Terms of Service

1. Use of IntegrityFile.org

IntegrityFile.org provides structured public-source due diligence reports for organizations and associated key individuals. Reports are intended to support partner, vendor, grantee, subcontractor, procurement, grant, and monitoring workflows.

Reports may help users identify, organize, review, and document public-source information relevant to due diligence. Reports are not legal advice, investigation findings, sanctions determinations, eligibility decisions, exclusion decisions, or recommendations to approve or reject any organization or individual.

Users remain responsible for final decisions, approvals, escalations, partner engagement, vendor review, follow-up questions, documentation, and compliance with their own policies and applicable law.

2. Complementary role

IntegrityFile.org is designed to complement existing systems and controls. It does not replace:

• sanctions screening
• anti-money laundering checks
• counter-terrorism financing checks
• vendor eligibility checks
• procurement approval
• legal review
• safeguarding investigation
• audit or assurance review
• management decision-making
• donor-required approval processes
• any required internal clearance or escalation process

The service supports the open-source and adverse-media due diligence step by creating a structured record of public-source risk signals, reviewed findings, dismissed false positives, source links, and user notes.

3. Authorized users and accounts

Customers are responsible for ensuring that only authorized personnel access their workspace. Users must keep login credentials secure and must not share accounts.

Customers are responsible for managing user roles, access rights, exports, internal sharing, and retention of reports within their organization.

IntegrityFile.org may suspend access where there is suspected misuse, security risk, unlawful use, non-payment, or breach of these terms.

4. Permitted use

Users may use IntegrityFile.org only for legitimate organizational due diligence, monitoring, procurement, grant, compliance, audit, risk management, or partner-review purposes.

Permitted use includes review of:

• implementing partners
• local NGOs and CSOs
• vendors and suppliers
• grantees
• subcontractors
• consortium members
• downstream partners
• directors, officers, board members, signatories, owners, senior managers, and other relevant associated individuals

Users must have a legitimate due diligence purpose before submitting information about individuals.

5. User responsibilities

Users are responsible for:

• entering accurate names, countries, identifiers, and context
• limiting searches to relevant organizations and individuals
• reviewing findings before relying on them
• documenting false positives
• considering source reliability, date, context, and severity
• giving partners or vendors an opportunity to clarify findings where policy permits
• following their organization's policies and applicable law
• ensuring that reports are not used for unlawful discrimination, harassment, retaliation, political targeting, or public shaming

6. Report limitations

IntegrityFile.org reports are based on available public-source information, user-submitted information, third-party search infrastructure, and automated or human-assisted classification.

Public-source information may be incomplete, outdated, mistranslated, inaccurate, duplicated, or unavailable in some countries or languages. A missing finding does not mean that no issue exists. A finding does not mean that the allegation is true or that the organization or individual is unsuitable.

Source availability varies by country, language, entity type, and public-record environment.

7. Human review required

Reports are signals, not conclusions. Users must not make automatic adverse decisions solely on the basis of an IntegrityFile.org report.

Before taking action, users should assess:

• identity match
• source reliability
• publication date
• country and language context
• seriousness of the issue
• whether the source is official, media, third-party, or user-submitted
• whether the finding relates to the same organization or person
• whether the matter has been resolved, disproven, appealed, or explained
• whether escalation, clarification, or legal review is required

8. Associated individuals

Where reports include individuals, searches should be limited to persons relevant to the due diligence purpose, such as directors, officers, signatories, owners, senior managers, board members, key project personnel, procurement contacts, finance officials, or other associated persons relevant to the review.

Users must not submit names for personal curiosity, stalking, harassment, political targeting, or unrelated background checks.

9. Source references and public information

Reports may include source links, publication dates, short summaries, public records, official registry references, adverse-media references, organization websites, donor or audit references, regulator records, court records where available, and other public-source material.

IntegrityFile.org does not guarantee that third-party links will remain available or unchanged. Users should retain reports and evidence according to their own file-retention requirements.

10. AI-assisted features

IntegrityFile.org may use AI-assisted tools to summarize sources, classify findings, identify possible risk categories, detect aliases or former names, suggest follow-up questions, and organize report sections.

AI-assisted outputs may contain errors and must be reviewed by users. AI-assisted classifications are not findings of fact, legal conclusions, or eligibility decisions.

