Terms of Service

1. Definitions and Interpretation

In these Terms of Service (“Terms”), the following definitions apply:

• “Brocade”, “we”, “us”, or “our” means Brocade Tech Ltd, a company registered in England and Wales (company number 17559908), whose registered office is at Apartment 45 Mill Stream House, Norfolk Street, Oxford OX1 1EB, and registered with the Information Commissioner's Office (registration number ZC292325).
• “Service” means the Brocade web application, including all features, APIs, and associated documentation made available at brocade.app.
• “Customer”, “you”, or “your” means the organisation or individual entering into these Terms, typically the Accountable Person, Principal Accountable Person, or building management company responsible for a higher-risk building.
• “Authorised User” means any person you authorise to access the Service under your account, including organisation administrators, building managers, and named staff.
• “Customer Data” means all data submitted to, stored in, or generated through the Service by you or your Authorised Users, including Golden Thread Data.
• “Golden Thread Data” means the digital record of building safety information that the Accountable Person is required to create and maintain under the Building Safety Act 2022 and the Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023.
• “Confidential Information” means any information disclosed by one party to the other that is marked as confidential, or that a reasonable person would consider confidential given its nature or the circumstances of disclosure.
• “Subscription Term” means the period for which you have subscribed to the Service, whether monthly or annual, as set out in your subscription confirmation.
• “Resident” means a leaseholder, tenant, or other occupant who accesses the resident portal under your account. Residents are governed by separate Resident Terms of Use.
• “Contractor” means a third-party service provider who accesses the Service via magic-link or token-authenticated access to submit updates, evidence, or invoices.

2. Service Description and Compliance Disclaimer

Brocade is a software-as-a-service (SaaS) platform designed to help building managers and Accountable Persons organise, track, and evidence their compliance obligations under the Building Safety Act 2022. The Service provides tools for managing fire risk assessment actions, safety cases, mandatory occurrence reporting, resident engagement, financial transparency, document storage, and audit trails.

The Service is not a substitute for professional fire risk assessments, qualified building safety advice, or legal counsel.

3. Account Registration and Access

To use the Service, you must register an account and provide accurate, complete information. You are responsible for:

• Maintaining the confidentiality of your login credentials and ensuring that your password is not shared with unauthorised persons.
• All activity that occurs under your account, whether or not you authorised it.
• Determining which Authorised Users should have access to your account and at what permission level (organisation administrator, building manager, or read-only).
• Promptly notifying us if you become aware of any unauthorised use of your account.

Multi-Tier Access

The Service supports multiple access tiers:

• Organisation Administrators — full management access across all buildings in your organisation.
• Building Managers — access scoped to specific buildings as assigned by an administrator.
• Residents — access to building safety information, service charge statements, and issue reporting via a building-specific portal URL, governed by separate Resident Terms of Use.
• Contractors — limited access via time-limited magic links to submit updates, evidence, or invoices for specific tasks.

You are responsible for ensuring that each person granted access to the Service under your account is appropriately authorised and that their access level is suitable for their role.

4. Trial Period

We may offer a free trial of the Service. During the trial period:

• The duration of your trial is set at the time of signup and displayed in your account.
• No payment is required during the trial period. We will not charge you unless you actively add a valid payment method and choose to subscribe.
• Your trial will not automatically convert to a paid subscription without your explicit action. If you do not subscribe before the trial expires, your access to the Service will be suspended.
• We keep your data after the trial ends, and you may reactivate your account by subscribing. We may delete your data at any time from 12 months after the trial ends. If you ask us in writing, we will delete it, including copies and audit log entries, within 30 days of your request. We keep it longer only where the law requires us to.
• All features available during the trial are subject to change before general availability.

If you convert to a paid subscription, the data you entered during the trial will carry over to your subscription.

5. Subscription, Fees and Payment

Subscription Plans

The Service is available on a monthly or annual subscription basis. Your subscription fee, billing cycle, and plan details are set out in your subscription confirmation.

Auto-Renewal

Unless you cancel before the end of your current Subscription Term, your subscription will automatically renew for a further period of the same length. We will send you a renewal reminder at least 5 working days before the last date on which you can cancel to avoid renewal. For annual subscriptions, we will also send a reminder at the 6-month point.

You may cancel your subscription at any time by contacting us. Cancellation takes effect at the end of the current Subscription Term.

Price Changes

We may change our subscription fees from time to time. We will give you at least 30 days' written notice of any price increase. Price changes take effect at the start of your next Subscription Term. If you do not agree to a price change, you may cancel your subscription before the change takes effect.

Late Payment

If any amount owed to us is overdue, we may charge interest on the outstanding amount at the rate prescribed by the Late Payment of Commercial Debts (Interest) Act 1998. We may also suspend your access to the Service if payment remains overdue for more than 14 days, after giving you reasonable written notice.

