remain temporarily in third-party backup systems after deletion.

Backup retention is governed by the relevant provider's technical and contractual practices.

Third-party services that process Personal Data on Asiyst's behalf may be treated as subprocessors where applicable.

The Subprocessors Policy provides additional information.

The Privacy Policy explains how Asiyst handles Personal Data.

This Policy supplements, rather than replaces, the Privacy Policy.

Third-party security requirements may also be addressed in Asiyst's Security Policy and Security & Trust Center.

Third-party payment processing is also governed by the applicable Payment Terms and Refund Policy.

AI-related third-party processing is also addressed in the AI Transparency & Disclosure, AI Usage Policy, and applicable data-processing documentation.

Where a third-party service generates information or output, customers are responsible for reviewing that output before using it for important purposes.

If a third-party integration permits automated actions, customers are responsible for ensuring that those actions are authorized and appropriately configured.

Customers should regularly review third-party permissions and revoke access that is no longer necessary.

If Asiyst terminates or loses access to a third-party service, affected functionality may be modified, suspended, or discontinued.

Failures caused by circumstances outside Asiyst's reasonable control, including major failures of third-party infrastructure, may be subject to the applicable force-majeure and service-availability provisions.

Use of a third-party service does not transfer ownership of Asiyst software, trademarks, technology, or other intellectual property to that provider or customer.

Use of a third-party service through Asiyst does not transfer ownership of Customer Content to Asiyst or the third-party provider, except for rights necessary to provide the applicable service.

Customers remain responsible for determining what information they choose to send through third-party integrations.

Asiyst may provide configuration controls intended to help customers manage such transfers, but customers remain responsible for their configuration.

Where a customer directly uses or connects a third-party service, the customer must comply with applicable provider policies.

Violations of a third-party provider's terms may result in the provider restricting the integration.

Customers may not use Asiyst to bypass:

• Third-party rate limits.
• Authentication requirements.
• Usage restrictions.
• Licensing restrictions.
• Security controls.
• Billing controls.
• Other provider restrictions.

Asiyst may monitor integration activity where reasonably necessary for:

• Security.
• Reliability.
• Abuse prevention.
• Troubleshooting.
• Service operation.
• Compliance.

Asiyst may suspend an integration where reasonably necessary to:

• Protect security.
• Prevent abuse.
• Address a provider incident.
• Comply with law.
• Protect Asiyst or other users.
• Prevent unauthorized access.

Disputes between a customer and an independent third-party provider are generally between those parties.

Asiyst is not responsible for resolving disputes concerning services it does not control.

To the extent permitted by applicable law, Asiyst is not responsible for losses caused solely by an independent third-party provider's acts, omissions, outages, changes, or failures.

Customers should review relevant third-party documentation before configuring an integration.

Third-party documentation may contain requirements not controlled by Asiyst.

Asiyst may provide documentation describing third-party integrations.

Such documentation may become outdated when third-party providers change their services.

Experimental or beta integrations may be subject to additional limitations and may not be covered by standard availability commitments.

Customers may not rely on undocumented methods to connect third-party services to Asiyst where such methods are not expressly supported.

This Policy supplements Asiyst's Terms of Service.

If a separate written agreement contains specific provisions regarding a third-party integration, that agreement controls to the extent applicable.

Where a Data Processing Agreement applies, its provisions regarding third-party processing and subprocessors control to the extent of any conflict.

The Subprocessors Policy governs third-party providers that qualify as subprocessors for applicable Customer Data processing.

Security requirements and responsibilities may also be governed by Asiyst's Security Policy, Security & Trust Center, and Incident Response & Security Breach Policy.

Asiyst may update this Policy when:

• Third-party relationships change.
• New integrations are introduced.
• Existing integrations are discontinued.
• Legal requirements change.
• Security practices change.
• Service functionality changes.

Questions regarding third-party services, integrations, providers, data processing, or related concerns should be submitted through the applicable Asiyst support, privacy, legal, or account-management contact method.