Terms of Service

For Corsift Desk and Corsift Watch. Effective 27 October 2026.

1. About these terms

Corsift is a trading name of ASG INFOTECH LIMITED, a company registered in England and Wales (number 13873222). Our registered office is Sterling House, Maple Court, Maple Road, Tankersley, S75 3DP, United Kingdom, and our VAT number is GB402247244. You can reach us at hello@corsift.com. In these terms "we", "us" and "Corsift" mean ASG INFOTECH LIMITED.

These terms apply when an organisation ("you") uses Corsift Desk (desk.corsift.com) or Corsift Watch (watch.corsift.com), including during a free trial and on Watch's free plan. They are business-to-business terms: by signing up or using the service you confirm that you're acting for a business and that you're authorised to accept these terms for it. Corsift Relay has its own Relay terms.

These terms and any order or quote we've agreed with you in writing make up our agreement. If a signed order says something different for its own scope, the order wins. How we handle your own account details, as opposed to the data in your workspace, is explained in our privacy notice for Desk and Watch.

2. Your workspace and the people in it

• Each organisation gets its own workspace. The person who signs up becomes its first Admin.
• You decide who you invite and what each person may do, through groups and permissions. You are responsible for everything people in your workspace do with Corsift, as if you had done it yourself.
• Keep sign-in details private, use the security your sign-in offers, remove people who leave, and tell us straight away at hello@corsift.com if you think someone has got into your workspace who shouldn't have.
• Give us accurate details and keep them up to date, including an email address where we can reach you.

3. Trials and the free plan

• A trial lasts 15 days unless we agree a different length with you. No payment card is needed, and a trial doesn't turn into a paid plan by itself.
• Desk: if a trial ends without moving to a paid plan, the workspace locks. Nobody in it can sign in, and Desk stops bringing in new email, running automations and Sift, and sending actions to computers. Remote sessions end within about a minute; anything already running on a computer may finish. Your data is kept. Once you've arranged payment, we switch your plan on and access returns. Email that arrived more than 7 days before your workspace unlocks isn't brought in, but it stays in your own mailbox.
• Watch: when a trial ends unpaid, the workspace moves to the free plan, which covers 15 devices. For now, devices you already have beyond 15 keep being monitored, but you can't add more until you're under 15. The free plan has no time limit, but we may change or end it on 30 days' notice.
• We may extend a trial, or end one early if we reasonably believe it's being misused. Trials and the free plan come with the reasonable care and skill in section 13, but no other commitment about availability or support.

4. Fees and payment

• You pay per device, per month, at the prices on our pricing page when you move to a paid plan, or as agreed in an order. Prices are in pounds sterling and exclude VAT, which we add where it applies.
• In Desk, a device is a computer or server running the Corsift agent. In Watch, a device is anything Watch checks directly, such as a server, switch, firewall, host or cloud account.
• We invoice monthly in arrears, for each calendar month. Each charge is based on the most devices in your workspace at any time in that month: devices only in Desk at the Desk price, devices in both at the combined price, and devices only in Watch at the Watch price, with the first 15 of those free. Desk has a minimum charge of 20 devices a month. For the month you start or stop paying, we charge only for the days you were on a paid plan.
• Invoices are due within 30 days. If one is still unpaid 14 days after its due date and after we've sent you a reminder, we may suspend the service until it's paid. Suspension doesn't remove the amount owed.
• We may change our prices for the future on at least 30 days' notice. Section 14 explains how you can leave before a change applies to you.
• We correct billing mistakes. Otherwise we give refunds only where the law requires or an order says so.

5. The Corsift agent

To manage a computer with Corsift Desk you install the Corsift agent on it. The agent runs with full administrative rights on that computer: on Windows as SYSTEM, and on Mac and Linux as root. Through Corsift Desk, anyone in your workspace who has been given the right permission can then:

• see and control the screen;
• open a command line or PowerShell with full administrative rights;
• upload, download and change files;
• see running programs, and start, stop or restart services;
• run scripts, and install, update or remove software;
• change security and update settings;
• store and reveal disk-encryption recovery keys and the local administrator password;
• on supported Windows PCs, reset Windows and rebuild the PC, erasing what was on it.

These are the same powers an IT administrator has. Used wrongly they can do serious harm, so the rules below apply to everyone, including during a free trial.

Install it only where you're allowed to

You may install the agent only on computers that you own, or that you're authorised to manage on the owner's behalf, for example under a contract with your client. For each computer you are responsible for:

• having a lawful reason to manage and, where it applies, monitor it;
• telling the people who use it, as the law requires, that it's managed and what that means;
• deciding who in your workspace gets which permissions, and setting each company's session notice policy: whether the person at the computer is asked, told, or not told before someone connects.

