Keeper Security

Change Summary

AI Model Training and Customer Data

• Customer Data is expressly classified as Customer Confidential Information. This includes vault records and data provided by the customer or its users.
• The SaaS Terms now restrict either party from making Confidential Information available to generative AI tools, large language models, or other AI systems, unless:
• used solely for internal purposes;
• in a secure, access-controlled environment; and
• the use does not result in AI model training or unauthorized retention, disclosure, or use.
• The same restriction appears in the Partner Terms. Partners may not provide Keeper Confidential Information to AI tools except under the same limited conditions.
• No affirmative right to train AI models on Customer Data is granted. The terms instead permit Keeper to collect, use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the services, provided it does not include Customer Data or identify the customer or users.
• A potential ambiguity remains in the Partner Terms, which state that the partner authorizes Keeper to process “training data” through third-party providers. This could refer to training or educational data rather than AI training, but it should be clarified because it may create uncertainty about what data can be processed and for what purpose.
• Website communications and feedback receive weaker protection: submissions are stated to be non-confidential, and feedback becomes Keeper’s sole property. The website terms do not expressly prohibit AI training on such submissions. Customers should avoid submitting confidential information through website forms, chat or email.

Data Protection and Privacy

• Keeper’s Privacy Policy and Data Processing Addendum are incorporated into the SaaS and Partner Terms.
• Keeper states that it generally cannot access encrypted vault contents under its zero-knowledge architecture.
• For business accounts, Keeper acts primarily as a processor, while it acts as an independent controller for account registration, billing, technical analytics, support communications, website interactions and partner-program information.
• Administrators may access or process business-user information, including insights derived from users’ interactions with the services.
• Keeper may use vendors for support, analytics, payment processing and related services, and may transfer personal data internationally using the Data Privacy Framework, SCCs or other mechanisms.

Commercial and Operational Risks

• Annual fees are generally nonrefundable, payable in advance, and may increase at renewal.
• Keeper may suspend access for payment failures or customer breaches, including privacy, security, export-control or authorization violations.
• The service-level remedy is limited: the customer’s sole remedy for an SLA breach is termination, with a 99.9% API availability target and stated RTO/RPO of 8/24 hours.
• Liability is generally capped at fees paid in the prior 12 months, or twice that amount for indemnification obligations, with broad exclusions for consequential damages.
• U.S. customers are subject to mandatory Delaware arbitration, subject to limited exceptions.
• Partner-program terms, pricing, channel rules and portal materials may be updated, and continued participation constitutes acceptance. Partners also bear significant responsibility for downstream customer compliance and data protection.

Structured Summary of Important Changes and Risks

1. AI Model Use and Training

SaaS Terms

• A new confidentiality restriction addresses artificial intelligence tools, including generative AI and large language models.
• Neither party may make the other party’s Confidential Information available to AI tools unless:
• the use is solely for the receiving party’s internal purposes;
• the AI environment is secure and access-controlled; and
• the use does not result in AI model training or unauthorized retention, disclosure, or use.
• Effect: This is a meaningful contractual prohibition against using the other party’s confidential information—including Customer Data, which is expressly classified as Customer Confidential Information—to train AI models.
• Risk/limitation: The clause applies to “Confidential Information,” but its interaction with aggregated, anonymized usage and telemetry data is not entirely clear. Keeper separately reserves the right to collect, use, and analyze aggregated anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services. Customers should seek confirmation that their data will not be used to train models, even in de-identified or aggregated form, unless expressly authorized.

Partner Terms

• A similar restriction prohibits Partners from making Keeper Confidential Information available to AI tools except in a secure, access-controlled environment that does not involve AI model training or unauthorized retention or disclosure.
• Risk: The restriction protects Keeper’s information but does not clearly provide an equivalent, express promise concerning Partner or End Customer data handled through the Partner arrangement.
• The Partner Terms also state that the Partner has the necessary rights to authorize “the processing of training data” by third-party providers. This phrase is ambiguous and could refer to data used for training, even though it does not expressly authorize model training. It should be clarified, particularly regarding whether any customer or end-user data may be used to train provider models.

Privacy Policy

• The Privacy Policy describes analytics, service improvement, automated chat, marketing, and third-party service-provider processing.
• It does not expressly state that personal information or Customer Data will never be used to train AI models.
• For business customers, Keeper states it acts primarily as a processor and processes Customer Data according to contractual instructions. The SaaS AI restriction provides stronger protection than the Privacy Policy itself.

2. Data Protection and Zero-Knowledge Claims

• Customer Data expressly includes vault records and is treated as Customer Confidential Information.
• Keeper states that it cannot access encrypted vault contents, master passwords, or encryption keys.
• Keeper may independently process account, billing, support, technical, usage, telemetry, and website data as a controller.
• Business administrators may access and process user account information and usage-derived insights.
• The DPA and Privacy Policy are incorporated, with the DPA taking priority over the SaaS Terms in a conflict.

3. Website and Communications

• Website submissions are expressly non-confidential.
• Keeper may retain, monitor, or remove communications as permitted by law.
• Feedback about Keeper products becomes Keeper’s sole property.
• Automated chat, live chat, forms, and email submissions are governed by the Website Terms and Privacy Policy, creating potential data-use and confidentiality concerns for sensitive submissions.

4. Commercial and Liability Changes

• Fees are generally nonrefundable and may be automatically charged on a recurring basis.
• Liability is generally capped at fees paid during the preceding 12 months, with limited exceptions.
• Customer’s sole remedy for service-level failures is termination.
• Keeper may update Partner Portal terms and program requirements, potentially changing commercial obligations during participation.

5. Key Recommended Clarifications

• Confirm in writing that Customer Data, personal data, vault records, prompts, support communications, and telemetry will not be used for AI model training without express customer consent.
• Clarify the meaning of “training data” in the Partner Terms.
• Confirm whether anonymized or aggregated data may be used to train internal or third-party models.
• Review the DPA, Privacy Policy, and incorporated policies together for consistency.

Summary

Scope of the Change

• The diff indicates that approximately 15,240 words were removed from the document.
• No replacement language or specific deleted provisions is provided.

Key Legal Implications

• A deletion of this size may remove important provisions relating to:
• Customer and vendor obligations
• Data ownership and licensing
• Confidentiality and security
• Privacy and regulatory compliance
• Liability limits and indemnities
• Service levels, termination, and dispute resolution
• Intellectual-property rights
• Without the text of the deleted provisions, it is not possible to determine whether the changes are favorable or unfavorable, or whether they create gaps, inconsistencies, or unintended obligations.

Customer Data and AI Training

• The supplied diff does not identify which provisions were removed, so it is impossible to confirm whether language concerning the use of customer data to train AI models was deleted or modified.
• Important issues that should be checked in the removed text include whether the agreement:
• Permitted or prohibited using customer data, prompts, outputs, or usage data to train, fine-tune, or improve AI models;
• Required customer consent or allowed use by default;
• Restricted use to aggregated, anonymized, or de-identified data;
• Allowed human review or provider access to customer content;
• Gave the provider rights to retain data after termination;
• Applied different rules to consumer, personal, confidential, or regulated data; and
• Required deletion, opt-out mechanisms, security controls, or transparency regarding AI training.

Risk Assessment

• The principal risk is loss of contractual protections or clarity, particularly if the deleted provisions addressed data use, confidentiality, intellectual property, or liability.
• If AI-training restrictions were removed without replacement, the customer may have fewer contractual limits on the provider’s use of customer data.
• Conversely, if broad provider rights were removed, the provider may no longer have an express contractual basis for certain data uses.

Information Needed

To conduct a reliable legal analysis, the actual deleted and replacement language—or at least the sections concerning data use, AI training, privacy, confidentiality, intellectual property, and security—is required.

Summary of Changes

Overall Change

• The diff states that approximately 15,240 words were removed from the document.
• No replacement language or specific deleted provisions are provided.
• Because the actual deleted text is not included, it is not possible to determine precisely which legal rights, obligations, limitations, or protections were removed.

Customer Data and AI Training

• The supplied diff does not identify whether any provisions concerning AI, machine learning, model training, or use of customer data were added, removed, or changed.
• However, a deletion of this size could potentially remove important terms addressing:
• Whether customer data may be used to train or improve AI models;
• Whether customer prompts, outputs, files, or usage data may be retained;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether the provider may use customer data for product development or service improvement;
• Opt-out rights or restrictions on AI training;
• Ownership and licensing of customer data and AI-generated outputs;
• Confidentiality, security, and data-protection obligations;
• Restrictions on using regulated, personal, or sensitive information.

