The version that applies to you is the one you accept in the room. This copy is for information. "Sealroom" is the working name of the Haihtuva service.

Sealroom Terms of Service

Version 1.1 (final) Effective date: 6 October 2026

Summary

1. Parties, documents and definitions

1.1 Parties. These Terms are made between Biotech Start-Up Management Oy, Business ID 2574531-6, Vanhatie 70, 86100 Pyhäjoki, Finland ("BSUM"), and the organisation on whose behalf a User accepts them (the "Customer").

1.2 Documents. The agreement between BSUM and the Customer consists of: (a) these Terms, including Schedule 1 (Data processing); (b) the Platform and Room Use Rules (the "Room Rules"); (c) the AI Use Notice; (d) for each Room, the Room Security and Processing Specification approved for that Room (the "Security Specification"); and (e) any order form, pilot letter or price list agreed in writing (an "Order"). If they conflict, the order of priority is: the Order (for commercial terms only), these Terms, the Room Rules, the AI Use Notice and the Security Specification, except that the Security Specification prevails on the technical configuration of its Room.

1.3 Definitions. - "Service" or "Sealroom": the confidential due-diligence room service operated by BSUM, including its software, interface, workflows, methods, documentation and BSUM-provided prompts and system instructions. - "Room": one transaction space within the Service. - "Seller": the organisation that makes its documents available in a Room. "Buyer": an organisation invited to a Room to evaluate the transaction (including a prospective investor, licensee or acquirer). - "User": an individual who uses the Service on behalf of the Customer, including the Customer's employees and any adviser the Customer invites. - "Transaction": the transaction or proposed transaction for which a Room is opened. - "Permitted Purpose": the purpose for which a Room is made available, as identified in the Order or Security Specification, such as a transaction, proposed investment, acquisition, licence, collaboration, research-commercialisation assessment, due-diligence preparation, portfolio review or another purpose approved by BSUM. References in the agreement that limit use to the Transaction mean the Permitted Purpose. - "Transaction NDA": any non-disclosure, confidentiality or similar agreement between a Seller and a Buyer (or their affiliates) concerning the Transaction. - "Transaction Information": documents, data, communications, page images, transaction facts, reports and other information supplied or made available by a Seller, a Buyer or their advisers in connection with the Transaction. - "Platform Information": non-public information concerning Sealroom, including the software, architecture, security design, configurations, attestation details, BSUM-provided prompts and system instructions, workflows, methods, non-public interface elements, documentation, roadmap, vulnerabilities, tests, performance information, non-public pricing and technical operation. - "Customer Content": content uploaded, connected, submitted or written by or for the Customer in the Service, including documents made available from the Customer's storage, questions, answers, instructions and settings the Customer writes, but excluding Platform Information. - "Customer Results": reports, answers, briefs, findings and other outputs generated in the Service from Customer Content (and, for a Buyer, from Transaction Information made available to it), excluding embedded BSUM materials, BSUM-provided prompts and system instructions, and the underlying Service. - "Account Data": names, e-mail addresses, organisation, authentication and sign-in data, acceptance records and the access logs of Users. - "Competitor": a person or organisation that offers, or is actively preparing to offer, a virtual data-room, confidential due-diligence room or AI-assisted due-diligence service that competes with the Service, and anyone acting on its behalf. - "Fees": the fees payable to BSUM under an Order.

2. The Service

2.1 Sealroom lets a Seller make documents from its own storage available, read-only, to invited Buyers for AI-assisted analysis and protected viewing, and lets the Seller prepare its own documents for due diligence. The Service is provided to businesses only.

2.2 Within a Room, the Seller decides which documents are made available and to whom. Each Buyer decides its own AI settings, questions and reports, within the configuration approved in the Security Specification.

2.3 BSUM operates the Service. BSUM is not a party to the Transaction or to any Transaction NDA, does not review or moderate Transaction Information, and gives no assurance about the Transaction, the parties or the accuracy or completeness of Transaction Information.

2.4 Pilot. Where the Service is provided as a pilot, the scope, duration and any Fees are set out in the Order. Pilot features may change or be withdrawn. Sections 8, 9, 11, 12, 15 and 18 apply in full during a pilot.

3. Customer responsibility for Users and advisers

3.1 The Customer is responsible for: (a) deciding which individuals it invites and makes Users; (b) ensuring that its access to Transaction Information, and access by each of its Users and permitted advisers, is authorised under the applicable Transaction NDA or another lawful confidentiality arrangement; (c) the acts and omissions of its Users as if they were its own; and (d) removing access for Users who should no longer have it.