11. Customer content and reports

Customers retain responsibility for the information they submit, upload, annotate, export, or share through the service.

IntegrityFile.org may process customer-submitted data to provide the service, generate reports, maintain audit logs, support monitoring features, provide customer support, improve reliability, and meet legal or security obligations.

12. Confidentiality

IntegrityFile.org will use reasonable measures to protect non-public customer workspace data and reports. Customers are responsible for controlling who within their organization can access, export, download, or share reports.

Exports should be treated as sensitive due diligence records.

13. Intellectual property

IntegrityFile.org and its templates, workflow design, report structure, software, interface, classifications, and documentation are owned by IntegrityFile.org or its licensors.

Customers may use generated reports for their internal due diligence, compliance, procurement, grant, audit, and partner-review files, subject to these terms.

14. Fees and subscriptions

If paid plans are offered, pricing, billing period, report limits, monitoring limits, user limits, and cancellation terms will be described at checkout or in an order form.

Fees are non-refundable unless required by law or stated in the applicable order form.

15. Service changes

IntegrityFile.org may update features, report formats, source coverage, search logic, risk categories, AI-assisted functions, pricing, subprocessors, or these terms as the service develops.

Material changes will be posted in the Legal Center or notified to customers where required.

16. No warranties

IntegrityFile.org is provided on an "as is" and "as available" basis. IntegrityFile.org does not warrant that reports will identify every relevant issue, that all public sources are complete or accurate, that links will remain available, or that a report is sufficient for any specific donor, regulator, court, procurement, or internal policy requirement.

17. Limitation of liability

To the maximum extent permitted by law, IntegrityFile.org is not liable for decisions made by customers, actions taken against partners or vendors, missed findings, false positives, third-party source errors, public-source inaccuracies, loss of data caused by customer actions, or unauthorized sharing of exports by customer users.

Any liability cap should be set out in the applicable order form or subscription agreement.

18. Indemnity

Customers agree to use IntegrityFile.org lawfully and responsibly. Customers are responsible for claims arising from misuse of the service, unlawful submissions, unauthorized searches, discriminatory use, public accusations, or actions taken without human review and required internal approval.

19. Governing law

These terms are governed by the laws of the jurisdiction specified in the applicable order form or customer agreement, unless otherwise required by applicable law or agreed in a separate written agreement.

20. Contact

Questions about these terms may be sent to: legal@integrityfile.org.

Privacy Notice

1. Overview

IntegrityFile.org processes personal data to provide structured public-source due diligence reports for legitimate organizational review purposes.

This privacy notice explains what data we process, why we process it, how we use it, who we share it with, how long we retain it, and what rights may apply.

2. Who we are

IntegrityFile.org is operated by Alfa SUS (France).

Contact: legal@integrityfile.org Privacy contact: privacy@integrityfile.org Postal address: 88 avenue de France, Nice, 06000, France

3. Personal data we process

IntegrityFile.org may process the following categories of personal data:

Account and user data

• name
• work email address
• organization
• role or job title
• login and authentication information
• workspace membership
• usage logs
• support communications

Customer-submitted due diligence data

• organization names
• registration numbers
• countries
• websites
• aliases and former names
• names of associated individuals
• job titles or roles
• country or region information
• user notes
• review decisions
• uploaded files or source links, if enabled

Generated report data

• public-source references
• source links
• publication dates
• source summaries
• risk categories
• relevance indicators
• false-positive notes
• suggested follow-up questions
• reviewer notes
• monitoring status
• report metadata
• audit logs

Technical and security data

• IP address
• device and browser information
• session logs
• access logs
• security events
• cookie identifiers
• product usage events

4. Sources of personal data

We may receive personal data from:

• customer users
• organization uploads
• public websites
• official registries
• company and charity registers
• regulator records
• court or legal records where publicly available
• donor, audit, or inspector-general publications
• news and media sources
• publicly available organization documents
• third-party search or AI infrastructure used to generate reports

5. Purposes of processing

We process personal data to:

• create and manage user accounts
• generate due diligence reports
• identify public-source risk signals
• summarize and categorize public-source findings
• document search terms, sources, and review decisions
• allow users to export reports
• support monitoring and re-checking features
• maintain audit logs
• provide customer support
• improve product reliability and security
• prevent misuse
• comply with legal, contractual, and security obligations

6. Lawful basis

Where GDPR, UK GDPR, or similar laws apply, the lawful basis may depend on the processing activity and the customer's use case.

