Legal · Customer terms

Software Licence Agreement

The business terms for firms using Archway to manage mortgage, lending, introducer, and client workflows.

Effective 10 August 2026Archway Software LimitedCompany no. 17113566

Business customers only. This agreement is not a consumer contract. It becomes binding when a Customer signs or accepts an Order Form that incorporates it, or otherwise agrees to it when subscribing.

The Order Form sets the selected package, users, price, billing period, initial term, and any negotiated terms. If there is a conflict, the Order Form takes priority, followed by the Data Processing Schedule, this agreement, and the Acceptable Use Policy.

1. Agreement, parties and definitions

This Software Licence Agreement is between Archway Software Limited, company number 17113566, whose registered office is 89 Cardiff Road, Caerdydd, United Kingdom, CF15 7PL (Archway, we, us), and the business identified in the Order Form (the Customer, you).

In this agreement:

  • Authorised User means a named employee, worker, adviser, case manager, introducer, contractor, applicant, or other individual whom the Customer permits to use the Services;
  • Customer Data means information, records, documents, prompts, communications, and other material submitted to or generated in the Services for the Customer, excluding Usage Data;
  • Order Form means an order, proposal, online checkout, or other written ordering document accepted by both parties;
  • Services means the Archway software, client portal, APIs, integrations, support, and related services described in the Order Form; and
  • Usage Data means technical, security, performance, and usage information about operation of the Services. It does not include Customer Data except in aggregated or irreversibly anonymised form.

2. Licence and Authorised Users

Subject to payment and compliance with this agreement, Archway grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term for its Authorised Users to access and use the Services for the Customer's internal business purposes.

Each user licence is for one named person. The Customer may reassign a licence when a user changes role or leaves, but may not share an account or allow concurrent use by multiple people. Applicant portal access does not count as a paid user unless the Order Form says otherwise.

The Customer must control user roles, promptly disable unnecessary access, protect credentials and integration keys, and comply with the Acceptable Use Policy. The Customer is responsible for its Authorised Users and for anyone accessing the Services through its accounts, except to the extent caused by Archway's breach of this agreement.

3. Services, changes, availability and support

Archway will provide the Services with reasonable skill and care and substantially in accordance with the applicable product description. We may improve, update, or replace functionality where this does not materially reduce the overall core service purchased by the Customer. We will give reasonable advance notice of a material adverse change where practicable.

We design the Services for high availability, but do not promise uninterrupted or error-free operation and do not provide a service-level credit or guaranteed uptime unless an Order Form expressly includes an SLA. Availability may be affected by maintenance, emergency security work, internet or supplier failures, lender systems, and events outside our reasonable control. Planned maintenance will be notified where reasonably practicable.

Archway will provide reasonable product and technical support through its published support channels. Support includes investigating reproducible faults and helping users understand the Services; it does not include legal, compliance, regulatory, mortgage, tax, or financial advice. Response and resolution targets are not binding unless stated in the Order Form.

4. Customer responsibilities

The Customer must:

  • provide accurate information and reasonably cooperate with onboarding, security, support, and compliance enquiries;
  • configure roles, workflows, templates, retention, integrations, and permissions for its business;
  • ensure its systems, connectivity, devices, and third-party accounts meet published requirements;
  • maintain lawful bases, privacy information, consents, records, policies, and contracts for Customer Data;
  • check the accuracy and completeness of data, calculations, outputs, communications, and documents;
  • keep independent business-continuity arrangements and export records reasonably required for its regulated obligations; and
  • notify Archway promptly of suspected unauthorised access, security incidents, or material misuse.

The Customer retains responsibility for its business, employees, appointed representatives, introducers, applicants, advice, decisions, submissions, record keeping, and compliance. Archway does not supervise or audit the Customer's regulated activities merely by supplying the Services.

5. Mortgage and regulatory responsibilities

Archway is a software provider and is not authorised by the Financial Conduct Authority. Archway does not act as a mortgage broker or lender, does not enter into a regulated mortgage contract, does not make a personal recommendation to an applicant, and does not approve an application. Displaying or sorting products by objective criteria such as rate, payment, fee, or loan-to-value is not a recommendation by Archway.

The Customer warrants that it and each relevant user holds and will maintain all authorisations, permissions, appointments, competence, oversight, and insurance required for their activities. The Customer must immediately tell Archway if its regulatory status changes in a way that may affect use of the Services.

The Customer is solely responsible for advice, suitability, affordability, disclosure, vulnerable-customer treatment, Consumer Duty outcomes, financial promotions, AML and sanctions compliance, and lender requirements. Suitability reports and other regulated documents generated through the Services are drafts based on Customer inputs. A suitably authorised person must review, amend where required, and approve them before use.