3.2 Each User who accepts these Terms confirms that they are authorised to accept them for the Customer. If a User lacks that authority, the User is personally bound, to the extent the law allows, by the conduct rules in sections 5, 6 and 9 and in the Room Rules and AI Use Notice. The domain of a User's e-mail address is evidence of the organisation the User acts for, but is not by itself conclusive proof of authority.

4. Relationship to the Transaction NDA

4.1 Transaction Information. As between a Seller and a Buyer, their Transaction NDA governs the confidentiality, permitted use, disclosure, copying, retention and destruction of Transaction Information. Nothing in the Sealroom documents amends, replaces, limits or interprets a Transaction NDA, changes its governing law or forum, or redefines who may receive Transaction Information under it.

4.2 Platform matters. As between BSUM and the Customer, these Terms govern access to the Service, User conduct within the Service, technical restrictions, Platform Information, BSUM's intellectual property, platform security, suspension and BSUM's remedies. A Transaction NDA does not limit BSUM's rights under these Terms. For example, a Transaction NDA that permits copies of documents does not permit screenshots of the protected viewer.

4.3 No additional rights. Access to a Room does not give the Customer any right to use, disclose or retain Transaction Information beyond the rights granted by the Seller and the applicable Transaction NDA. Transaction Information may be accessed and used through Sealroom only for the purpose authorised by the Seller and that Transaction NDA.

4.4 No BSUM responsibility. BSUM does not warrant, and has no duty to verify, that a valid Transaction NDA exists, that any individual User is personally a party to it, or that any User's conduct complies with it, and BSUM does not monitor or enforce any Transaction NDA. The Seller enforces its Transaction NDA. BSUM may, as permitted by law and section 13, provide content-free records to a party to support enforcement.

5. Accounts and access

5.1 Accounts are personal. Sign-in requires a password and an authenticator code. Users must keep credentials and authenticators private, must not share accounts, credentials or sessions, and must tell BSUM and their own administrator without delay if they suspect misuse.

5.2 The Seller may add, restrict or remove Users and withdraw documents at any time. Each side's administrators may add or remove Users on their own side within the limits the Room allows.

5.3 Competitor access. The Customer must not invite or give access to the Service, or to Platform Information, to a Competitor without BSUM's prior written approval. If a Transaction participant or adviser is a Competitor, the Customer must ask BSUM before inviting them. BSUM will not unreasonably withhold approval where access is limited to the Permitted Purpose and subject to these Terms.

6. Acceptable use

The Customer and its Users must use the Service only for the Permitted Purpose of the Room to which they were invited, in accordance with law, these Terms, the Room Rules and the AI Use Notice, and must not: - make available material they are not entitled to make available, or that infringes the rights of others; - use the Service in breach of sanctions or export-control laws; - interfere with or overload the Service, or introduce malware; - access or attempt to access another party's data or settings, or any document they are not permitted to see; - carry out security testing, scanning or probing of the Service without BSUM's prior written permission (BSUM welcomes responsible reports of suspected vulnerabilities through the contact details published on BSUM's website at www.bsum.fi (at the effective date of these Terms: juhani.lahdenpera@bsum.fi)); - use the Service in any way that is unlawful or misleading.

7. Licence

BSUM grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable and revocable right, for the term of the agreement, for its Users to use the Service for the Transaction in accordance with these Terms. All rights not expressly granted are reserved.

8. Platform Information

8.1 The Customer must keep Platform Information confidential, use it only to use the Service, and disclose it only to Users who need it for that purpose and are bound by these Terms. The Customer must protect it with at least reasonable care.

8.2 This duty lasts for the term of the agreement and five years after it ends, and for information that is a trade secret, for as long as it remains a trade secret under applicable law.

8.3 The duty does not apply to information that is or becomes public without breach of these Terms, that the Customer lawfully possessed before receiving it from BSUM free of any confidentiality duty, that the Customer lawfully receives from a third party free of any confidentiality duty, or that the Customer develops independently without use of Platform Information. The Customer may disclose Platform Information where required by law or by a court or authority, after notifying BSUM where lawful and disclosing only what is required.

8.4 BSUM identifies Platform Information as confidential and applies access restrictions to it in order to protect it as a trade secret. The Customer acknowledges that BSUM-provided prompts and system instructions, the security design and non-public workflows are Platform Information whether or not marked.