Potential Legal Risks

• Loss of protections: Deleted language may have limited the provider’s rights to access, use, disclose, or commercialize customer data.
• Ambiguity: If the deleted provisions were not replaced, the remaining agreement may lack clear rules governing data use and AI training.
• Expanded practical rights: Other provisions may now govern by default and could permit broader use of data than before.
• Reduced remedies or safeguards: Deleted terms may have included warranties, audit rights, indemnities, liability protections, deletion obligations, or breach-notification requirements.
• Changed commercial balance: The deletion may remove customer-favorable terms without making the resulting changes obvious from the shortened agreement.

Recommended Review

The removed text should be compared with the complete revised agreement, particularly sections concerning:

1. Customer data and confidentiality;

2. Data processing and privacy;

3. Artificial intelligence or machine learning;

4. Intellectual property and licensing;

5. Security and retention;

6. Liability, indemnification, and termination.

A definitive assessment of AI-training rights requires the actual deleted and remaining language.

Summary of Changes

Overall Change

• Approximately 15,240 words have been removed from the document.
• No replacement or newly added language is provided.
• Because the deleted text is not shown, the specific legal and commercial effects cannot be determined from this diff alone.

Key Legal Risks

Loss of Customer Protections

The deleted material may have contained provisions addressing:

• Confidentiality and permitted uses of customer data
• Data security and breach-notification obligations
• Ownership of customer data and intellectual property
• Service warranties, indemnities, and liability limitations
• Audit, compliance, or regulatory requirements
• Termination, data return, and deletion obligations
• Restrictions on subcontractors or third-party providers

Removing these provisions could materially reduce the customer’s contractual protections, depending on whether they were replaced elsewhere.

AI Training and Model Development

The diff does not identify whether customer data may be used to train, fine-tune, test, evaluate, or improve AI models.

In particular, it is impossible to determine whether the removed text:

• Prohibited or permitted training on customer data
• Required the customer’s consent before training
• Limited training to de-identified, aggregated, or anonymized data
• Allowed use of customer prompts, inputs, outputs, or usage data
• Granted the provider rights to retain data for model improvement
• Addressed ownership of models, derived data, or generated outputs
• Required deletion or exclusion of customer data from training datasets
• Applied different rules to consumer, business, or enterprise customers

If the deleted provisions contained restrictions on AI training, their removal could expand the provider’s ability to use customer data. Conversely, the deletion could remove a previously broad permission and therefore reduce that ability. The direction of the change cannot be established without the original and revised text.

Recommended Review

Obtain:

1. The full pre-change document;

2. The full post-change document; and

3. A redline showing the deleted language or a list of affected sections.

Particular attention should be given to definitions of “Customer Data,” “Usage Data,” “Content,” “Confidential Information,” “Service Improvement,” “Artificial Intelligence,” and “Training.” Until those provisions are reviewed, the impact on data use and AI model training should be treated as materially uncertain.

Summary of the Change

Overall Change

• The diff states that approximately 15,240 words were removed from the document.
• No replacement text or details of the deleted provisions are provided.
• Because the deleted language is not shown, the specific legal and operational effects cannot be determined reliably.

Key Risks

Loss of Customer Protections

The deleted material may have contained provisions addressing:

• Confidentiality and permitted uses of customer data
• Data security and breach-notification obligations
• Data retention and deletion
• Ownership of customer data and work product
• Service levels, warranties, and indemnities
• Liability limitations and remedies
• Audit, compliance, or regulatory requirements
• Termination and post-termination obligations

Removing these provisions could materially reduce the customer’s contractual protections or create uncertainty about the parties’ rights and obligations.

AI Training and Model Development

The provided diff does not identify whether any language concerning AI training has been added, removed, or modified.

In particular, it is not possible to determine whether the deleted provisions:

• Prohibited or permitted using customer data to train AI or machine-learning models
• Required customer consent before training
• Limited training to de-identified, aggregated, or anonymized data
• Allowed use of customer prompts, inputs, outputs, or usage data for model improvement
• Addressed ownership of model weights, outputs, or improvements
• Required deletion or exclusion of customer data from training datasets
• Applied confidentiality, security, or opt-out rights to AI-related processing

If the removed text contained restrictions on AI training or secondary data use, its deletion could significantly expand the provider’s ability to use customer data. Conversely, the deletion might remove a provider permission or disclosure, but the available diff does not establish which.

Recommended Review

Obtain the full “before” and “after” versions, or at least the text of the approximately 15,240 deleted words. The review should specifically search for:

• “train,” “training,” “machine learning,” “AI,” and “model”
• “improve,” “develop,” or “fine-tune”
• “customer data,” “inputs,” “outputs,” and “usage data”
• “de-identified,” “aggregated,” or “anonymized”
• Consent, opt-out, deletion, confidentiality, and data-use provisions

Until that comparison is available, the principal conclusion is that the document may have undergone a substantial and potentially material reduction in customer protections, but no specific AI-training change can be confirmed.

Summary of Available Change

The supplied diff states only:

> [Removed approximately 15,240 words from the document]

No replacement text or details of the deleted provisions are included.

Key Legal Implications

• Scope of deletion is unclear: It is impossible to determine which rights, obligations, warranties, limitations, or protections were removed.
• Potential material risk: Deleting approximately 15,240 words could substantially change the agreement, including provisions relating to:
• Data ownership and permitted use
• Confidentiality and security
• Intellectual-property rights
• Liability limits and indemnities
• Termination and data deletion
• Regulatory compliance
• Audit or transparency rights
• Service levels and customer remedies
• AI-training provisions cannot be assessed: The available diff does not show whether the contract now:
• Permits or prohibits using customer data to train, fine-tune, evaluate, or improve AI models
• Permits use of customer prompts, outputs, files, metadata, or derived data
• Applies different rules to personal data or confidential information
• Requires customer consent or provides an opt-out
• Allows human review or sharing with model providers
• Requires deletion of training data or restricts retention
• Grants the provider rights to use aggregated, de-identified, or anonymized data
• Gives the customer ownership, control, audit, or transparency rights concerning trained models

Risk Assessment

High uncertainty / potentially high risk. The deletion may remove customer protections or may simply reflect removal of unrelated material. No reliable conclusion can be reached without the text that was deleted and any replacement provisions.

Information Needed

To perform a meaningful legal analysis, provide either:

1. The full redline showing the deleted and added text; or

2. The prior and revised versions of the agreement, especially provisions concerning:

• Customer data
• AI or machine learning
• Service improvement
• Confidentiality
• Intellectual property
• Data retention and deletion
• Subprocessors and third-party model providers

Until that comparison is available, the contract should not be treated as confirming that customer data is protected from AI-model training.

Summary of Changes

Scope of the Diff

The diff only states that approximately 15,240 words were removed from the document. It does not identify:

• Which clauses were deleted
• Whether any provisions were replaced
• The subject matter of the removed text
• Whether the deletions affect customer data, confidentiality, security, intellectual property, or AI training

Key Legal Risks

Material Terms May Have Been Deleted

A removal of this size could eliminate important contractual protections or obligations, including:

• Data-use restrictions
• Confidentiality obligations
• Security and breach-notification requirements
• Intellectual-property ownership and licensing terms
• Data retention and deletion requirements
• Audit, compliance, or regulatory provisions
• Liability limitations, indemnities, or termination rights
• Service-level commitments and customer remedies

Without the deleted text, it is not possible to determine whether the changes favor the customer or the provider.

AI Training and Model Development

The provided diff contains no identifiable language concerning AI, machine learning, model training, model improvement, prompts, inputs, outputs, or customer data.

Accordingly, it is not possible to determine whether the revised document:

• Permits or prohibits using customer data to train AI models
• Allows use of customer data to improve products or services
• Uses customer data for aggregated, de-identified, or anonymized training
• Permits human review of customer content for model development
• Gives the customer an opt-out right
• Requires deletion of customer data from training datasets or model-development systems
• Distinguishes between customer content, metadata, usage data, and model outputs

Overall Assessment

The diff is insufficient for substantive legal analysis. The only confirmed change is a large-scale deletion of approximately 15,240 words. That deletion itself creates a significant review risk because material protections may have been removed, but no specific conclusion can be drawn about the legal effect.

To assess the changes—particularly AI-training rights—the deleted text and any surrounding replacement language should be provided, preferably as a clause-level redline or the before-and-after versions of the agreement.