Applications and lender submissions are transmitted only following an Authorised User's instruction and approval. The Customer is responsible for confirming the authority and accuracy of every submission and for ensuring that an introducer does not conduct regulated activity outside the scope permitted to that introducer.

6. Third-party services, data and AI

The Services may connect to lender portals, valuation and property-data services, communications providers, identity and AML services, payment providers, and other third parties. Their availability, data, rules, and terms are outside Archway's control and may change. The Customer authorises Archway to send and receive the information needed to perform the Customer's selected integration and must maintain any required third-party account or permission.

Quotes, lender criteria, property estimates, affordability results, identity checks, and other third-party information may be delayed, incomplete, or inaccurate. An automated valuation is not a formal valuation. The Customer must verify material information with the relevant provider before relying on it.

AI-assisted features may help draft, extract, summarise, or organise information. Outputs may be inaccurate and are never a substitute for professional judgement or mandatory checks. The Customer must arrange meaningful human review and must not use the Services to make a solely automated decision that has legal or similarly significant effects on an applicant. Archway does not use Customer Data to train general-purpose AI models and requires its AI providers to process submitted content only to provide and secure the relevant feature.

7. Fees, VAT and payment

Fees, permitted user numbers, packages, and billing frequency are set out in the Order Form. Fees are invoiced in advance and are exclusive of VAT and similar taxes, which will be added where legally required. The Customer must pay valid invoices in pounds sterling by the due date without set-off or deduction except where required by law.

Monthly subscriptions renew monthly and annual subscriptions renew annually unless cancelled in accordance with section 14. Archway may change renewal pricing by giving at least 30 days' notice for a monthly plan and at least 60 days' notice before an annual renewal. A change does not affect a prepaid fixed term.

If an undisputed amount is overdue, Archway may charge statutory interest and reasonable recovery costs and, after giving at least 10 days' notice, suspend paid access until payment. A genuine billing dispute raised promptly and in good faith will not trigger suspension of the disputed amount while the parties work to resolve it.

8. Intellectual property and data ownership

Archway and its licensors retain all rights in the Services, software, designs, documentation, models, workflows, improvements, and Usage Data. No rights are granted except the express licence in this agreement.

The Customer retains its rights in Customer Data and grants Archway a non-exclusive right to host, copy, transmit, transform, display, and otherwise process Customer Data only as necessary to provide, secure, support, and improve the Services, comply with law, and follow the Customer's documented instructions.

Archway may create and use aggregated statistics and irreversibly anonymised information that cannot reasonably identify the Customer or any person. Archway may use suggestions and feedback without restriction, but will not publicly identify the Customer as their source without permission. Archway will not sell Customer Data.

9. Confidentiality

Each party must protect the other's non-public business, technical, security, financial, and customer information using at least reasonable care and use it only to perform or receive the Services. Confidential information may be disclosed to personnel, professional advisers, auditors, insurers, and suppliers who need it and are bound by appropriate confidentiality duties.

These obligations do not apply to information that the receiving party can show was lawfully known without restriction, becomes public without breach, is independently developed, or is lawfully received from another source. A legally compelled disclosure is permitted, with advance notice where lawful and practicable. Trade secrets remain protected for so long as they qualify as trade secrets; other confidentiality obligations continue for five years after termination.

10. Data protection and security

Each party must comply with applicable data protection law. For account administration, billing, security, service analytics, support, and its own business records, Archway acts as an independent controller as explained in the Privacy Policy. Where Archway processes applicant, client, lead, or other personal data on the Customer's documented instructions, the Customer is the controller and Archway is the processor. The Data Processing Schedule in section 17 applies to that processing.

Archway will maintain appropriate technical and organisational measures designed to protect Customer Data, including encryption in transit and at rest, role-based access controls, multi-factor authentication support, audit logging, encrypted backups, vulnerability management, security testing, and incident-response procedures. No online service can guarantee absolute security.

11. Warranties and disclaimers

Each party warrants that it has authority to enter into this agreement. Archway warrants that it will provide the Services with reasonable skill and care and will not knowingly introduce malicious code.

If Archway materially breaches that warranty, the Customer must give sufficient details promptly. Archway will use reasonable efforts to correct or reperform the affected Service. If it cannot do so within a reasonable period, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused period. This is the Customer's exclusive remedy for breach of the service warranty.

To the fullest extent permitted by law, all other implied warranties and conditions are excluded. In particular, Archway does not warrant that the Services, third-party data, AI outputs, lender systems, or generated documents are error-free, continuously available, suitable for a particular applicant, or sufficient by themselves to meet the Customer's regulatory obligations.

