Legal center.

1. Terms & Privacy

Your use of any OmniStrat AI product (Foundry, Terminal, Agora, Passport, Taskforces, Compliance, marketing site, all APIs) is governed by our:

• Terms of Service — the contract between you and OmniStrat AI.
• Privacy Policy — what data we collect, how we use it, and what we never do.

By creating an account, subscribing, or otherwise using the Service, you agree to both documents. If you don’t agree, don’t use the Service. This Legal Center supplements those documents. Where a conflict exists, the more specific provision controls.

2. Financial services disclaimer

2.1 Not investment advice

Nothing on this site, in the Terminal, in the AI Analyst, in our documentation, or in any communication from OmniStrat AI constitutes investment, tax, legal, or financial advice, or a recommendation to buy, sell, or hold any security, commodity, cryptocurrency, futures contract, or other financial instrument. Every market comment, backtest, screen output, options-flow reading, or model output is illustrative technology output and is not a personalized recommendation.

2.2 Past performance

Backtests are historical. Past performance is not indicative of future results. Actual returns will differ from backtests because of slippage, commissions, market impact, latency, order-book depth, tax, borrow availability, corporate actions, and factors we cannot model. Do not size positions based on backtest returns.

2.3 Trading risk

Trading securities, options, futures, and cryptocurrencies involves substantial risk of loss and is not suitable for every investor. You can lose more than your initial investment when trading on margin, options, or futures. Options in particular involve unique risks including but not limited to time decay, volatility risk, and total loss of premium. Cryptocurrency values are highly volatile and unregulated in many jurisdictions. You are responsible for understanding the risks of the instruments you trade.

2.4 AI Co-pilot

The AI Analyst inside the Terminal generates responses using large language models. Model output can be wrong, incomplete, out of date, or hallucinated. Do not treat AI output as a research report or an order. Verify every recommendation before acting.

2.5 Broker-dealer status

OmniStrat AI is not currently registered with the SEC, FINRA, CFTC, NFA, or MSRB as a broker-dealer, investment adviser, futures commission merchant, commodity pool operator, or municipal securities dealer. We are a technology platform that connects to broker-dealers you already use (Alpaca, IBKR, Tradovate, etc.). If your jurisdiction requires the Terminal or its features to be delivered by a registered entity, do not use the Terminal.

2.6 Terminal Compliance is a workstation, not a compliance service

The Terminal Compliance add-on is a workflow and reporting tool for registered broker-dealers to manage their own compliance obligations. OmniStrat AI does not act as your compliance officer, regulator representative, or filing agent. All filings, submissions, and regulatory decisions are made by you or your registered CCO.

2.7 Options Clearing Corporation disclosure

Before you trade listed options in the United States, obtain and read the Options Clearing Corporation’s current Options Disclosure Document (“Characteristics and Risks of Standardized Options”) from your broker. OmniStrat AI does not distribute the ODD.

3. AI-generated content notice

OmniStrat AI products route requests to third-party large language models (Anthropic, OpenAI, Google, xAI, Cloudflare Workers AI, Bedrock, and others). All outputs from these models:

• Are generated by AI and may be inaccurate, incomplete, biased, or fabricated.
• Are provided as-is with no representation of correctness.
• Should be independently verified before you rely on them for any consequential decision.

You are responsible for how you use AI output. OmniStrat AI does not endorse, verify, or take responsibility for the content of any AI-generated response you receive through Foundry, the Terminal AI Analyst, Taskforces, or any other product.

3.1 EU AI Act (Regulation 2024/1689)

OmniStrat AI acts as a “deployer” and, for our own routing layer, an “operator” of general-purpose AI systems under the EU AI Act. Our Foundry does not train foundation models. When you use Foundry to build user-facing AI features, you become the “deployer” toward your users and are responsible for Article 50 transparency (informing users they are interacting with AI), risk classification, and any high-risk system obligations. Our routing does not constitute a “high-risk AI system” on its own but may become part of one depending on your use.