Summary of the Document Change

High-Level Change

• Approximately 15,240 words have been removed from the document.
• No replacement language or specific deleted provisions were provided.
• Because the actual deleted text is unavailable, the legal and commercial impact cannot be determined reliably.

Potential Legal Risks

The removed material may have included important provisions concerning:

• Customer obligations and restrictions
• Provider rights to use or disclose information
• Confidentiality and data protection
• Intellectual property ownership and licenses
• Security commitments and breach notification
• Service levels, warranties, and disclaimers
• Indemnification and limitation of liability
• Termination rights and post-termination obligations
• Governing law and dispute resolution

The deletion of a large volume of text could materially change the allocation of risk, even if the remaining document appears unchanged. In particular, provisions limiting the provider’s liability or granting it broad rights may have been removed—or, conversely, customer protections may have been deleted.

AI Training and Customer Data

• The supplied diff does not identify whether any AI-related provisions were added, removed, or amended.
• It is therefore impossible to determine from this diff whether the provider:
• May use customer data, prompts, outputs, or usage information to train or improve AI models;
• Must obtain customer consent before such use;
• May use data only in de-identified or aggregated form;
• May permit third-party model providers to access customer data;
• Must delete or segregate customer data from training datasets; or
• Grants the customer ownership or control over AI-generated outputs.

Recommended Review

The full before-and-after versions should be compared, rather than relying on the summary “[Removed approximately 15,240 words].” Particular attention should be given to searches for:

• “train,” “training,” “improve,” “fine-tune,” or “machine learning”
• “artificial intelligence,” “AI,” “models,” or “generative AI”
• “customer data,” “content,” “prompts,” and “outputs”
• “de-identified,” “aggregated,” “anonymized,” or “usage data”
• “service providers,” “subprocessors,” and “third parties”

Until the deleted language is reviewed, the customer should assume that important rights, restrictions, or protections may have changed and should not approve the amendment based solely on this diff.

Summary of Changes

Scope of the Diff

• The diff states only: “Removed approximately 15,240 words from the document.”
• No replacement text or specific deleted clauses are provided.
• As a result, it is not possible to determine which contractual rights, obligations, limitations, or protections were removed.

AI Training and Customer Data

• The available diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• It is therefore impossible to confirm whether:
• Customer data may be used for model training;
• prompts, inputs, outputs, or usage metadata may be retained;
• data may be shared with affiliates, vendors, or model providers;
• data may be aggregated, anonymized, or de-identified for training;
• customers can opt out of training or require deletion; or
• confidentiality and data-protection restrictions continue to apply to AI-related processing.
• If provisions addressing these topics were among the deleted 15,240 words, their removal could materially change the customer’s risk exposure.

Potential Legal Risks

The deletion may have removed important protections or limitations concerning:

• Data ownership and permitted use
• Confidentiality and security obligations
• Privacy-law compliance and data-processing roles
• Subprocessors and third-party AI providers
• Data retention and deletion
• Intellectual-property rights in inputs and outputs
• Indemnities and liability caps
• Audit, suspension, and termination rights
• Service-level commitments and warranties
• Restrictions on unilateral changes to the agreement

A deletion of restrictions on AI training could allow broader use of customer data without a clear consent requirement, opt-out mechanism, purpose limitation, or deletion commitment. Conversely, deletion of a provider’s right to use data could reduce the provider’s ability to improve its services.

Conclusion

The supplied diff is insufficient for a substantive legal comparison. It shows a large deletion but does not reveal what was removed. The deleted version and the revised document—or a line-by-line redline—are needed to assess changes, particularly those involving customer-data use for AI training.

Change Summary

1. AI model use and training

New restrictions on AI use of confidential information

The SaaS Terms add an express restriction stating that neither party may make the other party’s Confidential Information available to artificial intelligence tools—including generative AI and large language models—except for internal use in a secure, access-controlled environment that does not result in:

• AI model training;
• unauthorized retention;
• unauthorized disclosure; or
• unauthorized use.

The Partner Terms contain a similar restriction applicable to Partner’s Confidential Information.

Risk/impact: This is a meaningful protection against using customer or Keeper confidential information to train external or public AI models. However, the provision applies to “Confidential Information,” not expressly to all Customer Data or personal data. Its effectiveness therefore depends on Customer Data qualifying as confidential—which the SaaS Terms expressly state—or on the DPA and Privacy Policy providing additional protection.

No express authorization to train models on vault data

The SaaS Terms state that Keeper may collect, use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the Services, provided that it:

• does not include Customer Data; and
• does not permit identification of Customer or Authorized End Users.

This language does not authorize Keeper to use Customer Data, vault records or identifiable user data to train AI models. It also appears to exclude encrypted vault contents from the permitted analytics use.

Residual risk: “Aggregated anonymized” is not defined in detail, and the provision permits broad use of telemetry and operational data for improving the Services. Customers may wish to confirm that prompts, support content, chat transcripts, usage-derived insights and model inputs are treated as Customer Data and are excluded from training.

Partner “training data” provision

The Partner Terms state that Partner authorizes Keeper to engage third parties for support and supplemental services and confirms it has rights to authorize “the processing of training data through such providers.”

Risk: “Training data” is undefined and could be interpreted as data used for personnel or service training, or potentially AI training. This wording creates ambiguity and should be clarified expressly to state whether it includes or excludes AI model training and whether End Customer data may be used.

2. Privacy and data governance changes

• Keeper describes itself as a processor for business customers and an independent controller for account, billing, support, website and service-usage analytics.
• Business administrators may access data, including insights derived from users’ interactions with the Services.
• Privacy language permits automated chat tools to record requests, suggest content and assist responses.
• The Privacy Policy does not expressly state that personal data or support communications will never be used for AI training.

3. Other important changes

• Customer Data expressly includes Authorized End Users’ vault records and is classified as Customer Confidential Information.
• The DPA and Privacy Policy are incorporated into the SaaS Terms, with the DPA taking priority over the main Terms.
• Partner obligations and portal terms may be updated periodically, with continued participation constituting acceptance.
• Customer liability remains subject to significant exclusions and a cap generally limited to fees paid in the prior 12 months.

Change Summary

Key AI and Data-Use Changes

• New restrictions on AI use of confidential information. The SaaS Terms now state that neither party may make the other party’s Confidential Information available to artificial intelligence tools—including generative AI and large language models—unless:
• the use is solely for the receiving party’s internal purposes;
• the AI environment is secure and access-controlled; and
• the information is not used for model training or unauthorized retention, disclosure, or use.

• Similar restriction added to Partner Terms. Partners are subject to the same AI-use prohibition. This is important because partner personnel, resellers, and downstream parties may handle Keeper or customer information.

• Potentially broad “training data” authorization for partners. The Partner Terms state that a partner authorizes Keeper to use third parties to administer, manage, support, and deliver supplemental services, and confirms that it has the rights to authorize “the processing of training data through such providers.” This wording is not clearly limited to AI training and could create uncertainty about:
• what constitutes “training data”;
• whether customer or end-user information may be included;
• which third-party providers may process it; and
• whether the partner has actually obtained the necessary consents.

• Customer Data expressly excluded from analytics use. Keeper may collect, use, and analyze aggregated, anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services, but the provision says this data must not include Customer Data or permit identification of the Customer or its users. This is a helpful limitation, although the effectiveness depends on the anonymization and aggregation process.

• No express authorization to train AI models on vault data. The terms emphasize Keeper’s zero-knowledge architecture and state that Keeper cannot access encrypted vault contents. The revised provisions do not expressly grant Keeper a right to train models on Customer Data or vault records. The AI restriction also affirmatively prohibits model training using Confidential Information.

Other Important Changes and Risks

• Website submissions are nonconfidential. Communications and submissions to Keeper—including chats, forms, emails, and feedback—are stated not to be confidential. Keeper may retain, monitor, or remove communications as permitted by law. Feedback becomes Keeper’s sole property. Do not submit sensitive information unless necessary.

• Broader privacy-policy incorporation. The Privacy Policy and DPA are incorporated into the SaaS and Partner Terms, and the Privacy Policy may be updated over time. Customers and partners should monitor incorporated online documents for changes.

• Business-account administrator access. Administrators may access and process business-account information, including insights derived from users’ interactions with the Services. Employees should not assume that all account-related usage information is private from their employer.

• Partner compliance burden increased. Partners must obtain required notices and consents, provide transaction and reseller information, ensure downstream contractual protections, and remain responsible for data-protection compliance when acting as a controller or processor.