Keep agent install links private. An install link lets whoever has it add a computer to your workspace.

When the agent stops

You can remove the agent from a computer at any time. While a Desk workspace is locked, no actions are sent to its computers. When your workspace ends, we stop sending actions to its computers, end remote sessions, withdraw your install links and tell you how to remove the agent. Until you remove it, the agent may keep contacting our device server, but we won't act on that computer.

6. Acceptable use

You must not use Corsift, or let anyone else use it, to:

• get into any computer, account or data without permission from the person entitled to give it;
• install the agent on a computer without the owner's knowledge or consent;
• trick anyone into installing the agent, for example by pretending to be their IT support, their bank or another company;
• watch, record or track people in a way the law doesn't allow;
• spread malware, ransomware or anything else designed to cause harm;
• send spam, or email anyone in breach of the law;
• store or send anything unlawful, or anything that infringes someone else's rights;
• give or sell access to Corsift, the agent or your install links to anyone outside your organisation and the clients you manage;
• probe, overload or try to get around the security or limits of Corsift, or copy, reverse engineer or resell the service, except where the law allows it;
• break any law, including the Computer Misuse Act 1990 and data protection law.

We keep an audit log in your workspace of remote sessions and actions on computers: who did what, on which computer, and when. Remote sessions aren't recorded; session recording is switched off. If we reasonably believe Corsift or the agent is being misused, we may suspend your workspace, withdraw install links and stop acting on your computers straight away. Where we can, we'll tell you why and give you the chance to respond, and we'll restore the service once the problem is dealt with. We may also report suspected crime to the police or other authorities.

7. Sift and other AI features

• Sift, Corsift's AI agent, suggests things: how to triage a ticket, a draft reply, a workflow, an explanation. Its suggestions can be wrong. Check them before you rely on them.
• A person accepts each part of a reply Sift has drafted and presses Send: Desk never sends a reply Sift wrote on its own. If you switch on automatic acknowledgements for a mailbox, Desk sends those itself, using the template you set.
• What Sift may do without asking is decided by written rules in our code, not by the AI. Anything it does on its own that can be undone comes with an Undo.
• In Desk, before text reaches an AI model, we replace names, email addresses, phone numbers, user names, device names and anything that looks like a secret with codes, and put the real details back afterwards. This greatly reduces the personal data AI providers see, but no filter can catch everything: an unfamiliar name or sign-in, a short number or date with no label, or something that reads like an ordinary word can occasionally get through. Our security page explains more.
• Watch's AI features use your questions and your monitoring data, including device and resource details, readings, alerts, events and cloud costs, to answer questions, group incidents and produce analyses and briefings. They don't read email or tickets.
• We use AI models only through Corsift's own business accounts with the providers in section 11. Corsift doesn't use your data to train AI models.

8. Services you connect

You can connect your own services to Corsift: for example Microsoft 365 or Gmail mailboxes; Microsoft Entra ID, Intune and Defender; your AWS or Azure accounts for Watch to monitor; HaloPSA; and Slack, Microsoft Teams or your own webhooks for Watch alerts. When you do, you confirm that you're allowed to, and you authorise us to use the access you grant, and only that access, to provide the features you've turned on. Those services remain under their providers' own terms and your agreements with them. We aren't responsible for them, or for changes their providers make. You can disconnect them at any time.

When Desk installs software on a computer, the computer usually downloads the installer directly from the software's publisher, such as Microsoft or Google, so those publishers see the computer's network address.

9. Your data

• Everything you and your clients put into Corsift stays yours: tickets, email, documents, device information, settings. You give us permission to use it only to provide, secure and support the service for you, and as these terms or the law require.
• You are responsible for having the right to put that data into Corsift, and for its accuracy.
• While your workspace is active, and for 30 days after it ends, an Admin can ask us at hello@corsift.com for an export of your workspace. It covers all the data you've put into Corsift, including, in Desk, tickets with their messages and attachments, docs, contacts, companies and devices, and, in Watch, devices, monitoring history, alerts and incidents, plus audit records. Records come as CSV or JSON files and attachments in their original format. We'll provide it within 14 days of the request. Some lists can also be downloaded from inside Corsift.
• We may use anonymous, aggregated information about how Corsift is used (counts and timings that don't identify you, your clients or any person) to run and improve the service.

