Customer Verification and End-Use Policy

Last updated: 17 August 2026

This policy explains the minimum information we may require, the activities we do not support and the responsibilities of customers and authorised users.

It does not replace applicable law or the terms of a signed contract. Additional requirements may apply depending on the equipment, service, destination, customer, end user, ownership structure and proposed workload.

1. Scope

This policy applies to prospective and existing arrangements involving:

• on-demand or reserved GPU compute
• dedicated GPU servers
• bare-metal infrastructure
• private or hybrid-cloud environments
• managed AI infrastructure
• hosting and colocation-related services
• high-performance storage and networking
• remote access to controlled infrastructure
• intermediaries, resellers or subcontractors where expressly approved.

No capacity is allocated and no binding commercial commitment is made until the required review has been completed and the applicable agreement has been executed.

2. Our objectives

The review process is intended to help NOVACORE AI:

• identify the contracting entity and authorised representatives
• understand ownership and control
• identify end users, intermediaries and relevant destinations
• understand the intended workload
• assess technical and operational suitability
• evaluate sanctions and export-control considerations
• prevent unauthorised onward access
• identify potential misuse, circumvention or diversion
• comply with applicable legal and contractual obligations.

Completion of a review does not certify the customer or guarantee that every risk has been eliminated.

3. Customer verification

Before entering an applicable arrangement, we may request:

Entity information

• full legal name
• legal form
• registered office
• registration and tax identifiers
• country of incorporation and operation
• official registry extracts
• business activity
• corporate website and contact details.

Representative information

• name and business contact details
• position and authority to represent the entity
• reasonable evidence of identity and authority.

Ownership and control

• direct and indirect ownership structure
• ultimate beneficial owners
• persons or entities exercising control
• parent companies and relevant affiliates
• explanation of nominee, trust or other non-standard structures where relevant.

Transaction information

• contracting and paying entities
• source and route of payment
• intermediaries, resellers or subcontractors
• intended users
• hosting and access locations
• countries from which systems will be administered or used.

We may request certified, translated or recently issued documentation when proportionate to the risk.

4. Screening

NOVACORE AI may screen relevant persons and entities against applicable official sanctions and restricted-party sources.

Screening may consider:

• the customer
• authorised representatives
• beneficial owners
• persons or entities exercising ownership or control
• intended end users
• payment parties
• intermediaries
• relevant destinations and jurisdictions.

A name match does not automatically establish that a person is restricted. Potential matches may require additional information and review.

Screening may be repeated during the commercial relationship, including when ownership, control, users, destinations, payment arrangements or applicable legal measures change.

5. End-use statement

A written end-use statement may be required before approval.

It should describe:

• the intended workload and technical purpose
• the customer’s sector and business objective
• the anticipated users and administrators
• the countries from which the service will be accessed
• the location and categories of data
• the requested GPU platform, quantity and term
• whether third parties will receive access
• whether results, models, software or technical information will be transferred to other parties or locations
• any known military, governmental, critical-infrastructure, surveillance, cryptographic, cybersecurity or dual-use context
• any licence, authorisation or regulatory restriction identified by the customer.

The statement must be complete, accurate and consistent with actual use.

6. Export-control assessment

Certain equipment, software, technology, technical assistance, access arrangements or destinations may be subject to export-control or trade-restriction requirements.

The applicable analysis may depend on:

• technical classification
• product origin
• equipment and software licence terms
• customer and end-user location
• remote-access location
• destination and onward transfer
• intended end use
• applicable sanctions
• licensing requirements
• involvement of non-EU jurisdictions.

NOVACORE AI may request classification information, licences, authorisations, end-user documentation or specialist legal advice before proceeding.

The customer remains responsible for its own compliance obligations and must not assume that NOVACORE AI’s review replaces independent legal analysis.

7. Prohibited uses and arrangements

NOVACORE AI services and infrastructure must not be used for:

• activity prohibited by applicable law, sanctions or binding trade restrictions
• access by a person or entity where providing the service would be prohibited
• sanctions or export-control circumvention
• concealment of the actual customer, beneficial owner, end user, destination or payment party
• undisclosed resale, sublicensing, transfer or onward access
• unauthorised access to systems, accounts, networks or data
• development, deployment or distribution of malware
• credential theft, phishing, fraud or identity abuse
• denial-of-service attacks or deliberate service disruption
• unlawful surveillance or interception
• unlawful processing or exploitation of personal data
• child sexual-abuse or exploitation material
• development or support of prohibited chemical, biological, radiological or nuclear activities
• prohibited weapons-related activity
• activity intended to cause unlawful harm to persons, critical infrastructure or public safety
• any use prohibited by the applicable contract or service-specific policy.

This list is not exhaustive. A proposed use may be declined where it creates legal, security, human-rights, operational or reputational risk that cannot be appropriately managed.