9. Protection of the platform

9.1 Ownership. The Service and Platform Information, including the software, its protected interface elements, documentation, BSUM-provided prompts and system instructions, workflows, methods, security architecture and inventions (including those in BSUM's pending patent application filed in Finland), belong to BSUM or its licensors. BSUM claims rights in its specific implementation, confidential configuration, protected expression, inventions, trade secrets and contractually protected information. BSUM does not claim exclusive rights in the general idea of an AI-assisted data room, in general due-diligence practice or in confidential computing as such.

9.2 Restrictions. Except as these Terms expressly allow, the Customer must not, and must not permit or assist anyone to: - copy, mirror, frame or reproduce the Service, its interface or its documentation; - scrape, crawl or extract data, screens, interface elements or Platform Information by automated or systematic means; - reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, BSUM-provided prompts, system instructions, policies, model configurations or security design; - attempt to extract BSUM-provided prompts or system instructions, including by prompting a model to reveal them; - bypass, disable or interfere with access controls, watermarks, logging, attestation or other security functions; - use Platform Information, unauthorised copies of the Service, extracted prompts, non-public workflows, security architecture, protected interface elements or other BSUM confidential information to design, develop, train, evaluate, improve, operate or market a product or service competing with Sealroom; - publish benchmarks, performance or security test results, comparisons, screenshots or descriptions of non-public parts of the Service without BSUM's prior written permission; - use BSUM's names, logos, screenshots or materials publicly without BSUM's prior written permission; - do indirectly, through an affiliate, contractor, portfolio company, adviser or any other person, anything the Customer may not do directly.

9.3 Independent development and mandatory law. Nothing in these Terms prevents the Customer from investing in, advising, acquiring or independently developing a product or service that competes with Sealroom, provided that it does not use Platform Information, infringe BSUM's rights or breach these Terms. The restrictions in section 9.2 do not apply to the extent that the activity cannot lawfully be prohibited by contract under mandatory law, including the limited rights of a lawful user of a computer program under applicable copyright law.

9.4 Investigation. BSUM may investigate suspected breach of sections 5, 6 or 9 using records described in section 13, without access to Transaction Information. The Customer will cooperate reasonably, including by providing information about the Users and systems involved.

10. Customer Content and Customer Results

10.1 As between BSUM and the Customer, the Customer (or its licensors) retains all rights in its Customer Content and Customer Results. Rights in Transaction Information as between Seller and Buyer are governed by the Transaction NDA.

10.2 The Customer grants BSUM the limited rights needed to host, transmit and process Customer Content and Customer Results solely to provide the Service in accordance with the Security Specification, these Terms and Schedule 1.

10.3 BSUM does not use Customer Content, Transaction Information or Customer Results to train, fine-tune or evaluate any AI model, and does not use them to improve the Service, except where the Customer separately and expressly instructs BSUM in writing.

10.4 Customer Results may contain or reflect elements of the Service, such as report structures and headings. The Customer may use such elements as part of its Customer Results for its own purposes, but this gives no right to the underlying Platform Information.

11. Feedback

11.1 "Feedback" means suggestions, ideas, error reports, enhancement requests or comments about the Service that the Customer or its Users give to BSUM. Feedback does not include Customer Content, Transaction Information or Customer Results.

11.2 BSUM may use, modify and exploit Feedback for any purpose without restriction, payment or attribution. To the extent the Customer or its Users hold rights in Feedback, the Customer assigns, and will procure that its Users assign, those rights to BSUM, and grants BSUM a perpetual, irrevocable, worldwide, royalty-free licence to the extent an assignment is not effective.

11.3 The Customer must not include Transaction Information or personal data in Feedback or support requests unless BSUM asks for it.

12. Data protection

12.1 Roles. Each Seller and Buyer acts as controller for the personal data in its Customer Content and Customer Results for which it determines the purposes and means of processing. BSUM acts as processor for such personal data and for Account Data processed to run the Service, on the documented instructions of the Customer given through these Terms, the Room's settings and approvals. BSUM acts as an independent controller for the personal data it needs for contract evidence (section 15), billing, compliance with its legal obligations, and the security of the Service. The roles depend on the actual processing; Schedule 1 describes the typical allocation.

12.2 Processing terms. Where BSUM acts as processor, Schedule 1 forms the data processing agreement under Article 28 of the GDPR.

13. Security and records

13.1 Security Specification. The technical configuration of each Room, including the model, endpoint, region, network paths, processing modes, output settings, recovery settings and attestation information, is recorded in its Security Specification. BSUM's security commitments are those described in the Security Specification and Schedule 1. No system is completely secure, and BSUM does not warrant that the Service is uninterrupted or error-free.