• Operational and commercial risks remain significant. Fees are generally nonrefundable, service remedies are limited largely to termination, liability is capped (generally at fees paid in the prior 12 months), and Keeper may suspend access for specified breaches or nonpayment.

Summary

Scope of the Change

• The diff only states: “Removed approximately 15,240 words from the document.”
• The actual deleted language is not provided.
• No additions, replacements, or specific clause text are available for review.

Legal and Commercial Risks

• A deletion of this size may materially change the agreement, including:
• Customer data ownership and usage rights
• Confidentiality and security obligations
• Data retention and deletion requirements
• Service warranties, indemnities, and liability limits
• Compliance obligations
• Termination and post-termination obligations
• Subcontractor or third-party rights
• Audit and transparency rights
• Without the removed text, it is not possible to determine whether protections were eliminated, narrowed, or merely consolidated elsewhere.
• The deletion itself should be treated as a material change requiring comparison against the prior full document, rather than assumed to be administrative.

AI Training and Model-Use Provisions

• The supplied diff contains no identifiable language concerning artificial intelligence, machine learning, model training, model improvement, prompts, inputs, outputs, or customer data.
• Accordingly, it is not possible to determine whether the revised document:
• Permits or prohibits using customer data to train AI models
• Allows use of customer data to improve products or services
• Permits retention of prompts, inputs, outputs, or derived data
• Allows human review or labeling of customer data
• Applies data-use rights to de-identified, aggregated, or pseudonymized data
• Gives the provider rights to use customer data after termination
• Separates “customer content” from telemetry, usage data, or metadata

Recommended Action

• Obtain the complete before-and-after versions, or at least the 15,240 deleted words.
• Specifically search the revised document for terms such as “train,” “training,” “machine learning,” “AI,” “model,” “improve,” “customer data,” “content,” “inputs,” “outputs,” “aggregated,” “de-identified,” “usage data,” and “service improvement.”
• Until that comparison is completed, assume there may be an unresolved risk that customer-data protections or restrictions on AI training were removed.

Summary of Important Changes and Risks

1. New or Expanded AI-Use Restrictions

SaaS Terms

The confidentiality section now expressly regulates the use of confidential information with artificial-intelligence tools, including generative AI and large language models. Neither party may make the other party’s confidential information available to AI tools unless:

• The use is solely for the receiving party’s internal purposes;
• The AI environment is secure and access-controlled; and
• The information is not used for model training or unauthorized retention, disclosure, or use.

Effect: Customer data and other confidential information may not be submitted to third-party AI tools for general-purpose processing or training. The provision does not expressly authorize Keeper to train models using Customer Data.

Partner Terms

A similar restriction applies to Partner confidential information. Partners may use AI only internally in a secure, access-controlled environment, and only where the use does not result in AI model training or unauthorized retention or disclosure.

However, the Partner Terms also state that the Partner authorizes Keeper to engage third parties and confirms that it has the necessary rights to authorize the processing of “training data” through those providers.

Risk: “Training data” is not defined. This wording could create uncertainty about whether certain Partner or downstream-customer data may be processed by service providers for training-related purposes. Partners should seek clarification and ensure their customer contracts expressly permit any such processing.

2. Customer Data and Analytics

The SaaS Terms define Customer Data broadly to include data provided by the Customer or its users, including vault records, and classify it as Customer Confidential Information.

Keeper may collect, use, and analyze aggregated, anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services, provided that it does not include Customer Data or identify the Customer or its users.

Risk: Although the language excludes Customer Data from this permission, the boundaries between “Customer Data,” telemetry, metadata, and anonymized data may be disputed. Customers should confirm that vault contents, prompts, support submissions, usage records, and derived data cannot be used for AI training or product development except as expressly authorized.

3. Privacy Policy Changes

The Privacy Policy distinguishes between:

• Keeper acting as a processor for business customers; and
• Keeper acting as an independent controller for account registration, billing, technical usage analytics, support communications, website interactions, and partner-program information.

Keeper may use limited information with vendors for support, analytics, account security, payment processing, and live chat. It also uses usage and browsing information for marketing and advertising optimization.

Risk: These controller activities may involve profiling, analytics, or automated tools even though Keeper states it does not conduct automated decision-making producing legally significant effects.

4. Business Administrator Access

For business accounts, administrators may access and process user data, including insights derived from how users interact with the Services.

Risk: Employees may have less privacy than expected, particularly concerning usage-derived insights, even though encrypted vault contents remain inaccessible under the zero-knowledge model.

5. Other Material Commercial Risks

• Service-level remedy is limited to termination; no service credits are provided.
• SaaS liability is generally capped at fees paid in the preceding 12 months, with limited exceptions.
• Evaluation versions may not receive the same security reviews or safeguards as production Services.
• Keeper may update Partner Portal terms and program requirements, binding Partners through continued participation.
• Expired paid accounts may have file-containing records deleted after 90 days, subject to notice.

Summary of Available Changes

Scope of the Diff

The diff only states:

> Removed approximately 15,240 words from the document

No replacement text or details of the deleted provisions are provided. As a result, it is not possible to determine which contractual rights, obligations, limitations, or protections were removed.

AI Training and Customer Data

The available diff does not identify whether any provisions concerning AI training or the use of customer data were added, removed, or changed.

However, deleting approximately 15,240 words could potentially remove provisions addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer data is used for service improvement or product development;
• Opt-out or consent requirements for AI training;
• Restrictions on using customer content to train third-party or foundation models;
• Data retention, anonymization, aggregation, or de-identification;
• Ownership of customer inputs, outputs, and derived data;
• Confidentiality and security obligations;
• Deletion or return of customer data;
• Subprocessor or affiliate access to customer data; and
• Indemnities, liability limitations, or remedies relating to data use.

If any of these provisions were deleted without replacement, the customer may have reduced contractual protection and less clarity regarding how its data can be used.

Potential Legal Significance

A bulk deletion of this size may represent:

1. Removal of substantive terms rather than a simple drafting change;

2. Elimination of customer rights or provider obligations;

3. Loss of restrictions on secondary use of data;

4. Removal of warranties, compliance commitments, or remedies; or

5. Accidental deletion or an incomplete export of the revised document.

The commercial effect cannot be assessed reliably without the text that was deleted and the remaining version of the agreement.

Recommended Next Step

Obtain either:

• The full “before” and “after” versions;
• A line-by-line redline; or
• The text of the deleted provisions, particularly sections addressing customer data, artificial intelligence, machine learning, model training, confidentiality, security, retention, and data ownership.

Until then, treat the change as potentially material and do not assume that prior restrictions on AI training or secondary data use remain in effect.

Summary of the Diff

Scope of Change

• The diff states that approximately 15,240 words were removed from the document.
• No replacement language or details of the deleted provisions are provided.
• Because the actual deleted text is unavailable, it is not possible to determine precisely which obligations, rights, limitations, or protections were removed.

Key Legal Risks

• Loss of customer protections: Deleted provisions may have included confidentiality duties, security standards, data-use restrictions, warranties, indemnities, audit rights, service commitments, or liability protections.
• Changed allocation of risk: Removing provisions can shift risk to the customer even if no new language is added. For example, deletion of a warranty or indemnity may leave the customer with fewer remedies.
• Ambiguity and interpretation risk: Large-scale deletions may create inconsistencies with provisions that remain, including undefined terms, incorrect cross-references, or conflicting obligations.
• Reduced transparency: Removing operational or compliance terms may make it harder for the customer to verify how the service is operated or how its information is handled.

AI Training and Customer Data

• The supplied diff does not identify whether any provisions concerning AI training, machine learning, model development, or use of customer data were added, deleted, or modified.
• However, given the size of the deletion, it is important to verify whether the removed text addressed:
• Use of customer data or prompts to train, fine-tune, or improve AI models;
• Whether training is conducted using identifiable, aggregated, de-identified, or anonymized data;
• Opt-in or opt-out rights;
• Restrictions on human review or sharing with model providers;
• Ownership of inputs, outputs, embeddings, or derived data;
• Retention and deletion of data used for training;
• Commitments not to use customer data for general-purpose model improvement; and
• Security, confidentiality, and regulatory compliance obligations relating to AI processing.

Recommended Next Step

The deletion-only description is insufficient for a reliable legal comparison. Obtain the full prior version and revised version, or at least the deleted passages and their surrounding sections. The AI/data-use provisions should be specifically reviewed before acceptance, because deletion of a restriction may permit broader use of customer data even without an express new authorization.

