Terms of service

The agreement between you and Dokima. Governed by the laws of England and Wales.

This policy is being formally reviewed and may be updated before launch. Email [email protected] with concerns.v0.2 — 2026-05-10

The contracting party

These Terms create a legal contract between you and Daniel Iwugo, trading as The Malware Files (the "Provider", "we", "us"). The Malware Files is currently an unincorporated trading name; until incorporation as a UK private limited company, the contracting party is Daniel Iwugo personally. On incorporation, these Terms (and your subscription) will be assigned to the new corporate entity by way of novation, with prior written notice given to you by email.

Acceptance + scope

By creating an account, generating an API key, embedding a Dokima badge, or using any part of the Dokima service ("Service"), you agree to these Terms, the Privacy Policy, and the Acceptable Use Policy (together, the "Agreement"). If you do not agree, do not use the Service.

What Dokima is — and what it is not

Dokima scores publicly available AI models on Hugging Face across seven dimensions and produces a structured Verdict, a letter grade, an actionable remediation list, and an embeddable badge.

Dokima scores are structured opinions derived by an automated process from publicly available metadata. A Dokima score is the output of a published methodology applied to disclosed inputs at a specific point in time. Scores are NOT statements of fact about the model's safety, fitness for purpose, regulatory compliance, or merchantability. Scores are NOT a warranty, certification, audit, or accreditation. Where a score, grade, or remediation suggestion appears to make a factual claim about a model, that claim is one of structured opinion based on the metadata cited in the report and the methodology published at our Methodology page.

You remain solely responsible for your own due diligence before deploying, integrating, procuring, or relying on any AI model in production.

Methodology as objective process

The Dokima methodology — including dimensions, weights, point allocations, grade boundaries, and hard-fail triggers — is published at our Methodology page and is updated only on the calibration cadence set out there (quarterly minimum-viable recalibration plus drift-triggered manual reviews; 30 days' prior notice of material changes). Scores produced before a methodology update remain valid as historical opinions under the methodology then in force; the methodology version applied to each score is recorded in the score report and verifiable against the published rubric.

Public-interest publication + good faith

We publish scores in the public interest of advancing AI safety, transparency, and informed procurement. We reasonably believe publication of structured methodology-driven assessments of publicly distributed AI models is in the public interest, having regard to the rapid deployment of AI in safety-critical contexts and the absence of universal regulatory verification of AI model fitness.

All scores are published in good faith on the basis of the Methodology and the evidence chain stored against each individual score. Each score record includes the methodology version under which it was produced, the source data inputs, the dimension breakdown, and any attestation flags raised. This section is included in support of the public-interest defence under section 4, and the honest-opinion defence under section 3, of the Defamation Act 2013.

Notice of complaint about a score (Defamation Act 2013, s.5 procedure)

If you believe a Dokima score, report, or attestation contains a defamatory statement about you or an entity you represent, you may submit a formal notice of complaint to [email protected]. To benefit from the operator-of-website notice procedure under section 5 of the Defamation Act 2013, your notice must:

  • specify your name and contact details, including a postal address for service in the United Kingdom or an authorised UK agent;
  • set out the statement complained of, the URL where it appears, and the date you became aware of it;
  • explain why the statement is defamatory of you (or the entity you represent);
  • state whether you consent to your identity and the substance of your complaint being disclosed to the person responsible for the statement;
  • be in writing (email is acceptable for the purposes of the regulations).

Our response will follow the procedure set out in the Defamation (Operators of Websites) Regulations 2013, including the statutory response timeframes (which provide for an initial response within 48 hours of receipt, excluding weekends and bank holidays in England and Wales), and (where applicable) attempting to contact the person responsible for the statement, removing or amending the statement, or providing reasons in writing for not doing so.

Dokima is operated by a single individual. Where notice volume materially exceeds normal operations, we may take a reasonable additional period to respond consistent with our statutory obligations.

This s.5 procedure is provided in addition to, and does not replace, our lighter-weight score-dispute and re-scan processes; methodology disagreements should be raised via the score-appeal channel before invoking the s.5 procedure.