Possible lawful bases may include:

• performance of a contract for account administration and service delivery
• legitimate interests for organizational due diligence, fraud prevention, compliance, procurement, grant management, partner review, security, and service improvement
• legal obligation where processing is required to comply with applicable law
• consent where required for optional cookies or certain optional communications

Customers are responsible for identifying their own lawful basis for submitting individuals for due diligence review.

7. Legitimate interests

Where legitimate interests are relied upon, those interests may include:

• responsible partner and vendor due diligence
• fraud, corruption, safeguarding, procurement, and reputational risk management
• protection of donor, grant, procurement, and public-interest resources
• documentation of public-source review steps
• security, abuse prevention, and service reliability

Processing should be proportionate, limited to relevant individuals, and subject to human review.

8. Sensitive data

IntegrityFile.org is not designed for users to upload unnecessary sensitive personal data.

Public-source findings may sometimes include sensitive or high-risk information, such as allegations related to criminal proceedings, political exposure, safeguarding, sanctions exposure, human rights issues, or other reputational matters.

Users should submit only the data necessary for the due diligence purpose and should avoid uploading sensitive data unless legally permitted, necessary, and authorized under their organization's policies.

9. Children's data

IntegrityFile.org is not intended for searching or processing children's data. Users must not submit children's personal data unless legally required, specifically authorized by customer policy, and supported by an appropriate lawful basis.

10. How reports present personal data

Individual findings are presented with public-source references, dates, summaries, and review context where available. Reports should be used as review materials, not as automatic conclusions.

Users should assess relevance, identity match, accuracy, source reliability, severity, and context before taking action.

11. Sharing and disclosure

We may share personal data with:

• authorized users within the customer workspace
• service providers and subprocessors supporting hosting, storage, authentication, email delivery, monitoring, analytics, AI/search infrastructure, and security
• professional advisers where necessary
• authorities where legally required
• successor entities in connection with a merger, acquisition, restructuring, or asset sale

We do not sell personal data.

12. International transfers

Where personal data is transferred internationally, IntegrityFile.org will use appropriate transfer mechanisms where required, such as standard contractual clauses, adequacy decisions, contractual safeguards, or other lawful transfer mechanisms.

Specific transfer mechanisms may depend on the customer location, service providers selected, and applicable law.

13. Retention

Report retention should reflect customer grant, procurement, legal, audit, monitoring, and file-retention requirements.

IntegrityFile.org may retain:

• account data while the account remains active
• reports according to customer configuration or subscription terms
• audit logs for security and accountability purposes
• backups for a limited period
• billing and legal records as required by law

Customers may request deletion or export subject to legal, security, audit, contractual, and backup limitations.

14. Security

IntegrityFile.org uses administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encryption in transit, encryption at rest where supported, audit logging, backups, restricted administrative access, and incident response processes.

No service can guarantee absolute security.

15. Individual rights

Depending on applicable law, individuals may have rights to:

• access personal data
• correct inaccurate data
• request deletion
• object to processing
• restrict processing
• request portability
• challenge automated decisions
• complain to a supervisory authority

Where IntegrityFile.org acts as processor for a customer, requests may need to be directed to the customer organization. IntegrityFile.org will assist customers with rights requests as required by the applicable agreement and law.

16. Automated decision-making

IntegrityFile.org does not make final eligibility, approval, rejection, exclusion, or adverse decisions about organizations or individuals.

Reports provide public-source signals for human review. Customers must ensure that any decision with legal, contractual, employment, funding, procurement, or similarly significant effects is made through appropriate human review and required internal approvals.

17. Cookies

IntegrityFile.org may use essential cookies for authentication, session security, load balancing, and preferences. Optional analytics or product-improvement cookies are used only where enabled and disclosed through an appropriate consent or preference mechanism where required.

18. Changes to this privacy notice

We may update this privacy notice as the service develops, legal requirements change, or subprocessors are added. The latest version will be posted in the Legal Center.