3.2 US state AI regulations

You are responsible for compliance with US state AI laws applicable to your use, including but not limited to: Colorado AI Act (SB 205), California AB 2013 (training-data disclosure), California SB 942 (consumer AI transparency), Illinois AI Video Interview Act, and NYC Local Law 144 (automated employment decision tools). We can provide model documentation on request via legal@omnistrat.ai.

3.3 Training

We do not train foundation models. We do not use your prompts, responses, or Passport-scoped data to train third-party models. Upstream providers may have their own training policies for prompts routed through them; we default every provider to their no-training or opt-out setting where offered, and pass through your no-training preference on every request.

4. Compliance-product disclaimer

OmniStrat Compliance (Foundation and every vertical extension — Terminal BD, Foundry AI Governance, Agora Attestation Compliance) is a technology platform. Using OmniStrat Compliance does not automatically make your organization compliant with any law, regulation, or industry standard. Your Chief Compliance Officer, General Counsel, or equivalent remains responsible for interpretation, filing, and defense of every obligation.

The workstation is designed to help you organize, evidence, and prove work you have already done. It does not perform legal analysis, it does not represent you to regulators, and it does not substitute for licensed counsel.

5. Accessibility statement

OmniStrat AI is committed to making our website and products accessible to everyone, including people with disabilities. We target WCAG 2.1 Level AA conformance and follow WAI-ARIA authoring practices for interactive components. Ongoing work includes:

• Color contrast ratios meeting AA on text and interactive elements.
• Keyboard navigation for all interactive controls.
• Semantic HTML with meaningful labels for screen readers.
• Reduced-motion support via prefers-reduced-motion.
• Focus-visible outlines that survive theme changes.
• Text-size preferences respected; no lock on user zoom.

If any part of our website or products is not accessible to you, please email accessibility@omnistrat.ai and we will work with you to provide the information or service you need through an alternative accessible channel. This statement is issued in good faith and updated as we address gaps.

6. Privacy rights (US state laws + GDPR/UK-GDPR)

6.1 We do not sell or share your personal information

OmniStrat AI does not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Because we do not sell or share, we do not display a “Do Not Sell or Share My Personal Information” link — but if you want written confirmation for your records, email privacy@omnistrat.ai.

6.2 US state privacy laws

The following US state comprehensive privacy laws apply to residents of those states. Your rights under each are substantively similar; where they diverge, we apply the more favorable to you:

• California (CCPA/CPRA)
• Virginia (VCDPA)
• Colorado (CPA) — including universal opt-out via Global Privacy Control
• Connecticut (CTDPA)
• Utah (UCPA)
• Texas (TDPSA)
• Oregon (OCPA)
• Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Rhode Island, Tennessee, Indiana — as their statutes come into force.

6.3 Your rights

Regardless of where you live, you have the right to:

• Know what personal information we hold about you and the purposes we use it for.
• Access a copy of that information in a machine-readable format.
• Correct inaccurate personal information.
• Delete your account and associated personal information (subject to legal retention obligations).
• Object to processing that is not strictly necessary to deliver the Service.
• Data portability — export your data in a common format.
• Opt out of profiling or automated decisions producing legal effects (we do not currently make such decisions).
• Global Privacy Control (GPC) — we honor GPC signals as an opt-out request under Colorado and California law.
• Non-discrimination — we will not deny service, charge different prices, or degrade the Service because you exercise a privacy right.

Submit any request to privacy@omnistrat.ai. We respond within 45 days (extendable to 90 for complex requests, per CPRA), or the shorter timeline required by your state.

6.4 GDPR / UK-GDPR

If you are in the EEA, UK, or Switzerland, we process your personal information as an independent controller based on the following lawful bases (as applicable): contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f) — delivering the Service, security, product improvement), consent where required, and compliance with legal obligation (Art. 6(1)(c)).