Voluntary correction request (informal channel)

Before invoking the formal s.5 procedure above, you may submit an informal correction request to [email protected] with subject line "Score correction". Correction requests should specify the model identifier, the scoring element you believe is incorrect (for example licence detected as "missing" when in fact a SPDX identifier is present in the model card), and any supporting evidence. We will review correction requests in good faith and re-scan where the input data has materially changed; this informal channel is offered as a courtesy and does not affect your statutory rights or our obligations under the s.5 procedure.

Intellectual property complaints

If you believe content on Dokima infringes your intellectual property rights, send a notice to [email protected] containing: your contact details; identification of the material you claim is infringing; identification of the work you claim is infringed; a statement that you have a good-faith belief the use is not authorised; a statement that the information is accurate and you are authorised to act for the rights-holder; your physical or electronic signature. We will review and act expeditiously, in accordance with our obligations under regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002.

Account requirements

You must be at least 18 years old to create an account. You agree to provide an accurate email address and to keep your password confidential. One person, one account. You are responsible for all activity under your account, including activity by anyone you authorise to use your API keys.

The Free tier

The public web scanner is free of charge, requires no account, and is rate-limited per IP address. A free account adds monthly scan history (100 scans/month) and shareable score reports. The Free tier is web-only and does not include API access.

Paid tiers and subscription terms (DMCC Act 2024)

Hobby (£5/month) and Pro (£39/month) tiers add API access, larger quotas, and additional features as listed on the Pricing page. All paid tiers are subscriptions that auto-renew at the end of each billing cycle unless cancelled.

In line with the UK Digital Markets, Competition and Consumers Act 2024 and supporting subscription regulations, we will:

  • clearly display the renewal date, frequency, and amount before you subscribe;
  • send a reminder notice to your registered email at least 10 days before each renewal;
  • provide a one-click cancellation option in your account billing page that takes effect at the end of the then-current billing cycle, with no winback dialogs, no retention barriers, and no requirement to contact support;
  • honour a 14-day cooling-off period from each renewal date, during which you may cancel and receive a pro-rata refund for the unused portion of the renewal period.

Cancellation does not delete your account or score history; account deletion is a separate action under "Delete account" in your Settings.

Payments + refunds + service credits

Payments are processed by Lemon Squeezy as Merchant of Record. Lemon Squeezy handles VAT, sales tax, and any other consumption tax for your jurisdiction. Prices are shown in GBP unless otherwise indicated. Card details are not transmitted to or stored by Dokima.

Refund policy. We offer a 7-day no-questions-asked refund on your first paid charge. Beyond that window, the cooling-off period above applies at each renewal. For consumers in the United Kingdom, nothing in this clause limits or excludes your statutory rights under the Consumer Rights Act 2015 (including the right to a refund where a service is not performed with reasonable care and skill).

Where Dokima is not working as promised beyond the cooling-off period, we will issue a pro-rata refund on a case-by-case basis. Refunds are processed via Lemon Squeezy and typically take 5–10 business days to reach the original payment method.

Service credits in lieu of refunds (business users). For business users, where the Service is materially unavailable or impaired beyond what these Terms permit (and the cause is within our reasonable control), we may at our option issue service credits — capped at one month's subscription fee per incident — to be applied against your next billing cycle. Service credits are the exclusive remedy for service-availability issues for business users, except where mandatory law (or these Terms) requires otherwise. For consumers, your statutory rights under the Consumer Rights Act 2015 remain unaffected.

Acceptable use

Your use of Dokima is governed by our Acceptable Use Policy. Material breach of the AUP entitles us to suspend or terminate your account immediately and without refund, and to ban the IP addresses, payment instruments, or email domains used in the breach. Severe or repeated breaches (including rating manipulation, scraping, or commercial resale of the service) may also be reported to relevant authorities or affected third parties.

Intellectual property

The Dokima engine source code is licensed under the GNU Affero General Public Licence version 3 or later (AGPL-3.0-or-later). The full source is available on request to [email protected] and may be made publicly browsable at a later milestone.

The scoring methodology — weights, dimensions, point allocations, grade boundaries — is open and published on the Methodology page. The trade marks "Dokima" and the triple-nested-hexagon logo remain our property; you may use them only in accordance with our published brand guidelines (forthcoming).

