Terms of Service

In these Terms of Service, the following words and expressions shall have the meanings set out below unless the context requires otherwise:

2.1  By creating an account, accessing, or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Agreement in its entirety. If you are entering into this Agreement on behalf of a company, organisation, or other legal entity, you represent and warrant that you have the authority to bind that entity to this Agreement.

2.2  If you do not agree to these Terms, you must not access or use the Service. Your continued use of the Service following the posting of revised Terms constitutes your acceptance of such changes, subject to the notice provisions in Section 15.

2.3  These Terms constitute the entire agreement between you and VerifyFlow with respect to the use of the Service, and supersede all prior or contemporaneous communications, proposals, and agreements, whether electronic, oral, or written, between you and VerifyFlow with respect to the Service.

3.1  VerifyFlow is a software-as-a-service (“SaaS”) platform that provides identity verification, know-your-customer (“KYC”), and anti-money laundering (“AML”) compliance tools designed for UK accountancy practices, authorised corporate service providers (“ACSPs”), and other regulated professional firms.

3.2  The Service includes, but is not limited to, the following features:

• Document verification with optical character recognition (“OCR”), machine-readable zone (“MRZ”) parsing, and automated fraud detection for passports, driving licences, and national identity cards;
• Biometric face matching between a live selfie photograph and the photograph on a presented identity document;
• Liveness detection to guard against presentation attacks including printed photographs, screen replays, and masks;
• Screening against HM Treasury (“HMT”), United Nations (“UN”), and Office of Foreign Assets Control (“OFAC”) sanctions lists, politically exposed persons (“PEP”) databases, and adverse media sources;
• Automated risk scoring and customer due diligence (“CDD”) level recommendations;
• Case management, compliance review workflows, and human review pathways;
• Companies House data import and company officer management;
• Cryptographically signed Evidence Packs for audit and regulatory compliance;
• REST API access and webhook integrations for programmatic use;
• Ongoing monitoring with daily re-screening and document expiry alerts.

3.3  VerifyFlow reserves the right to modify, update, or discontinue any feature of the Service at any time. Where a material change will reduce the functionality available to you, we will provide no less than thirty (30) days’ prior written notice.

3.4  The Service is not a substitute for professional legal advice. While VerifyFlow assists in meeting regulatory obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended), the Customer remains solely responsible for its own compliance with applicable laws and regulations.

4.1  To use the Service you must register for an account by providing accurate, current, and complete information. You agree to update your registration information promptly to keep it accurate and current at all times.

4.2  You are responsible for safeguarding the password and any other credentials used to access your account. You must not share your account credentials with any third party. You agree to notify VerifyFlow immediately at security@verifyflow.uk upon becoming aware of any unauthorised use of your account or any other breach of security.

4.3  You are responsible for all activities that occur under your account, whether or not authorised by you. VerifyFlow shall not be liable for any loss or damage arising from your failure to comply with the obligations set out in this section.

4.4  Each Authorised User must have a unique account. You must not create accounts under false or misleading identities, and you must not create multiple accounts for the same individual.

4.5  VerifyFlow reserves the right to suspend or disable any account that we reasonably believe has been created in breach of these Terms, or that poses a security risk to the Service or other users.

5.1  You agree to use the Service only for lawful purposes and in compliance with all applicable laws and regulations, including but not limited to the Money Laundering Regulations 2017, the Proceeds of Crime Act 2002, the Terrorism Act 2000, the UK GDPR, and the Data Protection Act 2018.

5.2  You shall not, and shall ensure that your Authorised Users do not:

• ×Use the Service to facilitate, conceal, or further any criminal activity, including money laundering, terrorist financing, fraud, or tax evasion;
• ×Submit forged, fraudulent, stolen, or manipulated identity documents or biometric data to the Service;
• ×Attempt to gain unauthorised access to any part of the Service, other accounts, computer systems, or networks connected to the Service;
• ×Reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, algorithms, or underlying structure of the Service;
• ×Use automated scripts, bots, or scraping tools to access the Service, except through the documented REST API within your plan’s rate limits;
• ×Interfere with or disrupt the integrity or performance of the Service or the data contained therein;
• ×Resell, sublicense, or provide the Service to third parties as a managed service without VerifyFlow’s prior written consent;
• ×Remove, alter, or obscure any proprietary notices, labels, or marks on the Service.

5.3  You are solely responsible for ensuring that all Data Subjects have provided the requisite informed consent before their Personal Data (including Special Category Data such as biometric data) is submitted to the Service. VerifyFlow provides a built-in consent gate but does not verify the validity of consent obtained outside the platform.