13.2 Operator access. The Service is designed so that BSUM personnel are not provided with application functionality, credentials or cryptographic keys enabling them to access Transaction Information or Customer Content in plain text. Room keys are released under an attestation-based key-release policy; the verified scope of that policy is described in the Security Specification.

13.3 Where processing takes place. Documents are read on demand from the Seller's storage. The Security Specification states where each kind of processing takes place. In particular, where the approved model is not a model running inside the Room, the text sent for inference is processed by the model provider named in the Security Specification, in the stated region and under that provider's terms, and Customer Results saved by a Customer to its own storage or downloaded are outside the Service.

13.4 Records BSUM keeps. Closing a Room deletes the Room's database, keys and any recovery copy as described in the Security Specification, and both sides receive a signed destruction receipt. Closing a Room, or any destruction duty in a Transaction NDA, does not require BSUM to destroy: acceptance records and their SHA-256 fingerprints; signature verification data; service-security and content-free incident records; billing data; destruction receipts; and records BSUM is legally required to retain. These records do not contain Transaction Information, and their retention does not mean that BSUM retains any document content.

13.5 Monitoring. The Room monitors its own audit trail for signs of misuse and alerts the administrators of the affected side. BSUM receives only content-free signals (Room identifier, rule, severity and time). Each User can see their own access log, and each side's administrators can see the access logs of Users on their side.

14. AI output

Customer Results are generated by AI models and may be inaccurate or incomplete. They are not legal, financial, investment, regulatory or medical advice. Users must check them against the source materials, and the Customer remains responsible for its decisions. The AI Use Notice applies.

15. Electronic acceptance and evidence

15.1 Before using a Room, each User signs in with a password and an authenticator code, scrolls to the end of each document and confirms acceptance. The parties agree that the recorded electronic acceptance constitutes valid and binding acceptance and may be used as evidence of the agreement and of the identity, authority, time, version and exact text accepted.

15.2 For each acceptance the Room records the authenticated User, the organisation, the time (UTC), the document and version, a SHA-256 fingerprint of the exact text, that the User scrolled to the end, and, where available, the country of the network address, and signs the record with the Room's Ed25519 key. While the Room is open, the User can download a signed acceptance certificate under "My agreements". The Room sends BSUM a content-free copy of each acceptance (e-mail address, organisation, document, version, time and fingerprint), which BSUM keeps as controller for as long as claims under these Terms may be made.

15.3 Approval of a Security Specification by each side is recorded in the same way, together with the fingerprint of the approved configuration.

16. Fees

Fees, if any, and payment terms are set out in the Order. Unless the Order states otherwise, Fees are exclusive of VAT and payable within 14 days of invoice.

17. Term, suspension and termination

17.1 The agreement starts when a User first accepts these Terms for the Customer and continues until the last Room in which the Customer participates is closed, unless terminated earlier.

17.2 BSUM may suspend access immediately, in whole or in part, for a User, a side or a Room, if BSUM reasonably believes that sections 5, 6 or 9, the Room Rules or the AI Use Notice have been breached, that security is at risk, or that the law requires it. BSUM will inform the Customer's administrators of the suspension and its general reason where lawful and safe, and will lift it when the reason no longer applies.

17.3 During a suspension or investigation, BSUM may preserve relevant records that do not contain Transaction Information, such as access logs and signed records.

17.4 Either party may terminate the agreement by written notice if the other materially breaches it and does not remedy the breach within 14 days of notice, or immediately where the breach cannot be remedied. The Customer may stop using the Service at any time.

17.5 Sections 4, 8, 9, 10, 11, 12, 13.4, 15, 18 and 21, and any other provision that by its nature should continue, survive termination.

18. Liability

18.1 The Service is provided "as is" and "as available". To the extent permitted by law, BSUM gives no warranty other than those expressly stated in these Terms, including as to merchantability, fitness for a particular purpose, or the accuracy of AI output or Transaction Information.

18.2 To the extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit, revenue, business, goodwill or anticipated savings, lost or failed transactions, or loss or corruption of data.

18.3 BSUM's total aggregate liability arising out of or in connection with the agreement is limited to the Fees paid by the Customer in the twelve months before the event giving rise to the first claim, and in any case not less than EUR 5,000.

18.4 The limitations in sections 18.2 and 18.3 do not apply to: liability for wilful misconduct or gross negligence; liability that cannot be limited under mandatory law; the Customer's liability for breach of sections 5.3, 8 or 9 or for infringement of BSUM's intellectual property; or the Customer's payment obligations.