19. Contact

Privacy questions may be sent to: privacy@integrityfile.org.

Data Protection Overview

Due diligence with proportionality and controls

IntegrityFile.org is designed for documented public-source due diligence in organizational contexts. The service should be used proportionately and only where there is a legitimate due diligence purpose.

Core principles

Purpose limitation

Reports should be generated only for legitimate partner, vendor, procurement, grant, monitoring, audit, compliance, or risk-management purposes.

Data minimization

Users should submit only the information needed for the review, such as name, organization, country, role, website, registration number, or other relevant identifiers.

Accuracy and context

Findings are treated as signals requiring confirmation, context, and human review. Users should consider whether a source relates to the same organization or person, whether it is current, and whether the source is reliable.

Human review

Reports do not make automatic decisions. Users must review findings before taking action.

Source transparency

Reports should show source links, dates, summaries, risk categories, and review notes where available.

Retention control

Reports should be retained according to the customer's grant, procurement, legal, donor, audit, and monitoring requirements.

Access control

Reports should be available only to authorized users with a need to know.

Accountability

Customers should document who reviewed the report, what findings were considered, what false positives were dismissed, and what follow-up was required.

Appropriate individuals to review

Individual searches should generally be limited to people relevant to the organization's due diligence purpose, such as:

• directors
• officers
• board members
• trustees
• owners or beneficial owners
• signatories
• senior managers
• finance officials
• procurement officials
• key project personnel
• authorized representatives
• subcontractor or consortium leads

Higher-risk categories

Some findings require special care, including:

• safeguarding and PSEA allegations
• criminal allegations
• sanctions exposure
• terrorism-financing concerns
• political affiliation
• human rights allegations
• donor or investigation findings
• allegations involving vulnerable persons

Such findings should be reviewed carefully, escalated where required, and not treated as automatic conclusions.

Data subject requests

Requests from individuals should be assessed according to applicable law and the customer's policies. Where IntegrityFile.org acts as processor, the customer normally determines the response.

Recommended customer controls

Customers should maintain:

• an internal due diligence purpose statement
• a list of authorized users
• access controls for reports
• report-retention rules
• escalation rules for high-risk findings
• a false-positive documentation process
• a process for partner/vendor clarification where policy permits
• a human-review step before decisions

Data Processing Addendum

1. Purpose

This Data Processing Addendum explains the typical controller and processor roles for IntegrityFile.org. A signed customer DPA or order form may supplement or replace this page for enterprise customers.

2. Roles

For customer-submitted due diligence data, the customer typically acts as controller and IntegrityFile.org acts as processor.

For account administration, product telemetry, billing, security, abuse prevention, and general service operation, IntegrityFile.org may act as an independent controller.

Roles may vary depending on the customer relationship, jurisdiction, configuration, and agreement.

3. Processing subject matter

The processing subject matter is the generation, storage, display, export, monitoring, and management of public-source due diligence reports.

4. Processing duration

Processing continues for the duration of the customer's account, subscription, report-retention period, or as otherwise required by law, contract, security, audit, or backup obligations.

5. Processing purposes

IntegrityFile.org processes personal data to:

• create reports
• manage workspaces
• display and export findings
• maintain audit logs
• support monitoring
• provide customer support
• maintain security
• prevent misuse
• comply with legal and contractual obligations

6. Categories of personal data

Data categories may include:

• organization names
• registration numbers
• websites
• country information
• official names
• job titles and roles
• aliases and former names
• user notes
• source links
• source summaries
• report metadata
• account details
• audit logs
• technical logs

7. Categories of data subjects

Data subjects may include:

• customer users
• partner or vendor officials
• directors
• officers
• signatories
• owners or beneficial owners
• board members or trustees
• key project personnel
• subcontractor representatives
• public officials or politically exposed persons referenced in public sources
• other associated individuals submitted or identified for legitimate due diligence purposes

8. Customer instructions

IntegrityFile.org will process customer-submitted data according to customer instructions, these terms, the applicable order form, and applicable law.

9. Confidentiality

IntegrityFile.org will ensure that personnel authorized to process customer data are subject to confidentiality obligations.

