Terms and Conditions

Last updated: 20 September 2026. These terms apply when you buy a service from Orchid Labs Ltd (“we”, “us”), company number 17283133, registered office 124 City Road, London, EC1V 2NX. Athena / ATHENA AI Risk is a trading name and product face of Orchid Labs Ltd. The contracting party is always Orchid Labs Ltd.

1. Business customers only

These services are sold only to organisations buying in the course of business. They are not sold to private consumers. By completing checkout you warrant that:

  • you are buying as a business or other organisation, not as a private individual;
  • you have authority to bind that organisation;
  • You warrant that the employee band you select at checkout is true for the organisation on the order;
  • you have read and agree to these terms and the Privacy Notice;
  • you will not upload special-category data or other people’s personal files except as clause 4 allows; and
  • you understand the report covers Athena AI assessed risks as described in clause 2, not every possible risk.

Checkout will not complete unless those confirmations are given. If a warrant is untrue we may suspend the account. If the employee band is found to be wrong and you were charged a lower price than the band that applied, we may invoice the difference or suspend the account until it is paid. We may check the band retrospectively. We do not have to check at the point of delivering the service.

2. What you are buying — and what you are not

2.1 Services

  • One-off assessment: access to our framework assessment, a dashboard view of that run, and a dated report of Athena AI assessed risks and suggested mitigations for the information you submitted. There is limited scope to include out-of-framework risks specific to your business. We also list quick wins against some of the most fundamental items. We do not implement those wins for you unless a separate consultancy scope says so. The outcome in your organisation is yours to make happen.
  • Subscription: ongoing dashboard access, more room for out-of-framework risks, a customer area, a ticket portal available 24/7, booking for up to two sessions per month, preparation notes before booked sessions, a mitigation path for assessed risks, and quick wins against those risks. Again, we do not implement the outcome unless scoped separately.
  • Project consultancy: a scoped piece of work agreed in writing (email is enough) before it starts.
  • Support after purchase via the ticket system on the site. The portal can be used at any hour. We aim to respond during UK business hours.

2.2 Athena AI assessed risks

The dashboard, the Athena AI Risk Index and the report cover the risks our framework treats as fundamental for SMEs, based on what you submitted. They are not a complete list of every AI or operational risk that could affect you. That limit is part of the service, not a defect. Scoring is documented and designed to be as objective as the method allows. What is judgement is labelled as judgement.

2.3 What we are not

We provide an AI risk assessment and framework, reporting and optional advice. We do not sit on the request path of your models or agents. We do not promise to block, detect or prevent a security incident in your systems. We are not your solicitor, insurer, notified body or Data Protection Officer unless a separate written appointment says so. Findings are insight and a mitigation path, not a guarantee that a regulator, customer or court will treat them as sufficient.

3. How the contract is formed

The contract is formed when you give the confirmations in clause 1, agree these terms and the Privacy Notice, and complete payment (or when we accept a scoped consultancy in writing). The order, these terms, the Privacy Notice and any written consultancy scope are the whole contract. Marketing pages and Athena chat do not add promises that are not in those written documents.

4. Your responsibilities

  • Give accurate information. The report is only as good as what you submit.
  • Do not upload special-category data (health, ethnicity, political opinions and similar) or other people’s personal data unless you have a lawful basis and we have agreed in writing that the product will take it. The assessment is designed around your organisation’s AI posture, not employee files. If you paste that material in anyway, you are responsible for it; we may delete it and we do not accept it as part of the service.
  • Keep login details safe. You are responsible for activity under your account.
  • Use the service for lawful business purposes. Do not attempt to extract our unpublished scoring method or workflows beyond what the report itself discloses.

5. Method and intellectual property

We own the framework, scoring approach, workflows, software, dashboards, Athena, documentation and the structure of the report. You own the facts you submitted. You receive a licence to use your report and dashboard for your organisation’s internal governance, tenders and professional advisers. You may not resell the framework, copy the unpublished method, or present our product as your own software.