12. Liability

Nothing in this agreement limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited or excluded.

Subject to the paragraph above, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill, or business opportunity. Archway is not liable for a regulated recommendation or decision made by the Customer, inaccurate Customer Data, use contrary to documentation, third-party or lender systems, or a failure by the Customer to maintain appropriate business-continuity or export arrangements.

Subject to the first paragraph of this section, each party's total aggregate liability arising in any consecutive 12-month period is limited to the greater of £1,000 and the fees paid or payable by the Customer for the Services in that period. For breach of confidentiality, data protection obligations, or intellectual property rights, the cap is the greater of £2,000 and twice those fees. The caps apply in aggregate across contract, tort (including negligence), breach of statutory duty, misrepresentation, and all other causes.

The parties agree that these limits reflect the subscription fees, allocation of responsibility, availability of insurance, and the fact that the Customer controls its advice and regulated activities. Each party must take reasonable steps to mitigate loss.

13. Suspension

Archway may suspend all or part of the Services where reasonably necessary to address a security risk, prevent material misuse, comply with law or a binding provider requirement, protect an applicant or third party, or deal with overdue undisputed fees. Where practicable, Archway will give notice, explain the reason, limit suspension to the affected access or feature, and restore access when the issue is resolved.

Archway may act immediately where delay would create material risk. Suspension does not remove the Customer's obligation to pay fees unless the suspension results from Archway's uncured material breach.

14. Term, renewal, cancellation and termination

This agreement begins when the first Order Form is accepted and continues while an Order Form remains in force. Unless the Order Form states a different initial or minimum term, a monthly subscription runs month to month and an annual subscription runs for 12 months.

A monthly subscription may be cancelled at any time, taking effect at the end of the current paid monthly period. An annual subscription may be cancelled by giving at least 30 days' notice before renewal, taking effect at the end of the current annual term. Fees already paid are non-refundable except where this agreement expressly says otherwise. Cancellation may be sent through the account controls or to the legal contact email.

Either party may terminate an affected Order Form immediately by written notice if the other commits a material breach and fails to remedy it within 30 days after notice, or enters insolvency proceedings other than a solvent restructuring. A breach creating an immediate material security, legal, or applicant-harm risk may justify immediate termination where it cannot reasonably be remedied.

On termination, access ends and all outstanding fees become due. For 30 days, the Customer may request or use available tools to export Customer Data in a commonly used format. Archway will then delete Customer Data from active systems unless law requires retention. Residual encrypted copies will be isolated from ordinary use and deleted through the routine backup cycle, normally within a further 35 days. The Customer may request earlier deletion where technically and legally practicable. Archway may retain its own controller records, such as invoices, security logs, and contract records, for the periods described in the Privacy Policy.

15. Beta services and founder firms

A beta, preview, trial, early-access, or experimental feature is still under development. It may contain errors, change materially, have limited support, or be withdrawn. Unless an Order Form expressly says otherwise, beta features are provided without an uptime commitment or service credit and must not be the Customer's sole means of meeting a legal, regulatory, or business-continuity requirement.

Founder-firm benefits, such as introductory pricing, price protection, enhanced access, roadmap sessions, or onboarding support, apply only where written in the Order Form. The Order Form must state their duration and any conditions. Product feedback does not transfer ownership of Customer Data or give the Customer ownership of the Services, and Archway is not required to implement a requested feature.

16. General terms

Neither party may assign this agreement without the other's written consent, not to be unreasonably withheld, except that Archway may assign it as part of a merger, reorganisation, financing, or sale of substantially all relevant assets if the assignee assumes Archway's obligations. The Customer may permit an affiliate to use the Services only if included in the Order Form and remains responsible for it.

Neither party is liable for delay caused by events beyond its reasonable control, provided it takes reasonable steps to reduce the effect. This does not excuse payment obligations. The parties are independent contractors; this agreement creates no partnership, employment, fiduciary, or agency relationship.

Notices concerning breach, termination, or legal claims must be in writing and sent to the contact in the Order Form and, for Archway, to privacy@archwaysoftware.co.uk. Operational notices may be given in the Services or by email. If a provision is unenforceable, it will be adjusted only as needed and the remainder continues. A delay in exercising a right is not a waiver. Clauses intended to survive termination do so.

This agreement and its incorporated documents are the entire agreement about the Services and replace earlier proposals or representations, but do not exclude liability for fraud. No person other than the parties has a right to enforce it under the Contracts (Rights of Third Parties) Act 1999.

English and Welsh law governs this agreement. The courts of England and Wales have exclusive jurisdiction, although either party may seek urgent protective relief in another competent court.