Data may be transferred to the United States under Standard Contractual Clauses (2021/914/EU). We conduct a Transfer Impact Assessment (TIA) reviewing US surveillance law under the Schrems II standard and apply supplementary technical measures (envelope-encrypted PII, no plaintext export to US-government-accessible databases) so that transferred data remains protected against unlawful government access. If you require a copy of our TIA or SCCs, email privacy@omnistrat.ai.

You have the additional right to lodge a complaint with your supervisory authority. In the UK, this is the ICO. In the EU, it’s the DPA of your Member State.

6.5 Authorized agents

You may designate an authorized agent to exercise these rights on your behalf. We will require reasonable proof of authorization (a written, dated authorization signed by you, or a valid power of attorney).

6.6 Sensitive personal information

We do not knowingly collect sensitive personal information as defined by CPRA § 1798.140(ae) (SSN, driver license, precise geolocation, racial or ethnic origin, religious belief, union membership, contents of private communications, genetic data, biometric data, health data, sex-life data). If you provide such data (e.g., in a support ticket), we treat it as sensitive and honor limit-use requests.

7. Cookies & tracking

OmniStrat AI uses no third-party analytics cookies, no marketing cookies, and no cross-site tracking. We use exactly one first-party mechanism to remember you:

• Passport JWT stored in localStorage under the key omnistrat-token. Used to keep you signed in and to authenticate your requests to our APIs. Cleared automatically on sign-out.
• Theme & motion preferences stored under os-theme and os-motion to remember your visual preferences.

We use Cloudflare Web Analytics on the marketing site, which is privacy-preserving and cookieless. It records aggregate country + page views only. No fingerprinting, no personal identifiers, no cross-site linkage.

Because we use no consent-required cookies, we do not display a cookie consent banner. If regulation changes, or if third-party embeds ever require it, we will add one immediately and stop dropping non-essential cookies until you consent.

8. DMCA / copyright complaints

OmniStrat AI complies with the Digital Millennium Copyright Act (17 U.S.C. § 512). If you believe that content hosted on our services infringes your copyright, please send a written notification containing all of the following to our designated agent:

• Physical or electronic signature of a person authorized to act on behalf of the owner of the copyright.
• Identification of the copyrighted work claimed to have been infringed.
• Identification of the material that is claimed to be infringing (URL, cert_id, cohort_id, etc.) sufficient to permit us to locate it.
• Your contact information (address, telephone number, email address).
• A statement that you have a good-faith belief that use of the material is not authorized by the copyright owner, its agent, or the law.
• A statement, made under penalty of perjury, that the above information is accurate and that you are authorized to act on behalf of the copyright owner.

Designated agent: dmca@omnistrat.ai. We respond in accordance with the DMCA safe-harbor procedures and, where required, register the agent with the US Copyright Office. Counter-notifications should be sent to the same address. Repeat infringers will have their accounts terminated.

9. Security & vulnerability disclosure

If you have discovered a security vulnerability in OmniStrat AI products, please report it responsibly to security@omnistrat.ai. Do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and remediate it.

Please include: a description of the issue, steps to reproduce, expected impact, and any proof-of-concept material. We do not currently operate a paid bounty program but will credit responsible disclosures with your consent.

Safe harbor. We consider good-faith security research to be authorized use of the Service and will not pursue legal action against researchers who comply with this policy. You may not: (a) exfiltrate customer data beyond what is minimally necessary to demonstrate the issue, (b) publicly disclose without our consent before we have patched, (c) attempt to disrupt the Service, (d) use social engineering against employees, or (e) violate any other law.

10. Export controls & sanctions

OmniStrat AI complies with US export control laws (Export Administration Regulations, or EAR) and economic sanctions administered by the US Treasury Department’s Office of Foreign Assets Control (OFAC).

By using the Service, you represent that you are not subject to any of the above restrictions and that you will not export, re-export, or transfer the Service or any data received through it in violation of applicable law. You will not use the Service in the design, development, or production of nuclear, chemical, biological, or missile weapons.