Summary

The diff states only that approximately 15,240 words were removed from the document. It does not identify which clauses, sections, or legal terms were deleted.

Key Legal Implications

• Scope of deletion: The removal may materially change the parties’ rights and obligations, but the affected provisions cannot be determined from the supplied diff.
• Potential risk: Deleted language could have addressed important matters such as:
• Liability limitations and indemnities
• Confidentiality and data-security obligations
• Intellectual-property ownership and licensing
• Termination rights
• Governing law and dispute resolution
• Compliance requirements
• Audit, retention, or deletion obligations

Customer Data and AI Training

• The provided diff contains no identifiable language concerning customer data, artificial intelligence, machine learning, model training, or use of customer content.
• It is therefore impossible to determine whether the revision:
• Permits or prohibits using customer data to train AI models
• Limits training to aggregated, anonymized, or de-identified data
• Requires customer consent or provides an opt-out
• Gives the provider rights to retain or reuse prompts, outputs, or uploaded content
• Allows human review or disclosure of customer data for model improvement
• Applies confidentiality, security, deletion, or ownership protections to training data

Required for Reliable Analysis

A clause-level comparison, showing the actual deleted and added text, is required to assess the legal impact. In particular, the sections addressing data use, AI training, confidentiality, intellectual property, security, retention, and deletion should be reviewed.

Summary of Changes

Scope of the Diff

• The diff indicates that approximately 15,240 words were removed from the document.
• No replacement language or newly added terms are provided.
• Because the deleted text is not shown, it is not possible to determine which provisions were removed or how the remaining agreement changed.

Key Legal Risks

Loss of Important Protections

The deleted material may have included provisions relating to:

• Confidentiality and data security
• Customer ownership of data and intellectual property
• Data retention and deletion
• Privacy obligations and regulatory compliance
• Warranties, indemnities, and limitations of liability
• Audit rights and breach notification
• Termination rights and post-termination obligations
• Service levels and support commitments

Removing such terms could materially reduce the customer’s protections or create uncertainty about the parties’ obligations.

AI Training and Data Use

The provided diff does not identify whether any provisions concerning AI training were added, removed, or changed.

In particular, the available information does not establish whether the agreement now:

• Permits the provider to use customer data, prompts, outputs, or usage information to train or improve AI models
• Limits AI training to de-identified, aggregated, or anonymized data
• Requires customer consent or provides an opt-out
• Prohibits use of customer data for model training
• Grants the provider rights to retain or reuse data after termination
• Addresses ownership of AI-generated outputs or derived models
• Requires human review, security controls, or restrictions on sensitive data

If the deleted text contained a prohibition or limitation on AI training, its removal could significantly expand the provider’s rights. Conversely, if it contained a provider permission to train models, its removal could restrict those rights. The direction of the change cannot be determined from the redacted diff.

Recommended Review

The complete deleted language should be obtained and compared against the current version, with particular attention to:

1. Customer-data ownership and permitted uses

2. AI model training, model improvement, and data-retention rights

3. De-identification and aggregation standards

4. Opt-out, consent, and deletion mechanisms

5. Confidentiality, security, and regulatory compliance

6. Liability allocation for unauthorized data use

Bottom line: This diff shows a potentially material wholesale deletion, but it does not provide enough information to identify the specific legal or AI-data changes.

Executive Summary

The revised terms consolidate and expand Keeper’s website, SaaS, partner, privacy, security, and support provisions. The most significant changes concern confidentiality, artificial intelligence, data governance, partner responsibilities, and liability. Customers should review the incorporated DPA, Privacy Policy, Partner Portal materials, and referenced online policies because these documents may change over time.

AI Training and Use of Data

• Customer Confidential Information and AI tools: The SaaS Terms now expressly prohibit either party from making the other party’s Confidential Information available to artificial intelligence tools—including generative AI and large language models—unless the use is solely internal, occurs in a secure access-controlled environment, and does not result in AI model training or unauthorized retention, disclosure, or use.
• Partner restriction: Partner Terms contain a similar prohibition on using Keeper Confidential Information with AI tools. The clause appears intended to prevent training models on confidential information, but it permits secure internal AI use if no training or unauthorized retention occurs.
• Potential ambiguity: The AI restrictions apply to “Confidential Information,” while the SaaS Terms separately define Customer Data as Customer Confidential Information. This should protect vault-related Customer Data contractually, but the terms do not provide detailed technical standards, audit rights, deletion requirements, or an express prohibition on all model training involving every category of customer-related data.
• Partner training data: The Partner Terms state that the partner authorizes Keeper to process “training data” through third-party providers and represents that it has the necessary rights to do so. “Training data” is not clearly defined and could create uncertainty about whether it includes partner, reseller, employee, or customer information. Partners should seek clarification and confirm that appropriate notices, consents, and downstream contracts exist.

Customer Data and Privacy

• Keeper states that it may collect, use, and analyze aggregated, anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services, provided the data does not include Customer Data or identify customers or users.
• The Privacy Policy distinguishes between Keeper acting as a processor for business customers and an independent controller for account registration, billing, support, service analytics, website interactions, and partner-program information.
• Business administrators may access and process user data, including insights derived from users’ interactions with the Services. This expands the importance of employer/admin controls and applicable organizational privacy notices.
• Keeper continues to state that it cannot access encrypted vault contents, Master Passwords, or encryption keys under its zero-knowledge architecture.

Other Important Changes and Risks

• Website submissions are expressly nonconfidential; Keeper may retain, monitor, or remove communications, and feedback becomes Keeper’s sole property.
• SaaS terms impose broader customer duties concerning security configuration, backups, access controls, endpoint encryption, notices, and consents.
• Customer liability is generally capped at fees paid in the prior 12 months, with a higher cap for indemnification obligations; exclusions apply for IP misuse, fraud, gross negligence, willful misconduct, and non-limitable liabilities.
• Partner terms allow Keeper to update Partner Portal terms, channel requirements, discounts, and commercial conditions, generally binding partners through continued participation.
• Trials/evaluations receive reduced protections and may not undergo the same security reviews or compliance audits as paid Services.

Summary of the Available Change

Scope of Deletion

The diff states that approximately 15,240 words were removed, but it does not identify which provisions were deleted or provide the replacement text.

Because the deleted language is unavailable, it is not possible to determine with confidence:

• Which contractual rights or obligations changed
• Whether liability, indemnity, confidentiality, security, or termination terms were removed
• Whether pricing, service levels, warranties, or audit rights were affected
• Whether data-processing terms were narrowed or eliminated
• Whether the agreement now contains gaps or conflicting provisions

AI Training and Customer Data

The supplied diff does not show any specific language concerning AI models or training. Accordingly, it is impossible to confirm whether the revision:

• Permits or prohibits using Customer Data to train, fine-tune, validate, or improve AI models
• Restricts use to aggregated, de-identified, or anonymized data
• Allows human review or disclosure of Customer Data for model development
• Grants the provider ownership or broad usage rights over prompts, inputs, outputs, or derived data
• Requires deletion or segregation of Customer Data from training datasets
• Applies different rules to personal data, confidential information, or sensitive data
• Gives the customer an opt-out or requires affirmative consent
• Imposes retention, security, audit, or breach-notification obligations relating to AI training

The removal of a data-use restriction could materially expand the provider’s ability to use Customer Data. Conversely, removal of a provider authorization could restrict such use. The effect depends entirely on the missing provisions.

Key Legal Risks Created by the Incomplete Diff

• Scope risk: A large deletion may have removed important protections without showing what replaced them.
• Interpretation risk: If defined terms, exceptions, or cross-references were deleted, remaining provisions may become ambiguous or ineffective.
• Data-protection risk: Deleted privacy or security language could create uncertainty regarding lawful processing, retention, subprocessors, international transfers, and regulatory compliance.
• AI-specific risk: Any deleted training-related limitation could permit broader use of customer information than expected, potentially including confidential or personal data.
• Operational risk: Deleted service levels, support commitments, or security obligations may reduce the customer’s remedies.

Recommended Next Step

Obtain the full redline or both the prior and revised versions of the agreement. The deletion-only summary is insufficient to assess the legal effect, particularly regarding Customer Data and AI-model training.

Contract Change Summary

Overview

The diff indicates that approximately 15,240 words were removed from the document. However, no text showing the deleted provisions has been provided. Because the deletions are summarized rather than reproduced, it is not possible to determine which rights, obligations, limitations, or protections were removed.