6. Customer Obligations

You agree to:

• Data accuracy — ensure that all information you enter into the Service is accurate, complete, and kept up to date. The Service relies on the accuracy of your input to produce meaningful reports and audit trails.
• Legal compliance — comply with all applicable laws and regulations, including the Building Safety Act 2022, the Regulatory Reform (Fire Safety) Order 2005, and any guidance issued by the Building Safety Regulator.
• Lawful use — use the Service only for lawful purposes and in accordance with these Terms.
• Backups — maintain your own copies of critical compliance records. While we perform daily backups of your data, you should not rely on the Service as your sole record of Golden Thread information.
• Security reporting — notify us promptly if you become aware of any security incident, data breach, or vulnerability affecting your account or the Service.

7. Acceptable Use

You must not:

• Attempt to reverse engineer, decompile, disassemble, or otherwise derive the source code of the Service.
• Use automated tools, scripts, or bots to access the Service in a manner that exceeds reasonable usage or impairs the Service for other users.
• Upload or store any content that is unlawful, defamatory, infringing, or otherwise objectionable.
• Attempt to access data belonging to other customers or buildings outside your authorised scope.
• Circumvent or interfere with any security features of the Service, including rate limiting on API endpoints.
• Sub-licence, resell, or otherwise make the Service available to third parties except as expressly permitted (for example, granting Resident or Contractor access under your account).

We reserve the right to suspend or terminate your access if we reasonably believe you are in breach of this section, after giving you written notice where practicable.

8. Data Protection and Processing

This section sets out the data processing terms required by Article 28 of the UK General Data Protection Regulation (UK GDPR) and forms part of these Terms. A signed version of these terms is available on request: [email protected].

Roles

For Customer Data processed through the Service, you are the Data Controller and Brocade is the Data Processor. You determine what personal data is stored and for what purpose. We process that data solely on your documented instructions.

For data collected through the Brocade marketing website (lead capture forms, newsletter subscriptions, resource downloads), and for Authorised Users' own account and usage data (sign-in, product analytics, error tracking, trial emails), Brocade acts as Data Controller. That processing is covered by our Privacy Policy.

Subject Matter and Purpose

We process Customer Data for the purpose of providing the Service, including storing building safety records, generating compliance reports, facilitating audit trails, managing financial records, and delivering notifications. Processing continues for the duration of your Subscription Term and any post-termination retention period.

Types of Personal Data

• Resident and leaseholder details (names, contact details, unit, lease and ownership details)
• Financial records (service charges, demands, payments and arrears)
• Compliance records that name people (fire risk assessment actions, checks, safety case and mandatory occurrence records)
• Contractor details (names, contact details, insurance and certifications)
• Records of communications sent through the Service
• Authorised User details (names, email addresses, role assignments)
• Special category data: health information in personal emergency evacuation plans (PEEPs), and related emergency contact details, where you choose to record it

Categories of Data Subjects

• Residents and leaseholders, including their household members and emergency contacts named in PEEPs
• Directors, officers and members of your organisation
• Building managers, your staff and other Authorised Users
• Contractors, consultants and service providers, and their staff

Your Responsibilities

You are responsible for:

• having a lawful basis for the processing. For special category data, including the health information in PEEPs, you must also have a condition under Article 9 of the UK GDPR and, where needed, Schedule 1 of the Data Protection Act 2018;
• giving data subjects (residents, leaseholders, contractors and their contacts) the information Articles 13 and 14 of the UK GDPR require;
• the accuracy of the Customer Data you enter; and
• making sure your instructions to us comply with data protection law.

Processor Obligations

Brocade shall:

• Process Customer Data only on your documented instructions, including for transfers outside the United Kingdom. These Terms and your use of the Service's features are those instructions. If the law requires us to process Customer Data in any other way, we will tell you before doing so, unless the law forbids that.
• Tell you immediately if we believe an instruction infringes data protection law.
• Ensure that persons authorised to process Customer Data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational security measures, including encryption in transit and at rest, and role-based access controls.
• Not engage any sub-processor without your prior notification and the opportunity to object (see Sub-Processors below).
• Assist you, insofar as reasonably possible, in fulfilling your obligations to respond to data subject access requests and other rights under UK GDPR. If we receive a request directly, we pass it to you without undue delay and do not respond ourselves unless you instruct us to.
• Help you, taking into account the nature of the processing and the information available to us, meet your obligations under Articles 32 to 36 of the UK GDPR: security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner.
• Keep the record of processing activities that Article 30(2) of the UK GDPR requires.
• Notify you without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as we then know, the nature of the breach, the categories and approximate numbers of people and records concerned, the likely consequences and the measures taken or proposed. We will take reasonable steps to contain the breach and will help you notify the Information Commissioner and data subjects where you must.
• At your choice, delete or return Customer Data when the Service ends, as set out in Section 9, and confirm deletion in writing on request.
• Make available to you all information necessary to demonstrate compliance with these data processing obligations and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you. You will give at least 30 days' notice, unless a personal data breach or the Information Commissioner requires sooner. Audits take place during business hours, no more than once a year except after a breach, and the auditor must be bound by confidentiality. Each party bears its own costs.