11. Sub-processors & data flows

We use a small number of vetted sub-processors to deliver the Service. Each has been reviewed for security, GDPR SCCs (where applicable), and appropriate contractual commitments. Current list:

We do not use analytics vendors that fingerprint or track users. We do not use advertising networks. When you route through a BYOK provider (your own Anthropic key, etc.), that provider becomes a controller under its own terms; we act as a transit layer only.

We will notify you at least 15 days before adding a new sub-processor by updating this page. Enterprise customers may object under their DPA.

12. Communications preferences (CAN-SPAM / TCPA)

12.1 Transactional emails (cannot be opted out)

We send transactional emails required to deliver the Service: account verification, billing receipts, security alerts, breach notifications, sub-processor changes, material Terms updates. You cannot opt out of these while your account is active. Closing your account stops them.

12.2 Marketing emails (opt-in only)

We do not send marketing emails without your explicit opt-in. Every marketing email we do send contains an unsubscribe link that will process your request within 10 business days (CAN-SPAM § 7704(a)(4)). Our physical address appears in every marketing email.

12.3 SMS / phone (TCPA)

We do not currently send marketing SMS or make marketing calls. If we ever do, we will obtain your prior express written consent under the TCPA. You may text STOP to any transactional SMS to opt out; you may request DO-NOT-CALL registration by emailing privacy@omnistrat.ai.

13. Content ownership (AI outputs, IP, feedback)

13.1 Your content

You retain all right, title, and interest in the content you submit to the Service (prompts, documents, trades, save data, uploads). We claim no ownership. You grant us a worldwide, non-exclusive, royalty-free license to host, cache, transmit, and process your content solely as necessary to deliver the Service to you.

13.2 AI outputs

As between you and OmniStrat AI, you own the AI outputs generated in response to your prompts, to the extent permitted by law and by the upstream provider’s terms (Anthropic, OpenAI, etc. each define output ownership in their own terms). You are responsible for evaluating whether the output is fit for your use and for any downstream distribution. AI outputs may not be copyrightable in some jurisdictions.

13.3 Our IP

OmniStrat AI, the Passport substrate, the audit chain, our software, brand, designs, and documentation are and remain our property. Nothing in these terms grants you a license to use our trademarks or trade dress except as necessary to describe the Service accurately (e.g., “built on OmniStrat AI”).

13.4 Feedback

If you send us feedback, feature requests, or bug reports, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use, modify, and incorporate that feedback into the Service without obligation to you. You waive any moral rights in the feedback to the extent permitted by law.

13.5 Trademark policy

“OmniStrat,” the OmniStrat mark, “Foundry,” “Terminal,” “Agora,” “Passport,” and “Attestation” (in the context of our Service) are our trademarks. Do not use them to imply endorsement or affiliation. Fair use for commentary, review, and comparison is permitted.

14. Public trust anchor

Because our substrate is cryptographic, third parties can verify our claims without account access. We publish:

• JWKS (public keys): api.omnistrat.ai/auth/jwks — the EdDSA (Ed25519) public keys used to sign Passport JWTs and audit-chain records. Key rotation is announced 30 days in advance via this page and via JWKS metadata.
• Genesis attestation: att_MxxDlaSHtEDp7mQO02RF5088 — the first record on the chain. Anyone can verify at this URL.
• Verify endpoints: /api/attest/verify/<id> for attestations, /api/matchmaking/verify/<cert_id> for Match Certificates, cohort events and taskforce events chain to the same substrate.

If we ever lose control of a signing key, we will publish a signed revocation notice at omnistrat.ai/security-notices and rotate the key immediately.