Key Risks

• Material terms may have been deleted: The removed content could include provisions on fees, service levels, warranties, indemnities, liability caps, confidentiality, security, audit rights, termination, governing law, or dispute resolution.
• Risk allocation may have changed: Deleting disclaimers, liability limitations, indemnities, or customer obligations could materially shift risk between the parties.
• Customer protections may have been removed: The deletion may affect data security commitments, breach-notification obligations, data-processing restrictions, deletion/return requirements, or regulatory compliance terms.
• Operational uncertainty: If definitions, procedures, or incorporated schedules were removed, the remaining contract may contain gaps or conflicting provisions.

AI Training and Customer Data

The provided diff does not show the deleted language, so it is impossible to determine whether the contract changed:

• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use requires customer consent or may occur automatically;
• Whether data is anonymized, de-identified, aggregated, or retained for training;
• Whether prompts, inputs, outputs, usage data, or telemetry are included;
• Whether the provider may share data with affiliates or third-party model providers;
• Whether customers can opt out of AI training;
• How long training data is retained; or
• Whether the provider must delete customer data and derived model artifacts upon termination.

Any deletion of these provisions could either remove a customer restriction on AI training or remove a customer protection or opt-out right. The direction and practical effect cannot be determined from the summary alone.

Recommended Next Step

Obtain the actual deleted text and the complete before-and-after versions. The AI-data provisions should be specifically compared for language concerning:

1. “Train,” “fine-tune,” “improve,” or “develop” models;

2. Customer Data, Content, Inputs, Outputs, and Usage Data;

3. Consent and opt-out mechanisms;

4. De-identification or aggregation requirements;

5. Retention and deletion; and

6. Third-party or affiliate access.

Without the underlying text, no reliable conclusion can be drawn about the legal effect of the changes.

Summary of Changes

Overall Change

• The diff states that approximately 15,240 words were removed from the document.
• No replacement language or text showing what was removed has been provided.

Legal and Commercial Significance

• This is potentially a material change. Removing a large portion of a contract could eliminate or weaken important provisions, including:
• Data-use permissions and restrictions
• Confidentiality and security obligations
• Intellectual-property ownership and licensing
• Liability limitations and indemnities
• Warranties and disclaimers
• Termination and deletion obligations
• Audit, compliance, and dispute-resolution rights
• The legal effect cannot be determined reliably without seeing the deleted text and the remaining agreement. A deletion may either reduce a party’s obligations or remove protections that previously benefited the customer.

Customer Data and AI Training

• The provided diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• It is therefore impossible to determine whether:
• Customer data may be used for model training;
• Data may be combined with other customers’ data;
• Human reviewers or service providers may access data for training or quality control;
• Prompts, outputs, metadata, or usage information may be retained and used for product improvement;
• The provider must obtain consent before using customer data for AI purposes; or
• The provider must delete training data or model-derived information after termination.
• Because the deletion is extensive, it may have removed either an AI-data-use authorization or a restriction on such use. This should be treated as an unresolved and potentially significant risk until the deleted provisions are reviewed.

Recommended Next Steps

• Obtain the full before-and-after versions or a redline showing the actual deleted language.
• Search the removed and remaining text for terms such as “train,” “training,” “fine-tune,” “improve,” “machine learning,” “artificial intelligence,” “models,” “customer data,” “content,” “prompts,” “outputs,” and “service improvement.”
• Confirm expressly that customer data, prompts, outputs, and related metadata may not be used to train or improve AI models without the customer’s prior written consent, unless that use is intended and appropriately limited.

Change Summary

1. New or Consolidated Website Terms

• The website terms appear to have been substantially expanded or reorganized, including provisions covering:
• Website use restrictions, scraping and automated data collection;
• Electronic communications and non-confidential submissions;
• Personal-data handling through chat, forms and email;
• Intellectual property ownership;
• Disclaimers, liability limits, indemnification and termination;
• Entity-specific governing law and venue.
• Risk: Website submissions are expressly deemed non-confidential. Users should not submit passwords, confidential business information, sensitive personal data or security vulnerabilities except through designated channels.
• Continued website use accepts updated terms, creating a unilateral-change risk.

2. Customer Data and AI Model Training

SaaS Terms

• Customer Data expressly includes data supplied by the customer or users, including vault records, and is classified as Customer Confidential Information.
• Keeper may collect, use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the services, provided it does not include Customer Data or identify the customer or users.
• Confidential Information may not be made available to artificial-intelligence tools, including generative AI and large language models, except for internal use in a secure, access-controlled environment that:
• does not result in AI model training; and
• does not cause unauthorized retention, disclosure or use.
• Positive protection: This is an express contractual restriction against using confidential customer information to train AI models.
• Residual risk: The restriction applies to “Confidential Information,” but the permitted use of aggregated/anonymized telemetry could potentially support machine-learning or AI development if Keeper considers the data sufficiently anonymized. The agreement does not provide detailed de-identification standards, audit rights or a specific prohibition on training models using derived or anonymized data.

Partner Terms

• Partners receive a similar restriction against making Keeper Confidential Information available to AI tools, except in a secure environment without model training.
• However, Partner Terms state that the Partner has rights to authorize processing of “training data” by third-party providers.
• Important ambiguity/risk: “Training data” is not defined and could be read broadly. It may create uncertainty about whether certain partner-provided information can be used to train systems, particularly by vendors supporting Keeper’s learning-management or supplemental services. Partners should seek clarification that customer, end-user and confidential information will not be used for AI-model training without express, informed authorization.

3. Privacy Policy Changes and Data Use

• Keeper distinguishes between controller and processor roles. For business customers, it generally acts as processor, while independently controlling account, billing, support, website and usage-analytics data.
• Business administrators may access and process insights derived from users’ interactions with the services, subject to the organization’s controls and privacy notices.
• Keeper may use limited contact, payment and usage information through vendors for support, analytics, marketing and account operations.
• The policy states that Keeper does not access encrypted vault contents and does not sell or share personal information under applicable privacy laws.
• Risk: “Usage analytics,” “insights” and aggregated data are described broadly. The policy does not expressly state that these categories will never be used for AI or machine-learning model training.

4. Other Material Risks

• Customer is responsible for backups, access controls, endpoint security and obtaining required notices and consents.
• Fees are generally nonrefundable; automatic recurring billing and suspension rights apply.
• Liability is capped generally at fees paid in the preceding 12 months, with limited exceptions.
• Service availability is 99.9%, but the remedy is generally limited to termination.
• Free or evaluation products may lack normal security reviews, support and reliability.

Key Changes and Legal Risks

> Note: The diff appears to add or consolidate extensive terms, with the prior text largely unavailable. The analysis below focuses on material provisions appearing in the revised text.

1. Customer Data and AI Model Training

SaaS Terms

• “Customer Data” expressly includes data provided by the customer or users, including vault records, and is classified as Customer Confidential Information.
• Keeper may collect, use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the Services.
• This permission is expressly limited to data that:
• does not include Customer Data; and
• does not permit identification of the customer or its users.
• Confidential Information may not be made available to artificial intelligence tools, including generative AI and large language models, unless:
• used solely internally;
• in a secure, access-controlled environment; and
• the use does not result in AI model training or unauthorized retention, disclosure or use.

Risk/impact: The wording is favorable regarding training on Customer Data, but the exception for “aggregated anonymized” data is broad and does not expressly address whether telemetry or usage patterns could be used to train or fine-tune AI systems. Customers should seek confirmation that no Customer Data, prompts, outputs, metadata, or identifiable usage information will be used for model training.

Partner Terms

• Partners are subject to a similar AI restriction for Confidential Information.
• However, the Partner Terms also state that the partner authorizes Keeper to engage third parties and confirms it has rights to authorize processing of “training data” through those providers.

Important inconsistency/risk: “Training data” is not defined. This could authorize processing of data used for training—potentially broader than the SaaS restriction—and may create compliance and consent obligations for partners, especially where they act as processors for resellers or end customers.

2. Privacy and Data-Protection Changes

• Keeper’s role is differentiated:
• generally a processor for business customers;
• an independent controller for account, billing, analytics, support, website and partner-program information.
• Business administrators may access and process user data, including insights derived from service use.
• The Privacy Policy and DPA are incorporated into the agreements.
• Keeper may transfer personal data internationally using the Data Privacy Framework, Standard Contractual Clauses and other mechanisms.
• Vendors may receive limited personal, payment, usage and support information.