5.4  VerifyFlow may suspend your access to the Service immediately and without prior notice if we reasonably believe that your use of the Service violates this Section 5 or poses a risk to the security, integrity, or availability of the Service.

6.1  The Service is offered on a subscription basis. Subscription fees are charged in advance on a monthly or annual basis, depending on the plan selected by the Customer. All fees are quoted in pounds sterling (GBP) and are exclusive of value added tax (“VAT”), which will be added at the applicable rate.

6.2  Each subscription plan includes a specified number of Verification Checks per billing period. Usage exceeding the included allowance will be charged at the published per-verification overage rate for your plan, invoiced at the end of each billing period.

6.3  Payment is processed via Stripe. By providing your payment details, you authorise VerifyFlow (through Stripe) to charge your payment method for all fees incurred under your account. You are responsible for ensuring that your payment method remains valid and that sufficient funds are available.

6.4  VerifyFlow may change its fees and charges at any time by providing no less than thirty (30) days’ prior written notice. Fee changes will take effect at the start of the next billing period following the notice period. If you do not agree to the revised fees, you may terminate your subscription before the fee change takes effect.

6.5  If any invoice remains unpaid for more than fourteen (14) days after the due date, VerifyFlow may (a) charge interest on the overdue amount at the rate of 4% per annum above the Bank of England base rate, in accordance with the Late Payment of Commercial Debts (Interest) Act 1998; and (b) suspend your access to the Service until all outstanding amounts have been paid in full.

6.6  A free trial may be offered at VerifyFlow’s discretion. At the end of the trial period, your account will be converted to a paid subscription unless you cancel before the trial period expires. No payment details are required during the trial period unless otherwise stated.

7.1  For the purposes of the UK GDPR, the Customer is the data controller with respect to the Personal Data of Data Subjects that is processed through the Service. VerifyFlow acts as a data processor on behalf of the Customer, processing Personal Data solely for the purpose of providing the Service and in accordance with the Customer’s documented instructions.

7.2  The processing of Personal Data by VerifyFlow is governed by the Data Processing Agreement (“DPA”), which forms part of this Agreement. The DPA is available at /dpa and is incorporated into these Terms by reference.

7.3  VerifyFlow processes Special Category Data (biometric data) as part of the identity verification process. This processing is carried out on the basis that it is necessary for reasons of substantial public interest under paragraph 6 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts), and subject to the Customer having obtained appropriate explicit consent from the Data Subject.

7.4  VerifyFlow implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256);
• SHA-256 cryptographic integrity hashing on all Evidence Packs;
• Automated data retention and deletion in accordance with the retention schedule set out in the DPA;
• Access controls limiting data access to authorised personnel on a need-to-know basis;
• Comprehensive audit logging of all verification activities and administrative actions.

7.5  VerifyFlow’s data retention policy provides for the following default retention periods: identity document images are retained for thirty (30) days; Evidence Packs are retained for six (6) years; raw biometric face descriptors are deleted immediately after the Verification Check is completed. These periods may be adjusted by the Customer in accordance with the DPA.

7.6  VerifyFlow will assist the Customer in responding to Data Subject access requests and in meeting its obligations under Articles 32 to 36 of the UK GDPR, to the extent that such assistance is reasonably required and at the Customer’s cost where the request is excessive or manifestly unfounded.

8.1  The Service, including all software, algorithms, user interfaces, designs, text, graphics, logos, trademarks, and documentation, is the exclusive property of VerifyFlow or its licensors and is protected by copyright, trademark, patent, trade secret, and other intellectual property laws of the United Kingdom and other jurisdictions.

8.2  Subject to the terms and conditions of this Agreement, VerifyFlow grants the Customer a limited, non-exclusive, non-transferable, revocable licence to access and use the Service during the Subscription Term solely for the Customer’s internal business purposes in connection with its regulatory compliance obligations.

8.3  The Customer retains all right, title, and interest in and to the data that it uploads to the Service (“Customer Data”). The Customer grants VerifyFlow a limited licence to process Customer Data solely for the purpose of providing the Service.

8.4  VerifyFlow may use anonymised and aggregated data derived from the Customer’s use of the Service for the purposes of improving the Service, conducting research, and generating industry benchmarks, provided that such data cannot be used to identify the Customer, any Authorised User, or any Data Subject.