18.5 BSUM is not liable for failures caused by events beyond its reasonable control, by the Seller's storage, by a model provider chosen by the Customer under its own account, or by the Customer's own systems.

18.6 Contractual penalty. If the Customer or its User intentionally or through gross negligence breaches section 5.3 (Competitor access) or section 9.2 (Protection of the platform), the Customer shall pay BSUM a contractual penalty of EUR 25,000 for each breach, up to EUR 100,000 in total per Room. The penalty is without prejudice to BSUM's right to claim damages exceeding it, against which any penalty paid will be credited. BSUM does not need to prove its loss to claim the penalty.

18.7 Remedies. Breach of sections 5.3, 8 or 9 may cause BSUM harm that damages cannot adequately remedy. In addition to suspension and damages, BSUM may seek interim and injunctive relief.

19. Changes

BSUM may change these Terms, the Room Rules or the AI Use Notice for legitimate reasons, such as changes in law, security or the Service, by publishing a new version. Users must accept the new version to continue using the Service. Changes do not apply retroactively and do not reduce the protection of Customer Content in a Room already open without that Room's approval. A change to a Room's configuration requires a new approved Security Specification.

20. General

20.1 The agreement is the entire agreement between BSUM and the Customer on the Service and supersedes earlier communications on that subject. It does not affect any Transaction NDA.

20.2 The Customer may not assign the agreement without BSUM's consent. BSUM may use subcontractors and remains responsible for them, subject to Schedule 1.

20.3 If a provision is invalid, the remainder stays in force and the invalid provision is replaced by a valid one that comes closest to its purpose.

20.4 Notices to BSUM go to the contact details published on BSUM's website at www.bsum.fi (at the effective date of these Terms: juhani.lahdenpera@bsum.fi). BSUM keeps the published contact details current; the security and privacy contacts are published in the same place. Notices to the Customer may be given in the Service or to the e-mail address of a Customer administrator.

20.5 These Terms are drawn up in English. Any translation is for convenience only, and the English text prevails.

21. Governing law and disputes

21.1 Finnish law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

21.2 Disputes are settled by the Helsinki District Court as the court of first instance. BSUM may seek interim or injunctive relief in any competent court or jurisdiction.

Schedule 1: Data processing

S1.1 Subject matter and duration. Processing of personal data to provide the Service for the duration of the agreement and until the deletion described in section 13.4.

S1.2 Nature and purpose. Hosting, transmission, display, AI analysis on the approved model, generation of Customer Results, access control, logging and security monitoring, notifications and support.

S1.3 Categories of personal data. Account Data; personal data contained in Customer Content, Transaction Information and Customer Results (for example names, contact details and employment information of persons named in transaction documents). The Customer should avoid making special categories of personal data available unless necessary, and may mark such files as AI-only or restrict them.

S1.4 Data subjects. Users; persons named in Customer Content or Transaction Information.

S1.5 BSUM's obligations as processor. BSUM will: process personal data only on documented instructions, including those given through the Room's settings and approvals, unless required otherwise by law (in which case it will inform the Customer where lawful); ensure that persons authorised to process are bound by confidentiality; implement the measures in section 13 and the Security Specification; assist the Customer, taking into account the nature of the processing and the information available to BSUM, with data subject requests, security, data protection impact assessments and prior consultations; notify the Customer without undue delay after becoming aware of a personal data breach; delete personal data at the end of the processing as described in section 13.4, subject to legal retention; and make available the information necessary to demonstrate compliance and allow audits on reasonable written notice, carried out so as not to endanger the security of any Room.

S1.6 Sub-processors. The Customer authorises the following sub-processors: Microsoft Ireland Operations Limited and its affiliates for Azure confidential computing, Azure Key Vault and Azure Attestation, Azure Communication Services (notification e-mail), and, where approved in the Security Specification, Azure AI Foundry model hosting, in each case in the EU region stated in the Security Specification.Where the Customer pays by card, Stripe Payments Europe, Limited processes the billing data needed for the payment; it does not receive Customer Content. BSUM will give notice of intended changes, and the Customer may object on reasonable data-protection grounds. A model provider used under the Customer's own account is engaged by the Customer, not by BSUM.

S1.7 Transfers. BSUM does not transfer personal data outside the EU/EEA, except where a Customer chooses a model provider or storage outside the EU/EEA under its own account, or where a sub-processor does so under appropriate safeguards notified to the Customer.

S1.8 Technical and organisational measures. As described in section 13 and the Security Specification, including confidential virtual machines with memory encryption, attestation-based key release, strong authentication, role-based access, watermarking, audit logging, content-free monitoring and signed destruction receipts.