Risk: The policy permits analytics, marketing optimization, cookies and service-improvement processing outside the encrypted vault. “Zero Knowledge” therefore does not mean that all account-related metadata is inaccessible or excluded from analytics.

3. Commercial and Operational Risks

• Annual fees are generally nonrefundable and automatically recurring.
• Keeper may change prices at renewal and update incorporated policies or Partner Portal terms.
• Service availability is 99.9%, but only for the Keeper Services API and subject to broad exclusions.
• The sole remedy for service-level failure is termination.
• Disaster recovery objectives are an 8-hour RTO and 24-hour RPO, potentially allowing up to 24 hours of data loss.
• Liability is generally capped at fees paid in the prior 12 months, with limited exceptions.
• U.S. customers must generally arbitrate disputes in Wilmington, Delaware.

4. Data Retention and Deletion

• Paid subscriptions not renewed within 90 days may result in deletion of vault files.
• Inactive free accounts may be deleted after 12 months.
• Keeper cannot decrypt vault data or modify vault contents, which may limit practical access, correction and deletion remedies.

Summary

Scope of the Change

The diff states only:

> [Removed approximately 15,240 words from the document]

No replacement text or details identifying the deleted provisions are provided.

Legal and Commercial Risks

Because the deleted language is not shown, it is not possible to determine which contractual rights or obligations have changed. The deletion could potentially affect important areas such as:

• Data ownership and permitted use
• Confidentiality and security obligations
• Customer warranties and indemnities
• Liability limits and exclusions
• Service levels and support
• Termination and data deletion
• Intellectual-property rights
• Audit and compliance obligations
• Subcontractor or third-party use
• Governing law and dispute resolution

A deletion of this size creates a significant review risk: provisions may have been removed without corresponding replacement language, leaving gaps or unintentionally shifting risk to the customer.

AI Training and Customer Data

The available diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models. It is therefore impossible to confirm whether:

• Customer data may be used for provider-wide model training;
• Data may be used only to provide the contracted services;
• Customer prompts, inputs, outputs, or usage data are retained;
• De-identified, aggregated, or pseudonymized data may be used;
• Human reviewers or third-party AI providers may access the data;
• The customer can opt out of training or secondary use;
• Customer data is deleted from training systems after termination; or
• The provider makes commitments regarding model confidentiality, memorization, or isolation.

If provisions addressing these topics were deleted, the customer may have fewer protections or may face ambiguity about secondary use of its data. Conversely, the deletion may have removed a broad provider right to train models, but that cannot be determined from the supplied information.

Recommended Action

Obtain the actual deleted text and any replacement language before approving the change. Particular attention should be given to provisions concerning “customer data,” “usage data,” “service improvement,” “machine learning,” “artificial intelligence,” “model training,” “aggregated data,” and “de-identified data.” Until reviewed, treat the amendment as potentially material and do not assume that customer data is excluded from AI training.

Change Summary

1. AI and Model-Training Provisions

SaaS Terms

A new confidentiality restriction addresses artificial intelligence tools, including generative AI and large language models. Neither party may provide the other party’s Confidential Information to AI tools unless:

• The use is solely for the receiving party’s internal purposes;
• The AI environment is secure and access-controlled; and
• The information is not used for AI-model training or unauthorized retention, disclosure, or use.

Risk/impact: This is a meaningful restriction on using customer or Keeper confidential information with third-party AI services. It does not expressly prohibit all AI processing of Customer Data, however. The restriction applies to “Confidential Information,” while Customer Data is separately defined as Customer Confidential Information. Keeper may still process permitted aggregated, anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services.

Partner Terms

The Partner Terms contain a similar prohibition on submitting Confidential Information to AI tools except in a secure, access-controlled environment that does not result in model training or unauthorized retention or disclosure.

However, the Partner Terms also state that the Partner has the necessary rights to authorize “the processing of training data” through third-party providers.

Risk/impact: This wording is potentially ambiguous and should be clarified. It could be read as authorizing third-party providers to process data described as “training data,” despite the separate prohibition on AI model training. The agreement does not define “training data,” identify the providers, or specify whether any data may be used to train, fine-tune, evaluate, or improve AI models.

Privacy Policy

The revised policy states that:

• Business-customer data is generally processed by Keeper as a processor and only to fulfill contractual obligations or customer instructions.
• Keeper does not access encrypted vault contents under its zero-knowledge architecture.
• Keeper may use limited contact, payment, technical, service-usage, analytics, and diagnostic information to operate and improve services.
• Vendor/service-provider processing is limited to essential business functions.

There is no express blanket statement that Customer Data will never be used to train AI models. The policy also does not clearly distinguish ordinary service improvement from AI training, model evaluation, or machine-learning development.

2. Other Important Changes

• The website navigation appears streamlined by changing “Legal & Compliance” to “Compliance.”
• A “Legacy Terms” section now identifies terms applicable before March 9, 2026, potentially indicating a new effective-version structure.
• Partner terms allow Keeper to update Partner Portal program terms and requirements, with continued participation constituting acceptance. This creates an ongoing unilateral-change risk.
• Business administrators may access and process user data, including usage-derived insights and account controls; end users should not assume their organizational account activity is private from the administrator.
• Evaluation versions may receive reduced security review, support, reliability, and compliance protections, with broad disclaimer of liability.

Change Summary

1. AI and Customer Data Use

New restrictions on AI use of confidential information

The SaaS Terms now expressly prohibit either party from making the other party’s Confidential Information available to artificial intelligence tools, including generative AI and large language models, except where all of the following apply:

• The use is solely for the receiving party’s internal purposes;
• The AI environment is secure and access-controlled; and
• The information is not used for model training or unauthorized retention, disclosure, or use.

The Partner Terms contain a similar restriction for Partner Confidential Information. This is a meaningful protection against confidential business information being submitted to public AI tools or used to train external models.

Customer Data excluded from service-improvement analytics

The SaaS Terms state that Keeper may collect, use, and analyze aggregated, anonymized usage, telemetry, and operational data to operate, secure, support, and improve the Services. This permission is expressly conditioned on the data:

• Not including Customer Data; and
• Not permitting identification of the Customer or its Authorized End Users.

This appears to prohibit using vault records or identifiable Customer Data to train or improve AI models. However, the clause does not expressly mention AI training, synthetic data, model development, or re-identification risk. “Aggregated anonymized” may therefore require careful interpretation and technical validation.

Potential ambiguity involving “training data”

The Partner Terms state that Partner authorizes Keeper to use third parties to administer, support, and deliver services, and that Partner has the necessary rights to authorize “the processing of training data through such providers.” This is potentially significant and unclear:

• “Training data” is not defined;
• It could refer to employee or partner training materials, but could also be read broadly enough to include data used for AI or other model training; and
• It may conflict with the separate prohibition on AI model training involving Confidential Information.

Partners should seek clarification or require a definition confirming that Customer Data and Confidential Information cannot be used for AI training.

2. Privacy Policy Changes

The Privacy Policy more clearly distinguishes Keeper’s roles as:

• A processor for business Customer Data; and
• An independent controller for account registration, billing, support communications, usage analytics, website interactions, and partner-program information.

Keeper states that business Customer Data is processed only to fulfill contractual obligations or as instructed by the business customer. It also states that encrypted vault contents remain inaccessible under the zero-knowledge architecture.

The policy permits automated chat tools to record requests, suggest content, and assist responses, but does not expressly state whether those tools use submitted information for AI training. Customers should review vendor terms and obtain confirmation that support communications are not used for model training.

3. Other Material Risks

• Privacy Policy and Partner Portal terms may be updated periodically, with continued use or participation constituting acceptance.
• Business administrators may access usage-derived insights and control account features.
• Customer remains responsible for security configuration, access controls, endpoint encryption, backups, notices, and consents.
• Liability is generally capped at fees paid during the preceding 12 months, with limited exceptions.
• U.S. customers are subject to mandatory arbitration in Delaware for most disputes.
• Free or evaluation versions disclaim support, security reviews, and liability.

Summary of Changes

Overall Change

• Approximately 15,240 words were removed from the document.
• No replacement text or added provisions are provided in the diff.
• Because the deleted language is not included, it is not possible to determine which specific rights, obligations, limitations, or protections were removed.