8. High-risk and sensitive uses

Certain lawful activities may still require enhanced review, technical restrictions or specific contractual controls.

These may include workloads involving:

• defence or military organisations
• government or public-sector users
• critical infrastructure
• advanced cybersecurity
• biometric identification
• surveillance
• high-impact automated decision-making
• sensitive personal data
• cryptography
• advanced semiconductor development
• autonomous systems
• controlled research
• high-risk jurisdictions
• complex intermediaries or multi-party access.

Inclusion in this list does not mean that a use is automatically prohibited. It means that additional information, controls, authorisation or professional review may be required.

9. Onward access and intermediaries

Customers must not provide access to another person or entity unless that access is permitted by the applicable agreement and has completed any required review.

Unless expressly approved in writing, customers must not:

• resell or sublicense capacity
• share administrative credentials
• operate anonymous access services
• conceal the identity of an end user
• route access through an undisclosed intermediary
• transfer control of dedicated equipment
• materially change the destination or purpose
• allow access from a restricted location.

Approved intermediaries remain responsible for ensuring that authorised downstream users comply with the applicable restrictions.

10. Continuing customer obligations

Customers must:

• provide accurate and complete information
• respond to reasonable verification requests
• keep ownership, control and contact information current
• use the service only for the approved purpose
• protect credentials and access mechanisms
• maintain an accurate list of authorised users where required
• notify NOVACORE AI before a material change in use, users, destination, ownership or control
• notify NOVACORE AI promptly of suspected misuse or unauthorised access
• retain records required by the applicable agreement
• cooperate with proportionate compliance and security reviews.

Providing false, incomplete or misleading information may result in refusal, suspension or termination.

11. Changes requiring a new review

A new or updated review may be required if:

• ownership or control changes
• a new beneficial owner is introduced
• the contracting or paying entity changes
• new users, intermediaries or subcontractors are added
• access is requested from another jurisdiction
• the workload or sector materially changes
• capacity is transferred or expanded
• sanctions or export-control rules change
• new risk information becomes available.

Prior approval does not guarantee continued eligibility if relevant circumstances change.

12. Decisions and enforcement

NOVACORE AI may request additional information, impose conditions, limit functionality, decline a request, delay provisioning, suspend access or terminate an arrangement where permitted by the applicable agreement and law.

Possible reasons include:

• inability to verify required information
• a confirmed or unresolved sanctions match
• missing authorisation or licence
• inconsistency between stated and observed use
• unauthorised onward access
• suspected circumvention or diversion
• material security risk
• breach of this policy or contract
• a legal or regulatory requirement.

Where appropriate and legally permitted, NOVACORE AI may refer relevant matters to competent authorities or cooperate with lawful requests.

Commercial approval remains at NOVACORE AI’s discretion unless a signed agreement states otherwise.

13. Review and correction

Where a request is declined because information appears incomplete or inconsistent, the applicant may provide clarification or corrected documentation.

NOVACORE AI is not required to disclose confidential screening methods, security information, legally protected material or information that could facilitate circumvention.

Submitting additional information does not guarantee approval.

14. Verification providers

NOVACORE AI may use authorised service providers, professional advisers or official databases to support identity, ownership, sanctions and end-use review.

Where personal data is processed, the applicable roles, safeguards, disclosures and rights are described in the Privacy Policy and relevant contractual documentation.

No solely automated adverse decision should be assumed from this policy. The review process may include manual assessment where appropriate.

15. Records and retention

Verification records may include:

• customer and representative information
• ownership and control documentation
• screening results
• end-use statements
• correspondence
• approvals, conditions and review decisions
• records of material changes.

Records are retained according to a documented retention schedule based on the commercial relationship, applicable legal obligations, limitation periods, dispute requirements, audit needs and risk.

Information is not retained indefinitely without a defined purpose. Certain records may be preserved for longer where required by law, a legal hold, an investigation or the establishment, exercise or defence of legal claims.

Further information is provided in the Privacy Policy.

16. Confidentiality

Verification information is handled according to its sensitivity and used for legitimate review, contracting, security and compliance purposes.

Access is limited according to role and need. Information may be disclosed where necessary to authorised advisers, screening providers, contractual partners or competent authorities, subject to applicable safeguards and law.

Do not send highly sensitive documents through a general contact form. NOVACORE AI may provide an appropriate submission channel during the review.

17. Policy updates

Sanctions, export controls and other restrictions can change rapidly.

NOVACORE AI may update this policy to reflect changes in law, official guidance, services, technology or risk. The current version and effective date will be published on this page.

Changes to this public policy do not retroactively modify a signed contract except where required by law or permitted under that contract.

18. Contact

Questions about this policy or a proposed use may be sent to:

NOVACORE AI S.R.L. Email: office@novacoresoftai.com Subject: End-Use Review Registered office: București, Sector 3, Strada Nerva Traian, Nr. 27–33, Birou 6, Scara B, Etaj 1, Romania