8.5  Nothing in this Agreement shall be construed as transferring any intellectual property rights from one party to the other, except as expressly provided herein.

9.1  Each party (the “Receiving Party”) agrees to hold in confidence all non-public information disclosed by the other party (the “Disclosing Party”) that is designated as confidential or that the Receiving Party ought reasonably to know is confidential (“Confidential Information”). Confidential Information includes, without limitation, trade secrets, business plans, financial information, customer lists, technical specifications, and the terms and pricing of this Agreement.

9.2  The Receiving Party shall not disclose Confidential Information to any third party except (a) to its employees, agents, and professional advisors who need to know such information for the purpose of performing obligations under this Agreement and who are bound by confidentiality obligations no less restrictive than those set out in this section; or (b) as required by law, regulation, or order of a court of competent jurisdiction, provided that the Receiving Party gives the Disclosing Party prompt written notice of any such requirement (to the extent legally permitted).

9.3  The obligations of confidentiality set out in this section shall not apply to information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was already known to the Receiving Party prior to disclosure; (c) is independently developed by the Receiving Party without reference to the Disclosing Party’s Confidential Information; or (d) is lawfully received from a third party without restriction on disclosure.

9.4  The confidentiality obligations set out in this section shall survive the termination or expiry of this Agreement for a period of three (3) years.

10.1  VerifyFlow warrants that: (a) it will provide the Service with reasonable skill and care in accordance with generally accepted industry standards; (b) the Service will perform substantially in accordance with the documentation; and (c) it has the right and authority to enter into this Agreement and grant the licences set out herein.

10.2  The Customer warrants that: (a) it has the right and authority to enter into this Agreement; (b) it will use the Service in compliance with all applicable laws and regulations; (c) all Customer Data submitted to the Service has been collected lawfully and with appropriate consent; and (d) it has a legitimate legal basis for processing the Personal Data of Data Subjects through the Service.

10.3  VerifyFlow does not warrant the accuracy, completeness, or reliability of any third-party data sources used in the screening process, including sanctions lists, PEP databases, or adverse media feeds. The Customer acknowledges that screening results are advisory and that the Customer is solely responsible for making final compliance decisions.

10.4  Nothing in this section excludes or limits any warranty that cannot be excluded or limited under applicable law, including the Consumer Rights Act 2015 (where applicable) and the Supply of Goods and Services Act 1982.

12.1  The Customer shall indemnify and hold harmless VerifyFlow, its officers, directors, employees, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or in connection with: (a) the Customer’s breach of this Agreement; (b) the Customer’s violation of any applicable law or regulation; (c) the Customer’s misuse of the Service; (d) any claim by a Data Subject relating to the Customer’s processing of Personal Data in connection with the Service, except to the extent that such claim arises from VerifyFlow’s breach of the DPA; or (e) the submission of fraudulent, forged, or stolen identity documents or biometric data to the Service by the Customer or its Authorised Users.

12.2  VerifyFlow shall indemnify and hold harmless the Customer from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of any claim that the Customer’s use of the Service in accordance with this Agreement infringes the intellectual property rights of a third party in the United Kingdom.

12.3  The indemnifying party’s obligations under this section are conditional upon the indemnified party: (a) giving prompt written notice of the claim; (b) granting the indemnifying party sole control over the defence and settlement of the claim; and (c) providing reasonable cooperation and assistance in the defence of the claim at the indemnifying party’s cost.

14.1  This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the laws of England and Wales.

14.2  Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation.

14.3  Notwithstanding the foregoing, nothing in this section shall prevent either party from seeking injunctive or other equitable relief in any court of competent jurisdiction for the protection of its intellectual property rights or Confidential Information.

15.1  VerifyFlow reserves the right to modify these Terms at any time. Where the proposed changes are material, VerifyFlow will provide no less than thirty (30) days’ prior written notice to the Customer by email to the address associated with the Customer’s account or by prominent notice within the Service.

15.2  Material changes include, but are not limited to: changes to the limitation of liability provisions, changes to the data processing terms, introduction of new fees or charges, and changes to the termination provisions.

15.3  If the Customer does not agree to the revised Terms, the Customer may terminate this Agreement before the revised Terms take effect by providing written notice to VerifyFlow. The Customer’s continued use of the Service after the revised Terms take effect constitutes acceptance of the revised Terms.

15.4  Non-material changes (such as corrections of typographical errors, clarifications of existing provisions, or the addition of new features) may be made at any time without prior notice. The date of the most recent revision will be indicated at the top of these Terms.