10. Security measures

IntegrityFile.org will maintain appropriate administrative, technical, and organizational measures, including:

• workspace-based access controls
• role-based permissions
• least-privilege administration
• encryption in transit
• encryption at rest where supported
• logging and monitoring
• backup controls
• vulnerability management
• incident response
• subprocessor review
• access revocation procedures

11. Subprocessors

IntegrityFile.org may use subprocessors for hosting, storage, authentication, email, analytics, monitoring, AI/search infrastructure, and security.

A current subprocessor list will be maintained in the Legal Center. IntegrityFile.org will provide notice of material changes where required by contract or law.

12. Assistance with rights requests

IntegrityFile.org will provide reasonable assistance to customers responding to data subject requests, where required by applicable law and the customer agreement.

13. Deletion or return

Upon customer request or termination, IntegrityFile.org will delete or return customer data according to customer configuration, subscription terms, legal obligations, audit requirements, security needs, and backup retention limits.

14. International transfers

Where required, IntegrityFile.org will use appropriate transfer mechanisms for international data transfers, such as standard contractual clauses, adequacy decisions, or other lawful mechanisms.

15. Audits

IntegrityFile.org will make reasonable information available to demonstrate compliance with this DPA. Enterprise audit rights, if any, should be set out in a signed agreement.

16. Incident notification

IntegrityFile.org will assess suspected security incidents promptly and notify affected customers where required by law or contract.

Security Overview

Administrative, technical, and organizational safeguards

IntegrityFile.org protects reports and submitted data using reasonable safeguards designed for sensitive due diligence records.

Access control

• Workspace-based access
• User roles for administrators, reviewers, and read-only users
• Least-privilege administrative access
• Access revocation when users leave a workspace
• Restricted production access for authorized operational personnel

Encryption

• Encrypted transport using HTTPS/TLS
• Encrypted storage where supported by hosting and database providers
• Secure handling of authentication tokens and session data

Logging and monitoring

• User activity logs
• Security event logs
• Administrative access logs
• Monitoring for service reliability and abuse prevention

Backups and recovery

• Secure backups
• Recovery procedures
• Backup retention according to operational requirements

Vulnerability management

• Dependency updates
• Security patching
• Review of critical vulnerabilities
• Remediation based on severity

Incident response

Security incidents are assessed promptly. Affected customers will be notified according to contractual and legal requirements.

Exports

Report exports are sensitive due diligence records. Customers are responsible for controlling exports after download, including storage, sharing, retention, and deletion in their own systems.

Customer security responsibilities

Customers should:

• use strong passwords and appropriate account-access controls
• restrict access to authorized users
• remove users who no longer require access
• treat exports as confidential
• avoid uploading unnecessary sensitive data
• configure retention according to internal policy
• report suspected unauthorized access promptly

Subprocessors

Third-party service providers

IntegrityFile.org may use third-party providers to operate the service. Subprocessors may support hosting, storage, authentication, email delivery, monitoring, analytics, AI/search infrastructure, customer support, and security.

The production subprocessor list should identify each provider, purpose, processing location, and transfer mechanism.

Current subprocessor list

Changes to subprocessors

IntegrityFile.org may update subprocessors as the service develops. Material changes will be posted in the Legal Center or notified to customers where required.

Cookie Notice

Essential and optional cookies

IntegrityFile.org uses cookies and similar technologies to operate the website and service.

Essential cookies

Essential cookies are required for:

• secure login
• session management
• authentication
• account security
• load balancing
• fraud and abuse prevention
• user preferences needed for service operation

These cookies cannot be disabled through the service because they are necessary for the product to function.

Preference cookies

Preference cookies may remember user choices such as interface settings, language, or workspace preferences.

Analytics cookies

Analytics cookies may be used to understand product performance, improve features, and diagnose issues. Where required, analytics cookies are used only after consent or through a preference mechanism.

Managing cookies

Users may control cookies through browser settings or the cookie preference tool where available. Blocking essential cookies may prevent the service from working properly.

Acceptable Use Policy

Responsible and lawful use

Users must use IntegrityFile.org only for legitimate organizational due diligence, monitoring, audit, grant, procurement, compliance, or risk-management purposes.