Customer Data and AI Training

• The provided diff contains no visible language addressing customer data, AI training, machine learning, model development, or related data rights.
• However, the large-scale deletion may have removed provisions concerning:
• Whether the provider may use customer data to train or improve AI models;
• Whether customer data may be aggregated, anonymized, or de-identified for model training;
• Whether prompts, inputs, outputs, usage data, or metadata may be retained or analyzed;
• Ownership or licensing of customer data and AI-generated outputs;
• Opt-out rights or restrictions on using confidential or personal information;
• Security, deletion, retention, or data-isolation obligations.

Key Legal Risks

• Unclear allocation of rights: The deletion may eliminate express limits on the provider’s use of customer data or may remove customer protections and usage rights.
• Potentially broader implied permissions: If data-use restrictions were deleted without replacement, the remaining agreement may permit broader use of data under general rights, service-improvement, or license provisions.
• Loss of protections: Deleted provisions may have included confidentiality, privacy, security, indemnity, audit, deletion, or regulatory-compliance protections.
• Interpretation uncertainty: A court or contracting party may rely on the remaining language, which could create ambiguity about data ownership, permitted uses, and AI-training rights.
• Operational and compliance exposure: If customer data can be used for AI training or service improvement, this could create confidentiality, privacy, intellectual-property, or sector-specific regulatory risks.

Recommended Review

The deleted 15,240 words should be retrieved and compared with the current version before approval. Particular attention should be given to provisions addressing:

1. Customer Data and Confidential Information;

2. AI or machine-learning training and model improvement;

3. Data licenses and permitted processing;

4. Aggregated, anonymized, or de-identified data;

5. Retention, deletion, and security;

6. Ownership of inputs, outputs, and derived data; and

7. Opt-out, consent, and subcontractor or third-party access rights.

Conclusion: The diff is too abbreviated to confirm the substantive legal effect, but the scale of the deletion creates a significant risk that important customer-data and AI-training protections have been removed.

Summary of Important Changes and Risks

1. New or Consolidated Legal Documents

The update appears to reorganize Keeper’s legal materials into a central terms page containing:

• Website Terms of Use
• SaaS Terms of Use
• Partner Terms
• Privacy Policy
• Service Level Objectives
• Support terms
• Usage Guidelines
• Security, zero-knowledge, trust-center and other resource pages
• Legacy terms retained for versions before March 9, 2026

Risk: Many important obligations are incorporated by reference to webpages, policies, the Data Processing Addendum (“DPA”), Partner Portal materials and documentation. Those materials may change separately, potentially altering the parties’ rights and obligations without a separately signed amendment.

2. Customer Data and Zero-Knowledge Commitments

The SaaS Terms define “Customer Data” broadly to include data supplied by the customer or end users, including vault records, and classify it as Customer Confidential Information.

Keeper states that:

• Customer controls the master password and encryption keys.
• Keeper cannot access encrypted vault records.
• Keeper may collect limited account, support, telemetry and operational information.
• Keeper may use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the services.
• Such data must not include Customer Data or permit identification of the customer or end users.

Risk: The exclusion for Customer Data is helpful, but “aggregated,” “anonymized,” “usage,” “telemetry,” and “operational data” are not precisely defined. Customers should confirm whether metadata, activity patterns, administrative analytics or derived insights could be used for product improvement.

3. AI Model Training Restrictions

A new express confidentiality restriction provides that neither party may make the other party’s Confidential Information available to artificial intelligence tools, including generative AI and large language models, except for internal use in a secure, access-controlled environment that:

• Does not result in AI model training; and
• Does not cause unauthorized retention, disclosure or use.

The Partner Terms contain a similar restriction, although they include a drafting error (“it's internal use”).

Importance: This is a significant limitation on AI use and appears to prohibit submitting Customer Confidential Information—including Customer Data—to external AI tools where the information may be retained or used to train models.

Residual risk: The clause applies to “Confidential Information,” not necessarily all personal data or non-confidential information. It also does not expressly address AI outputs, model memorization, provider logging, prompt retention, or use of de-identified data. The DPA and Privacy Policy should be reviewed for consistent AI-processing language.

4. Privacy Policy Changes

The Privacy Policy more clearly distinguishes Keeper’s roles:

• Processor for business-managed accounts.
• Independent controller for registration, billing, support communications, website interactions, analytics and partner-program information.
• Controller for individual and family users.

It also authorizes use of vendors for support, analytics, payment processing and live chat, and permits international transfers using the Data Privacy Framework, Standard Contractual Clauses and other mechanisms.

Risk: Keeper may use service and usage data for analytics, service improvement and marketing, subject to applicable law. Business customers should ensure their DPA, notices and instructions adequately restrict these uses.

5. Commercial and Liability Changes

Notable customer risks include:

• Annual fees generally nonrefundable.
• Automatic recurring charges.
• Suspension for unpaid fees.
• Liability generally capped at fees paid in the prior 12 months, with a higher cap for indemnification.
• No liability cap for IP misuse, fraud, gross negligence or willful misconduct.
• U.S. customers contracting with Keeper Security, Inc. are generally subject to Delaware arbitration.

6. Operational Risks

The service-level commitment is limited to 99.9% API availability and excludes emergency maintenance, force majeure and customer-specific or integration-related issues. The exclusive remedy for a breach is termination, rather than service credits.

Structured Summary of Important Changes

1. Major structural expansion

The update appears to replace a short or consolidated terms page with a comprehensive legal library covering:

• Website Terms of Use
• SaaS Terms of Use
• Partner Terms
• Privacy Policy
• Data Processing Addendum references
• Service-level objectives
• Support terms
• Usage guidelines
• Security, zero-knowledge, trust-center and related resources
• Legacy terms and a change-summary section

This substantially increases the number of incorporated policies and external webpages that may govern the customer.

2. AI model and training restrictions

SaaS Terms

A new confidentiality provision restricts either party from making the other party’s Confidential Information available to artificial-intelligence tools, including generative AI and large language models, except where all of the following apply:

• The use is solely for the receiving party’s internal purposes;
• The AI environment is secure and access-controlled; and
• The use does not result in model training or unauthorized retention, disclosure or use.

Risk/impact: This is a meaningful contractual restriction on employees, contractors and service providers using confidential information with public or hosted AI tools. “Confidential Information” is broad and may include customer data, business information and information that reasonably should be understood as confidential. Violations could create breach, confidentiality and potentially injunctive-relief exposure.

Partner Terms

The Partner Terms contain a similar prohibition applicable to Partner Confidential Information. Partners must ensure that information is not submitted to AI tools in a way that causes model training or unauthorized retention, disclosure or use.

Risk/impact: The Partner is responsible for controlling downstream personnel and may need AI-use policies, approved-tool lists and technical controls.

3. Customer Data use and AI training

The SaaS Terms expressly state that:

• Customer Data includes data supplied by the customer or users, including vault records;
• Customer Data is Customer Confidential Information;
• Keeper may collect, use and analyze aggregated, anonymized usage, telemetry and operational data to operate, secure, support and improve the Services; and
• Such data must not include Customer Data or permit identification of the customer or users.

This is a relatively favorable limitation: the text does not authorize Keeper to use Customer Data or encrypted vault contents to train AI models. The separate AI restriction also prohibits use of Confidential Information that results in AI model training.

However, the wording permits use of “aggregated anonymized” usage and telemetry data for service improvement. Customers should confirm that the DPA, Privacy Policy and any product-specific terms do not authorize broader use of personal data, prompts, support communications or derived data for AI training.

4. Privacy-policy changes and data governance

The Privacy Policy now distinguishes Keeper’s roles as controller or processor and describes collection of:

• Account, billing, device, IP and usage information;
• Website, marketing, cookie and chat data;
• Partner and reseller information; and
• Support communications.

It also permits vendors and service providers to process limited information for support, analytics, account security and related business functions.

Risk/impact: The Privacy Policy is incorporated into the agreements and may be updated. Customers should review the DPA, vendor list, retention provisions, international-transfer mechanisms and whether support/chat data can be used for analytics or AI functionality.

5. Other significant commercial/legal risks

• Annual fees are generally nonrefundable and automatically recurring.
• Service availability is limited to a 99.9% monthly API target, with broad exclusions; the stated remedy is termination only.
• Liability is generally capped at fees paid in the preceding 12 months, with limited exceptions.
• Customers bear responsibility for access controls, backups, endpoint security and user activity.
• Keeper may update agreements and partner-portal terms, subject to stated limitations.
• U.S. customers may be subject to mandatory Delaware arbitration, excluding certain intellectual-property disputes.
• Free or evaluation versions receive reduced protections and may not have undergone equivalent security reviews.