15. Data breach notification

If a security incident results in unauthorized access to your personal information, we will notify you and, where required, regulators within the timelines mandated by applicable law:

• GDPR: supervisory authority within 72 hours of becoming aware, if likely to result in risk to your rights and freedoms; direct notification without undue delay if likely to result in high risk.
• US state laws: the shortest timeline required by your state (typically 30 to 45 days after discovery; some states require faster).
• HIPAA (Enterprise/BAA): within 60 days of discovery.
• Contract: the shorter of the above or the timeline in your Enterprise agreement.

Notifications will describe the nature of the incident, the categories of data involved, the measures we have taken, and how to reach us.

16. Modifications to these terms

We may modify these Terms, Privacy Policy, or this Legal Center. Material changes will be posted here with a new “Last updated” date and, where the change materially reduces your rights, we will email account holders at least 30 days before the change takes effect. Non-material changes (typos, clarifications) may be made without notice. Your continued use after the effective date constitutes acceptance. If you disagree, cancel before the effective date; we will refund the unused portion of the current billing period.

17. Indemnification

You will indemnify, defend, and hold harmless OmniStrat AI, Inc., its officers, directors, employees, and agents from and against any third-party claim, loss, damage, or expense (including reasonable attorneys’ fees) arising out of or related to: (a) your use of the Service in violation of these Terms or applicable law, (b) your content submitted to the Service, (c) trades you place through the Terminal, (d) AI outputs you distribute to third parties, (e) attestations, Match Certificates, or other cryptographic artifacts you sign, or (f) your violation of any third-party right.

We will promptly notify you of any claim for which we seek indemnification, allow you to control the defense (with counsel reasonably acceptable to us), and reasonably cooperate at your expense. You will not settle any claim without our prior written consent if the settlement admits fault, imposes non-monetary obligations on us, or does not fully release us.

18. No warranty & limitation of liability

To the maximum extent permitted by law:

• OmniStrat AI is not liable for indirect, incidental, special, consequential, exemplary, or punitive damages.
• Our aggregate liability for any claim arising out of or relating to the Service is limited to the greater of: (a) the amount you paid us in the 12 months preceding the claim, or (b) US$100.
• We are not liable for lost profits, lost data, trading losses, business interruption, or any similar damages.

Basis of the bargain. These limitations reflect a reasonable allocation of risk between you and OmniStrat AI given the pricing and nature of the Service. They apply even if a limited remedy fails of its essential purpose, and they survive termination.

Some jurisdictions do not allow the exclusion of certain warranties or limitations of certain damages. In those jurisdictions, our liability is limited to the greatest extent permitted by law.

19. Governing law & arbitration

These Terms are governed by the laws of the State of Florida, United States, without regard to conflict-of-law principles. If you are a consumer in the EU/UK, mandatory consumer-protection law in your jurisdiction supplements these Terms.

Exceptions. Either party may (a) bring an individual claim in small-claims court in the small-claims-court division of the county of your residence or Orange County, Florida, and (b) seek injunctive or other equitable relief in a court of competent jurisdiction to protect intellectual property or confidential information without first arbitrating.

30-day opt-out. You may opt out of arbitration by emailing legal@omnistrat.ai within 30 days of first accepting these Terms, including your name and the phrase “arbitration opt-out.” Opt-out does not affect any other provision.

Class waiver. You may not pursue any claim as a class, collective, mass, private-attorney-general, or representative action. If the class waiver is found unenforceable as to any claim, that claim shall be severed and adjudicated in court; the remaining claims proceed in arbitration.

20. Force majeure & boilerplate

20.1 Force majeure

Neither party is liable for delay or failure to perform (except payment obligations) caused by events beyond reasonable control, including natural disasters, war, terrorism, civil disorder, pandemic, government action, internet or telecom failure, denial-of-service attack, or upstream provider outage.

20.2 Assignment

We may assign these Terms in connection with a merger, acquisition, reorganization, or sale of substantially all assets. You may not assign your rights or obligations without our prior written consent, except that you may assign to an affiliate that agrees in writing to be bound.

