CRUSETRA
Appendix D Terms of engagement ← Back to the findings

What the license grants, and for how long.

A thick page with three lines of text, a green signature stroke, and a pen resting with its tip at the stroke's end.

The terms below are short because they are real. They cover the thirty-day grant, the four tiers of the extraction cost audit, the public license, and the deliverable. A thirty-day grant is written into the license file, anyone can read the public license, and anyone can verify a deliverable. We also commit that the answer may go against us and recommend that you keep what you have. Where a term lives in the source, this page gives its path.

Thirty days, in writing

The Evaluation Grant is written into the license file. It gives you thirty days from first use, on your organization's own data, for its own internal evaluation, and you may share the output inside your organization. In plain words, it forbids three things: relying on the output in production, redistributing the software, and publishing the output externally. The period is extended only in writing, and anything beyond evaluation needs a separate commercial license.

Read the grant

It is the first sixteen lines of the license file on any clone.

run it yourself
head -16 LICENSEthe complete grant, as you will hold us to it

Where it livesLICENSE:8 · LICENSE:15

The extraction cost audit: four tiers, one contracting company

The Routing page sells the extraction cost audit as a fixed-price service, apart from the campaign and the license below. The free test covers 100 pages of one document type and up to 3 extractors: you run it, you email us the record, and you get a one-page PDF back within 48 hours. The record you send carries a content hash; the free-test report is not signed. It is an internal evaluation, like the $0 tier above and the Evaluation Grant of the license file. The Snapshot ($490) covers one document type, up to 1,000 pages, 10 fields and 4 extractors, and comes back as a PDF and a sealed record (hashed, then frozen: its content hash is checked before a figure is shown) within 48 hours. The Audit ($1,900) covers up to 3 document types, 10,000 pages, 30 fields and 10 extractors, within 72 hours. The Quarterly audit ($4,900 a year) is the Audit measured again 4 times a year, each report saying what moved since the last.

HS Industries LLC contracts and invoices each of them, under an engagement letter written before signature. Sealed means the record carries a content hash, which shows an edit made after sealing. The report itself is a signed page, like the sample on the Routing page: node src/verifier-rapport.mjs routing-sample-report.html checks it against the public key in the repository, and the PDF beside it is a rendering of that signed page. The Snapshot and the Audit include the right to act on the recommendation in your own operations; the paid engagement is the contract that grants it, and the public license is unchanged. The free test grants no such right.

The screening report: one price, one subscription, the same contracting company

The Screening page sells the screening report as a fixed-price service. You email a list of company and vessel names; we screen it against ten public sanctions lists and send back a PDF, a spreadsheet and the sealed record. The free test covers 10 names, back within 48 hours, at no charge. One report ($99) covers up to 500 names, back within 48 hours. The weekly re-screen screens the same list again each week against the lists of that week, at $79 a month up to 500 names, $199 a month up to 5,000 names and $499 a month up to 50,000 names, paid yearly with two months free, and you stop at any time. HS Industries LLC contracts and invoices each of them. A candidate in a report is a name for your compliance officer to check: the report does not decide, does not screen ownership, and is not legal advice. Once the report is sent, your file and the mails that carried it go to the trash and are permanently deleted within 30 days. A weekly re-screen subscriber's list is kept for the re-screen and goes the same way when the subscription stops.

How the three levels of the license work

The public license is PolyForm Noncommercial. Under it, anyone may read, study, fork (copy the source) and use the tool for noncommercial purposes, with no time limit. An organization that evaluates the tool gets the thirty days above. A client gets a negotiated commercial license. The public license itself states that it is not what a client buys.

This license is not OSI‑approved (approved by the Open Source Initiative), and some organizations exclude such licenses by policy. Such a policy holds back an organization picking up the tool on its own. It does not hold back a negotiated engagement. Like all licenses of its kind, it ships without warranty, with a 32‑day cure period, the time to put a violation right after written notice.

When the answer is to keep what you have

The engagement can end with a recommendation to keep what you have. The code that produces that recommendation is in the public source, and that outcome does not depend on our goodwill. With fewer than 20 observations, the tool makes no recommendation. The validation dossier states that it does not certify anything. It assembles what a reviewer needs, and the decision is the committee's. On the corpus we measured, 3 of the 5 fields are already handled at zero cost by regular expressions. That cheapest possible answer is in the headline. The recommendation itself prints, in figures, what would reverse it.

Print the recommendation

The script runs in one second and prints the recommendation with the condition that would reverse it.

run it yourself
node src/premiere-reponse.mjsthe conclusion, with what would reverse it

Where it livessrc/your-cases.ts:2476 · VALIDATION.md:28

What you send and what you get back

You supply one CSV (an id, a text, one column per field) and, if you wish, a filled questionnaire. Each field in the questionnaire is optional. What stays empty keeps this repository's default, and the report notes it. A missing figure never becomes an invented one. Running the tool this way makes no network call, and your file never leaves your machine.

You get back a measured report beside your own CSV. It gives rates per field with confidence intervals, the range the true rate is likely to sit in, and it quotes no rate below 20 observations. Under an audit engagement you also get a signed report, signed with our private key. Anyone, including a reviewer who does not trust us, verifies it against the public key that ships in the repository. The verification proves origin and integrity, meaning the report is ours and unaltered. It proves nothing about whether the figures are correct. That burden stays on the measurement.

Verify a deliverable

The verifier is a public script with no dependencies, and the key is in the repository.

run it yourself
node src/verifier-rapport.mjs rapport.htmleither authentic and unaltered, or refused

Where it livessrc/verifier-rapport.mjs:13 · src/intake.ts:225

Settled before signature

The remaining terms of a paid engagement (payment, confidentiality, audit rights, change of control, precedence, and the rights in the produced report) are settled in the engagement letter, written before signature, with no renegotiation after delivery. They are business terms, so this page names them without quoting them. The letter is the document your counsel receives.

One rule from the public license already binds the evaluation period. The output of an evaluation run is internal to your organization. External publication is excluded from the first day.