Prohibited uses

Users must not use IntegrityFile.org for:

• stalking
• harassment
• doxxing
• public shaming
• political targeting
• personal curiosity searches
• unlawful discrimination
• retaliation
• surveillance unrelated to organizational due diligence
• automated adverse decisions without human review
• generating defamatory or misleading accusations
• searching children's data without legal authorization
• uploading malicious content
• scraping or reverse engineering the service
• bypassing access controls
• sharing reports with unauthorized persons
• using reports outside their documented due diligence purpose

High-risk use restrictions

Users must not use reports as the sole basis for decisions that may significantly affect a person or organization, including exclusion from funding, contract termination, employment action, public accusation, referral to authorities, or denial of opportunity.

Such decisions require human review, context assessment, escalation, and required internal approval.

Misuse

IntegrityFile.org may suspend or terminate access if it reasonably believes the service is being misused or used unlawfully.

Human Review Policy

Reports are signals, not conclusions

IntegrityFile.org reports organize public-source information for review. They do not label any person or organization as guilty, sanctioned, unsuitable, affiliated, ineligible, excluded, or disqualified.

Required human review

Before taking action, users should review:

• whether the finding relates to the same person or organization
• whether identifiers match
• whether the source is reliable
• whether the source is current
• whether the allegation is proven, unresolved, disputed, or historical
• whether the matter is relevant to the specific due diligence purpose
• whether the partner or vendor should be asked for clarification
• whether legal, safeguarding, procurement, or management escalation is required

False positives

False positives must be documented and dismissed where appropriate. Reports should record the reason a result was dismissed, such as different country, different person, different organization, outdated information, unrelated acronym, or insufficient match.

Relevant findings

Relevant findings should be assessed for:

• severity
• recency
• source reliability
• identity confidence
• program relevance
• donor or policy implications
• whether the concern is resolved or ongoing
• whether follow-up questions are required

Partner or vendor clarification

Where policy permits, partners or vendors should be given an appropriate opportunity to clarify relevant findings before an adverse decision is made.

Final decisions

Final decisions remain with the customer organization and its approval processes. IntegrityFile.org provides structured public-source information to support review; it does not make decisions.

Methodology Notice

How reports are generated

IntegrityFile.org uses a structured public-source due diligence methodology. Reports may combine user-submitted information, public-source search, official registries where available, organization websites, donor and audit references, regulator records, court or legal records, media sources, local-language search terms where possible, and AI-assisted summarization or classification.

Source types reviewed may include

• official organization registries
• company and beneficial ownership registries
• charity and NGO registries
• sanctions, restricted-party and asset-freeze source references
• debarment and ineligibility sources
• government and regulator records
• court and legal records where publicly available
• donor, audit, and inspector-general records
• organization websites and public documents
• annual reports and project pages
• news and media archives
• local-language public sources
• social and web footprint indicators

Sanctions and restricted-party references may include public UN, OFAC, EU, UK, national asset-freeze, World Bank, multilateral development-bank, and public exclusion sources where relevant and available. See the sanctions-list reference page.

Risk categories

Reports may organize public-source signals into categories such as:

• integrity, fraud, and misuse of funds
• safeguarding, PSEA, and misconduct
• aid diversion, sanctions exposure, and terrorism-financing concerns
• political exposure and neutrality risk
• conflict of interest and related-party risk
• entity continuity and rebranding risk
• governance and registration concerns
• human rights and protection concerns
• procurement and vendor performance risk
• legal, regulatory, and financial distress
• donor, audit, and investigation history
• reputation and public controversy

No guarantee of completeness

Public-source coverage varies. Reports may not identify all relevant information. A clean report does not guarantee that no risk exists.

Review record

Each report is intended to document:

• the entity reviewed
• associated names reviewed
• search terms used
• risk categories checked
• sources reviewed
• relevant findings
• false positives
• source links
• review notes
• suggested follow-up
• report date
• user decision fields

Responsible Use Statement

IntegrityFile.org exists to help organizations conduct more consistent, documented, and proportionate due diligence. The service should be used to strengthen fairness, transparency, accountability, and review quality.

It should not be used to replace human judgment, make unsupported accusations, or bypass the rights of partners, vendors, grantees, or individuals.

The correct use of IntegrityFile.org is to identify public-source risk signals, document what was reviewed, separate relevant findings from false positives, and support responsible follow-up through the customer's established processes.