6. Price and payment

Prices are as shown at checkout or in a written consultancy quote, in GBP, exclusive of VAT unless stated. Payment is taken by Stripe. We do not store full card numbers. Stripe processes the card data; we are responsible for our own systems.

Price depends on the employee band chosen at checkout. You are charged for that band for the whole minimum term.

7. Refunds and cancellation

One-off assessment – Once the assessment is completed and the report is made available to you, the service has been delivered. We refund the fee only if we fail to provide the report or dashboard described in clause 2.1, or if the service is materially not as described in these terms. Asking for a refund within 14 days does not Disliking the findings or the score is not a ground for refund.

If you have bought a one-off assessment and later want a subscription, email billing@athenarisk.co.uk. We may set up a subscription on the terms then in force (including the three-month minimum and the employee band). Any credit or adjustment is at our discretion and will be confirmed in writing before you subscribe. Any credit will be redeemed through us issuing you with a credit code to be presented at checkout. A one-off purchase does not include subscription access and does not shorten the minimum term.

Subscription – The minimum term is three months from the first date of payment. You may cancel by giving written notice within the customer support portal, or by emailing policy. Notice cannot end the subscription before the minimum term is finished. Fees for the month/time already started, or where they are inside the minimum term, are not refunded unless we are in a material breach, and where we have not remedied it within 21 days of written notice. A one-off purchase is a separate product; buying one month of subscription is not a route to the one-off assessment at the monthly price. These are separate products.

If you submitted the wrong organisation identity before the report is issued, tell us within 14 days. We may, as a goodwill gesture and not as a right, re-run that assessment once. That is not a refund.

Subscription. You may cancel at the end of the current paid period via the customer area or by email to policy@athenarisk.co.uk. Fees already paid for a period that has started are not refunded unless we are in material breach and have not remedied it within 14 days of written notice.

Consultancy. Cancellation is as set out in that scope. Work already done is payable.

8. Data protection

Orchid Labs Ltd is the controller of account, billing, support and assessment-account data. How we use personal data is set out in the Privacy Notice. Those two documents tell the same story.

We do not use the content you enter in an assessment, report or dashboard to train our models or any third-party model. Assessment content is processed on our systems and on the processors named in the Privacy Notice (including payment, hosting, forms, dashboard display, ticketing and booking). Those processors receive only what they need to deliver the service.

You remain controller of personal data you type into the assessment about your own people. You must have a right to provide it.

9. Availability and support

We aim for the service to be available during UK business hours but we do not warrant uninterrupted access. The ticket portal can be used at any hour. We aim to respond during UK business hours.

10. Force majeure

We are not in breach if we cannot perform because of an event beyond our reasonable control (including failure of a hosting or payment provider we do not control, widespread infrastructure outage, fire, flood, epidemic, industrial action, or change in law). We will tell you promptly and resume as soon as practical. If the event lasts more than 30 days, either of us may cancel the unused part of a subscription and we will refund prepaid fees for time after the cancellation date. Force majeure does not cover a defect in our own software that we could reasonably have prevented.

11. Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, fraud, or any liability the law does not allow us to limit.

Subject to that, our total liability arising out of a contract is limited to the fees you paid us for the service giving rise to the claim in the 12 months before the claim. We are not liable for loss of profit, indirect or consequential loss, or loss that comes from information you omitted, misstated or should not have uploaded.

Advice in a consultancy session is given in good faith on the facts then available. It does not replace regulated legal, tax or cyber-security advice from a firm you appoint.

12. Insurance

We maintain business and professional indemnity insurance appropriate to a firm of our size. Details of cover current at the date of an order are available on written request. We communicate with our insurer electronically via email and by accessing their system.

13. Changes

We may update these terms. The version that applies to a purchase is the version you agreed at checkout. Material changes to a live subscription will be notified by email; if you do not accept them you may cancel at the period end.

14. Law

These terms are governed by the law of England and Wales. Courts of England and Wales have exclusive jurisdiction, except that we may pursue unpaid fees in your home courts.

15. Contact

policy@athenarisk.co.uk. Telephone 020 8040 3032. Registered office Orchid Labs Ltd, 124 City road, London, EC1 2NX .