10. How we process personal data for you

This section is the data processing agreement between us under Article 28 of the UK GDPR. For the personal data in your workspace, you are the controller and we are your processor. If you manage clients' computers or email, you may be their processor and we your sub-processor. Either way, these commitments apply.

• What we process. We process personal data only to provide Corsift as these terms describe. The people concerned are your staff and users; your clients and their staff; people who email you or whom you email through Corsift; people who use the computers you manage; and contacts in your directory. The data includes names, contact details, job and organisation details, the content of email, tickets and documents, sign-in names and directory information, device and network details, and anything else you choose to put in. Corsift isn't designed for special category data, such as health information. If you need to keep it there, you're responsible for deciding that's lawful.
• How long. For as long as you use Corsift, and afterwards only until the data is returned or deleted as set out below.
• Only on your instructions. These terms, your settings and how you use Corsift are your instructions, including where data is transferred (section 11). We'll tell you immediately if we think an instruction breaks data protection law. If the law requires us to process your data for another purpose, we'll tell you before we do, unless the law forbids it.
• Confidentiality. Everyone who can access your personal data on our behalf, including staff and contractors, is bound to keep it confidential.
• Security. We take the measures required by Article 32 of the UK GDPR. They include separate workspaces, encryption of stored credentials, access limited by role and audit logs. Our security page describes them.
• Sub-processors. You authorise the sub-processors in section 11. Before we add or replace one, we'll give you at least 30 days' notice by email. If you object on reasonable data protection grounds and we can't resolve it, you may end the service before the change takes effect. We bind each sub-processor to data protection obligations that protect personal data at least as well as these, and we remain responsible to you for them.
• International transfers. Corsift's own servers and databases are in the European Union (the Netherlands), and Desk's vault is in the United Kingdom. Some sub-processors are based in, or may process data in, the United States. Where personal data leaves the UK, including through OpenRouter to the model providers it uses, we make sure UK data protection law allows it: through UK adequacy regulations, including the UK–US data bridge for certified organisations, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Helping you. We'll help you, by appropriate technical and organisational measures and taking into account what we process, to answer people exercising their data protection rights. We'll also help with security, impact assessments, consultations with the Information Commissioner's Office, and telling the ICO and affected people about a breach. Much of this you can do yourself in Corsift. If a request about your data comes to us directly, we'll pass it to you.
• Breaches. We'll tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and keep you updated as we learn more.
• When the service ends. At your choice we'll return your data, using the export in section 9, and then delete it. We delete your workspace data, including copies in backups, within 90 days after the service ends, unless UK law requires us to keep it. Secrets in Desk's vault are deleted at the same time; Microsoft then removes them permanently within a further 90 days, a safeguard against accidental deletion that can't be shortened.
• Information and audits. We'll make available the information you reasonably need to show these obligations are met, normally by answering written questions. We'll also allow inspections by you or an independent auditor you appoint, on reasonable notice and under confidentiality. Inspections are normally limited to once a year, plus any reasonably needed after a personal data breach, where you have reasonable grounds to think we're not meeting these obligations, or where a regulator requires one.

11. Sub-processors

These providers process personal data for us to provide the services and features listed:

Provider	What they do	Where
Railway Corporation	Hosting for Desk and Watch: application servers, databases, file storage, backups and the device server the agent connects to	European Union (Netherlands)
Clerk, Inc.	Sign-in and organisation accounts	United States
OpenRouter, Inc.	Routes AI requests from Sift and Watch's AI features to the model providers below, or to another host that runs the same models for them, such as Amazon Web Services or Google Cloud	United States
Anthropic (through OpenRouter)	AI models (Claude) behind Sift and Watch's AI features	United States
OpenAI (through OpenRouter)	AI models for Watch's background analysis (automatic incident triage and cloud-cost analysis) once an organisation has used most of its monthly AI allowance	United States
Resend (Plus Five Five, Inc.)	Desk's own email to your staff: invitations, alerts and mentions	United States
Microsoft Corporation (Azure Key Vault)	Encrypted storage of secrets you keep in Desk's vault, such as Wi-Fi and local administrator passwords	United Kingdom

These process personal data only when the feature is available and you use it:

Provider	When	Where
Expo (650 Industries, Inc.), with Apple and Google for delivery	Notifications to the Watch mobile app, once it's available: the phone's notification token, device names and alert text	United States
Twilio Inc.	Watch's SMS and voice paging, once it's available to you: phone numbers and alert text	United States

The services you connect in section 8 aren't our sub-processors: data passes between Corsift and them under your own agreements with their providers. Watch's email alerts aren't switched on yet; before they are, we'll name the email provider here and give you notice as described in section 10.