Erasure

You can delete residents, leaseholders, contractors and PEEPs in the Service, and the deletion is permanent. Some compliance records (for example issues, fire risk assessment actions, checks and documents) are archived when deleted, so the record of the compliance work survives, and the audit trail keeps a history of changes. Where a data subject's erasure request needs personal data removed from archived records or the audit trail, we will do it within 30 days of your written instruction. Where we can, we keep the record of the compliance work with the personal data removed.

Sub-Processors

You give us general written authorisation to engage sub-processors. We use the following sub-processors to deliver the Service:

• Supabase, Inc.: database, file storage and authentication. Data is held in London, United Kingdom; Supabase is a US company, and its support staff may access data from the United States.
• Railway Corporation: application hosting, in the Netherlands (European Union).
• Resend, Inc.: sending email (notifications, reminders and sign-in links), in the United States.
• Functional Software, Inc. (Sentry): error tracking, in Germany (European Union).
• PostHog, Inc.: product analytics and session replay, in the European Union. On the marketing website, PostHog sets no cookies and keeps a random anonymous ID in session storage for the current tab only. When you follow a sign-up link, that ID is passed to the application so your website visits can be linked to the account you create. Within the application, PostHog uses a cookie and local storage to track usage patterns for logged-in users to improve the Service, and records sessions on manager pages with typed input masked. Session replays can show Customer Data that is on screen, and are not recorded in the resident portal.

We will give you at least 14 days' written notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may end your subscription without penalty.

We bind each sub-processor, by written contract, to data protection obligations that give at least the same protection as these Terms, in particular sufficient guarantees of appropriate technical and organisational measures. We remain fully liable to you for each sub-processor's performance of those obligations.

International Transfers

We, or a sub-processor, transfer Customer Data outside the United Kingdom only where the transfer meets the requirements of Chapter V of the UK GDPR. That means either UK adequacy regulations cover the destination, or appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Railway, Sentry and PostHog process Customer Data in the European Union, which UK adequacy regulations cover. For Resend, and for any support access to Supabase from the United States, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Golden Thread Data and Portability

We recognise that your Golden Thread Data is critical to your compliance with the Building Safety Act 2022 and the Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023. Failure to maintain an adequate Golden Thread can result in serious consequences, including criminal prosecution.

Brocade must not be a single point of failure for your Golden Thread. To that end, we commit to the following:

• Data export at any time — you may export your Customer Data during your Subscription Term through the platform's built-in export functionality. Exports are available per domain (issues, checks, budgets, service charges, documents, units) in CSV and PDF formats. Document files may be exported individually or in bulk as a ZIP archive.
• Post-termination access — for 90 days after your subscription ends (for any reason), you can sign in read-only and export your Customer Data. At your choice, we will then delete your Customer Data or return it. We will delete it, including copies and audit log entries, within 30 days of your written request. If you make no request, we may delete it at any time from 12 months after your subscription ends. We keep Customer Data beyond this only where the law requires us to, and it stays confidential and secure while we do. We will confirm deletion in writing on request.
• Service discontinuation notice — if we intend to discontinue the Service, we will provide you with at least 6 months' written notice and ensure that data export facilities remain available throughout that notice period.
• Migration cooperation — on request, we will provide reasonable assistance with the migration of your data to a successor platform, including making data available in standard formats and providing documentation of our data schema.

Audit Log Retention

We keep a checksum-chained audit trail of changes to compliance records, so tampering can be detected. Some compliance records are archived rather than removed when you delete them (see Erasure in Section 8). Archived records and audit log entries are part of your Customer Data. They are deleted with the rest of it as set out above, and on your written instruction we remove a data subject's personal data from them within 30 days.

10. Intellectual Property

Our IP: All intellectual property rights in the Service (including its software, design, documentation, and branding) belong to Brocade. These Terms do not grant you any rights in the Service other than the limited right to use it in accordance with these Terms during your Subscription Term.

Your IP: All intellectual property rights in Customer Data remain yours. You grant us a limited, non-exclusive licence to process your Customer Data solely for the purpose of providing the Service.

We will not use Customer Data for data mining, machine learning model training, aggregated analytics products, or any purpose other than providing the Service, without your explicit prior written consent.

11. Confidentiality

Each party agrees to keep the other party's Confidential Information confidential and not to disclose it to any third party without prior written consent, except:

• To employees, contractors, or advisers who need to know and are bound by equivalent confidentiality obligations.
• Where disclosure is required by law, regulation, or court order, including requests from the Building Safety Regulator.
• Where the information was already publicly available through no fault of the receiving party.