17. Data Processing Schedule

17.1 Scope and roles

This schedule applies to personal data in Customer Data that Archway processes on the Customer's behalf (Protected Data). The Customer is the controller and Archway is the processor. If the Customer acts as a processor for another controller, Archway is its sub-processor and the Customer confirms it is authorised to appoint Archway and give the instructions in this agreement.

17.2 Processing details

  • Subject matter and purpose: hosting and operating a mortgage CRM, client portal, sourcing, quoting, affordability, submissions, documents, communications, e-signatures, identity and AML workflows, reporting, support, security, and selected AI-assisted functions.
  • Duration: the subscription term plus the export and deletion period in section 14.
  • Nature of processing: collection, recording, organisation, storage, retrieval, consultation, matching, calculation, transmission, restriction, export, support, backup, and deletion.
  • People: applicants, borrowers, prospective borrowers, partners, dependants, guarantors, property owners, customers, leads, introducers, advisers, case managers, Customer personnel, lender and provider contacts, and other people whose data the Customer lawfully submits.
  • Personal data: identity and contact details; date of birth; address and residency history; family and dependant information; employment, income, expenditure, assets, liabilities, credit commitments, bank and transaction information; property, loan, mortgage, insurance, product and application information; identity documents, bank statements, evidence, correspondence, call records, signatures, audit records, device and security data; and information received through authorised lenders and integrations.
  • Sensitive information: health, disability and vulnerability information; biometric identity results where enabled; suspected fraud, criminal-offence, sanctions and politically exposed person information; and other special category data submitted under the Customer's documented instructions.

17.3 Archway's processor obligations

Archway will:

  • process Protected Data only on the Customer's documented instructions, including this agreement and use of configured features, unless UK law requires otherwise;
  • inform the Customer if an instruction appears to infringe data protection law and, unless prohibited, before processing required by law;
  • ensure people authorised to process Protected Data are bound by confidentiality and receive appropriate security and privacy training;
  • maintain measures appropriate to the risk, including the controls described in section 10;
  • taking account of the nature of processing, reasonably assist the Customer with data-subject requests, security, breach assessment and notification, DPIAs, and regulator consultation;
  • notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Protected Data and provide available information reasonably required for the Customer's response;
  • keep legally required processing records and make information reasonably necessary to demonstrate compliance available to the Customer; and
  • delete or return Protected Data in accordance with section 14, unless law requires retention.

17.4 Customer instructions and obligations

The Customer must ensure its instructions and processing are lawful, provide required privacy information, respond to rights requests, and identify an Article 6 basis and any required Article 9 or DPA 2018 Schedule 1 condition. The Customer is responsible for deciding and documenting applicant-record retention. Archway will provide configurable deletion and export tools where included in the Services and will follow documented retention instructions that are technically supported and lawful.

17.5 Sub-processors

The Customer gives general written authorisation for Archway to appoint sub-processors. Current principal providers include Supabase for London-region database, storage, and backups; Resend for email delivery; Sentry for error monitoring; Stripe for billing; OpenAI and Anthropic for enabled AI features; and PropertyData for property and automated valuation information. Archway may also use approved communications, identity and AML, infrastructure, support, and lender-connectivity providers required by selected features.

Archway will impose materially equivalent data protection duties on each sub-processor, remain responsible for its performance to the extent required by law, maintain a current list available on request or through the Services, and give at least 30 days' notice of a new sub-processor where reasonably practicable. The Customer may object on reasonable data-protection grounds within 10 days. The parties will work in good faith on a solution; if none is reasonably available, the Customer may stop the affected feature or terminate it and receive a pro-rata refund of prepaid fees for its unused period.

17.6 Location and international transfers

Archway's primary production database and storage are hosted in the London, United Kingdom region. Some sub-processors or authorised support personnel may process or access limited Protected Data outside the UK. Archway will make a restricted transfer only where permitted by data protection law and will use an applicable adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, or another lawful safeguard, together with a transfer risk assessment where required.

17.7 Audits

On reasonable written request, Archway will provide relevant security and compliance information. No more than once each year, unless required following a breach or by a regulator, the Customer may conduct an audit through an independent auditor bound by confidentiality. Audits must give at least 30 days' notice, occur during normal business hours, avoid disruption and access to other customers' data, and use existing independent reports first where sufficient. The Customer bears its audit costs; Archway may charge reasonable costs for assistance beyond standard evidence unless the audit identifies Archway's material breach.

17.8 Priority

If this schedule conflicts with another part of the agreement on processing Protected Data, this schedule takes priority. Nothing in it reduces either party's direct obligations under data protection law.