12. Security

We work to keep Corsift and your data secure, as our security page describes. You're responsible for the security of your own systems and computers, your sign-in details and install links, and for how your people use the access you give them. Tell us straight away at hello@corsift.com about any security issue you find.

13. Availability, support and changes to the service

• We provide Corsift, on every plan, with reasonable care and skill. The standard plans have no guaranteed uptime or response time.
• We may carry out maintenance, which can occasionally interrupt the service. Where we can, we'll do it at quiet times and give notice.
• We may suspend the service, or part of it, if we need to for security, to stop unlawful use or misuse (section 6), because an invoice is overdue (section 4), or to protect other customers. We'll keep a suspension no wider and no longer than necessary. Where it's practical, we'll tell you first and help you get back up and running.
• Corsift keeps improving, so features change. If we remove a feature that's an important part of what you pay for, we'll tell you at least 30 days before.
• Support is by email at hello@corsift.com.

14. Ending the service

• Plans run month to month. You can end the service at any time by emailing hello@corsift.com from an Admin's address. It ends at the end of the month you ask in, unless you ask for a later date.
• If you end the service because of a change we've told you about (to prices, to these terms, to our sub-processors or by removing a feature), you can choose an end date before the change takes effect, and the change won't apply to you.
• We can end the service on 30 days' notice. We can end it straight away if you seriously or repeatedly break these terms (including section 5 or 6), leave an invoice unpaid 14 days after its due date and after a reminder (section 4), or become insolvent.
• When the service ends, your access stops. Section 9 covers getting your data out, section 5 covers the agent, and section 10 covers deletion. Anything owed before the end is still owed, and the sections that by their nature should continue, including 9, 10, 15, 16 and 17, continue.

15. Our intellectual property, and confidentiality

• We, or our licensors, own Corsift: the software, the agent, the scripts we provide, and our designs and documentation. We give you a non-exclusive right to use Corsift for your business while your service lasts. Nothing in these terms transfers ownership of it to you.
• If you send us ideas or feedback, we may use them without owing you anything.
• Each of us will keep the other's confidential information confidential, and use it only for this agreement. This doesn't cover information that is public, was already known, or must be disclosed by law.

16. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that can't lawfully be limited.
• Apart from that, neither of us is liable to the other for indirect or consequential loss, or for loss of profits, revenue, business opportunity or goodwill.
• Apart from that, each party's total liability for all claims under or in connection with these terms, taken together, is limited to the fees paid or payable for Desk and Watch in the 12 months before the event that gives rise to the first claim, or £100 if that is more. This limit doesn't apply to your obligation to pay fees properly due, or to your liability under the indemnity below.
• Actions people in your workspace take on computers through Corsift, such as erasing a computer, running a script, or approving a step Sift suggested, are your actions, and you're responsible for choosing to take them. This doesn't excuse us if the loss is caused by our own breach of these terms or our negligence.
• Indemnity. You'll compensate us for losses, damages, reasonable costs and, so far as the law allows, fines that we suffer because of a claim by someone else arising from you or your people installing or using the agent on a computer without authority, or using Corsift unlawfully. This doesn't apply to the extent the claim is caused by our own breach or negligence. We'll tell you promptly about the claim, let you lead the defence, not settle it without your agreement (which you won't unreasonably refuse), and take reasonable steps to limit the loss.

17. General

• Events outside our control. Neither of us is responsible for delay or failure caused by events beyond reasonable control, such as a failure of a hosting or internet provider, as long as we take reasonable steps to limit the effects. Paying fees isn't excused this way.
• Changes to these terms. We may update these terms. We'll email you at least 30 days before a change that materially affects you, and section 14 explains how you can leave before it applies. The date at the top always shows the current version.
• Notices. We'll send notices to the email address of your workspace's Admins. Send yours to hello@corsift.com.
• Transfer. You may not transfer this agreement without our written agreement. We may transfer it to a company that takes over Corsift, and we'll tell you if we do.
• The whole agreement. This agreement replaces anything we said or agreed before about its subject. Neither of us relies on anything not set out in it, but this doesn't limit liability for fraud.
• Third parties. Nobody else has rights under this agreement, including under the Contracts (Rights of Third Parties) Act 1999.
• If part doesn't apply. If a court decides part of these terms can't be enforced, the rest still applies.
• Law and courts. English law applies, and the courts of England and Wales have exclusive jurisdiction.