20.3 Severability

If any provision is held unenforceable, the remaining provisions survive and the unenforceable provision is reformed to the minimum extent necessary to make it enforceable.

20.4 No waiver

Our failure to enforce any provision is not a waiver of our right to enforce it later. Waivers must be in writing and signed by an authorized representative.

20.5 Entire agreement

These Terms, the Privacy Policy, and any signed order form or Enterprise MSA constitute the entire agreement between you and OmniStrat AI regarding the Service and supersede all prior communications.

20.6 Survival

Sections 2 (Financial), 3 (AI), 8 (DMCA), 10 (Export), 13 (Content ownership), 17 (Indemnification), 18 (Warranty & liability), 19 (Governing law & arbitration), 20 (Boilerplate), and 27 (Contact) survive termination.

20.7 Electronic signatures & records

You consent to receive communications and to sign documents electronically. Records maintained by us in electronic form are admissible evidence to the same extent as originals.

20.8 Anti-corruption

You will comply with the US Foreign Corrupt Practices Act, the UK Bribery Act, and all other applicable anti-bribery laws.

20.9 Language

These Terms are drafted in English. Any translation is provided for convenience only; the English version controls.

21. Age restriction (COPPA)

OmniStrat AI is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not create an account or submit any personal information. If you believe a child under 13 has provided us with personal information, contact privacy@omnistrat.ai and we will delete it.

Subscribing to a paid plan requires you to be at least 18 or the age of majority in your jurisdiction, whichever is greater. For users aged 13-17, we require verifiable parental or guardian consent to use the Service.

22. Enterprise DPA / BAA / HIPAA

Enterprise customers with regulated data-handling obligations can execute the following supplementary agreements:

• Data Processing Addendum (DPA) incorporating the 2021 EU Standard Contractual Clauses and the UK IDTA. Available on request.
• Business Associate Agreement (BAA) under HIPAA for Enterprise deployments handling Protected Health Information. Requires the Enterprise tier ($250K+/yr) or above; not available on self-service plans.
• SOC 2 controls alignment letter available under NDA.
• Cybersecurity insurance certificate available under NDA.

Do not submit PHI, cardholder data, government-classified information, or export-controlled technical data to the Service under self-service tiers. Contact enterprise@omnistrat.ai to arrange the appropriate agreements.

23. Third-party links & embeds

The Service may contain links to or integrations with third-party websites, applications, or services (brokers, upstream AI providers, third-party UIs) that are not owned or controlled by us. We are not responsible for the content, privacy practices, or availability of any third-party service. When you leave OmniStrat AI, you are subject to the terms and privacy policies of the destination.

24. Health information disclaimer

OmniStrat AI is not a healthcare provider. AI outputs generated through our Service may discuss health topics but are not medical, dental, mental-health, or pharmacological advice. Do not rely on AI output to diagnose, treat, cure, or prevent any disease. Consult a licensed healthcare professional for any medical decision.

If you are an Enterprise customer under a BAA using the Service to handle PHI, health-information handling is governed by that BAA in addition to these terms.

25. Testimonials & endorsements

Testimonials, reviews, and endorsements displayed on our marketing materials are provided by real users describing their actual experiences. Unless expressly disclosed, testimonials are not compensated. Individual results vary. Compensated endorsements, if any, will be labeled “#ad” or “sponsored” in compliance with the FTC Endorsement Guides (16 C.F.R. Part 255).

If you are a customer and wish to withdraw a public testimonial you previously gave, email hello@omnistrat.ai.

26. US government users

The Service, associated documentation, and any related updates are “commercial computer software” and “commercial computer software documentation” under FAR § 2.101 and DFARS § 252.227-7014(a)(1). Use, duplication, or disclosure by the US government is subject to the restrictions in these Terms and the applicable federal acquisition regulations. Access, use, and disclosure by federal, state, or local government agencies is governed by these Terms; no additional government-specific rights are granted.

27. Contact & addresses