Confidentiality obligations survive termination of these Terms for a period of 3 years, or indefinitely in the case of personal data subject to UK GDPR.

12. Service Levels and Availability

We target 99.5% availability of the Service, measured monthly, excluding scheduled maintenance windows.

• Scheduled maintenance — we will give reasonable advance notice (typically 24 hours) of planned maintenance that may affect availability. Where possible, maintenance will be scheduled outside UK business hours.
• Incident notification — in the event of an unplanned outage or significant degradation, we will notify affected customers as soon as reasonably practicable and provide updates until the issue is resolved.
• Backups — we perform daily backups of all Customer Data. Backups are encrypted and stored separately from the primary database.

The 99.5% availability target is a commitment to good practice, not a guaranteed service level agreement. We do not currently offer service credits for downtime. This may change as the Service matures.

13. Liability and Indemnification

Limitation of Liability

Subject to the exclusions below, our total aggregate liability to you under or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed 100% of the fees paid by you in the 12 months preceding the event giving rise to the claim.

Exclusion of Indirect Losses

Neither party shall be liable to the other for any indirect, consequential, special, or incidental losses, including loss of profit, loss of business, loss of reputation, or loss of data (except as specifically provided in Section 9), whether or not such losses were foreseeable.

Compliance Disclaimer

Without limiting the generality of the above, Brocade shall have no liability for:

• Your failure to input accurate or complete data into the Service.
• Your failure to act on information, alerts, or reports generated by the Service.
• Regulatory penalties, fines, or enforcement action arising from your non-compliance, regardless of whether you were using the Service at the relevant time.
• The acts, omissions, or performance of any third-party contractor or service provider engaged by you.

Mutual Indemnification

Each party shall indemnify the other against losses arising from: (a) infringement of a third party's intellectual property rights caused by the indemnifying party; and (b) breach of the data protection obligations set out in Section 8.

Non-Excludable Liability

Nothing in these Terms excludes or limits liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any other liability that cannot be excluded or limited by law. Where the Consumer Rights Act 2015 applies (for example, to Resident access), additional protections may apply and this section shall be read subject to that Act.

14. Termination

Termination for Convenience

Either party may terminate these Terms by giving 30 days' written notice to the other party. Your subscription will end at the conclusion of the current Subscription Term following your notice.

Termination for Breach

Either party may terminate these Terms immediately by written notice if the other party commits a material breach and fails to remedy that breach within 30 days of receiving written notice specifying the breach.

Termination on Insolvency

Either party may terminate these Terms immediately if the other party becomes insolvent, enters administration, liquidation, or any analogous process.

Effects of Termination

• Your access to the Service will cease at the end of the notice period or current Subscription Term, as applicable.
• Your data will remain accessible in read-only mode for 90 days following termination, during which you may export your data (see Section 9).
• We then delete or return your Customer Data as set out in Section 9.
• Any fees already paid are non-refundable, except where we terminate for our convenience or where required by law.

Surviving Clauses

The following sections survive termination: Section 8 (Data Protection), Section 9 (Golden Thread Data), Section 10 (Intellectual Property), Section 11 (Confidentiality), Section 13 (Liability), and this Section 14.

15. Force Majeure

Neither party shall be liable for any delay or failure to perform its obligations under these Terms (other than payment obligations) where such delay or failure results from events beyond its reasonable control, including natural disasters, war, terrorism, pandemic, government action, or widespread internet or utility failures.

For the avoidance of doubt, failures or outages of Brocade's sub-processors (as listed in Section 8) do not constitute force majeure events. The management of sub-processor relationships is Brocade's responsibility.

16. General Provisions

Governing Law

These Terms are governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction over any dispute arising under or in connection with these Terms.

Entire Agreement

These Terms, together with your subscription confirmation and any documents expressly referred to herein, constitute the entire agreement between the parties. They supersede all previous agreements, understandings, and arrangements between the parties, whether written or oral.

Severability

If any provision of these Terms is found by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid and enforceable. If it cannot be so modified, it shall be deemed deleted. The validity and enforceability of the remaining provisions shall not be affected.

No Waiver

A failure or delay by either party in exercising any right or remedy under these Terms shall not constitute a waiver of that right or remedy.

Assignment

You may not assign or transfer your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations under these Terms to a successor entity in connection with a merger, acquisition, or sale of substantially all of our assets, provided we give you written notice.

Notices

Notices under these Terms may be given by email to the address associated with your account (for notices to you) or to [email protected] (for notices to us). Notices are deemed received on the next business day after sending.

Third Party Rights

No person other than a party to these Terms shall have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any provision of these Terms.

Contact

For questions about these Terms, please contact us at: [email protected]