Verdicts, scores, and remediation text generated for public Hugging Face models are released under Creative Commons Attribution 4.0 International (CC BY 4.0); you may reuse them with attribution to Dokima. Bulk extraction of Verdict text for use as training data, fine-tuning input, or evaluation set for any AI/ML model intended for commercial use requires a separate written licence (see AUP). Anything you submit to Dokima — model identifiers, account data, dispute communications — remains yours.

Disclaimers

Dokima scores metadata and documentation signals available through the Hugging Face public API. We do not download model weights, run inference, or perform dynamic analysis. The Hugging Face metadata may be incomplete, outdated, or inaccurate; our score reflects what is observable at the time of the scan. The Service is provided "as is" and "as available" without warranties of any kind, express or implied, except for any warranties that cannot lawfully be excluded under English law.

No reliance

You acknowledge that in entering into the Agreement you have not relied on, and shall have no remedy in respect of, any statement, representation, assurance, warranty, or understanding (whether made innocently or negligently, in writing or orally) other than those expressly set out in the Agreement. Nothing in this clause excludes or limits liability for fraud or fraudulent misrepresentation. For consumers, your rights under the Consumer Rights Act 2015 and the Misrepresentation Act 1967 are unaffected.

Force majeure

Neither party will be liable for any failure or delay in performance arising from circumstances beyond its reasonable control, including: failures of the public internet, hosting infrastructure, content delivery networks, or third-party APIs (including but not limited to the Hugging Face API on which Dokima depends as its primary data source); cyberattacks; denial-of-service attacks; pandemic; war; terrorist action; industrial action affecting third parties; changes in law; acts of God.

Solo-operator continuity. Dokima is operated by a single individual. Force majeure events expressly include the temporary unavailability or incapacitation of the operator (illness, hospitalisation, family emergency, bereavement, or other personal circumstance materially affecting capacity to operate the Service). In any such event, our Service-Level commitments and response timeframes are suspended for the duration of the unavailability; we will publish a banner on the Service and email account holders with reasonable updates. The cooling-off and refund provisions above continue to apply.

Where a force majeure event materially affects the Service for more than 30 consecutive days, either party may terminate the affected subscription tier and we will refund any pre-paid fees pro-rata for the unperformed period.

Limitation of liability

(a) Liability that cannot be excluded. Nothing in these Terms limits or excludes liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; any liability that cannot lawfully be excluded under English law; or breach of statutory rights under the Consumer Rights Act 2015 where you are dealing as a consumer.

(b) For consumers (individuals using Dokima outside the course of a business): our liability arising out of or in connection with these Terms is limited to the price you have paid for the affected service in the 12 months preceding the event giving rise to liability, EXCEPT where the Consumer Rights Act 2015 entitles you to greater compensation, in which case your statutory rights apply in full.

(c) For business users (any user not dealing as a consumer, including sole traders acting in the course of a business and all corporate users): our total aggregate liability arising out of or in connection with these Terms (whether in contract, tort, breach of statutory duty or otherwise) is limited to the greater of (i) £100, or (ii) the fees you paid us in the 12 months preceding the event giving rise to liability.

(d) Excluded heads of loss. In no event will we be liable, whether to consumers or business users, for: (i) loss of profits, business, contracts, anticipated savings, goodwill, or revenue; (ii) loss of, or damage to, data; (iii) special, indirect, or consequential losses; (iv) reliance on a Dokima score or remediation suggestion in any deployment, procurement, integration, or compliance decision.

Indemnification by you

You agree to indemnify, defend, and hold harmless the Provider against any third-party claim, demand, regulatory action, or loss (including reasonable legal fees) arising from: (a) your submission of model identifiers you do not have a legitimate interest in scoring; (b) your attempt to manipulate Dokima scores by submitting falsified data, creating multiple accounts to inflate or deflate scores, or otherwise gaming the methodology; (c) your use of Dokima output to defame, harass, or interfere with the business of any third party in a way not contemplated by Dokima's published purpose; (d) your breach of any third-party intellectual property rights via your use of Dokima; (e) your breach of these Terms or the Acceptable Use Policy.

Termination

You may terminate your account at any time from the Settings page; termination takes effect at the end of the then-current billing cycle for paid tiers. We may suspend or terminate accounts that materially breach these Terms or the Acceptable Use Policy, with or without notice depending on the severity.

Right to refuse or terminate for risk reasons. We may suspend or terminate your access to the Service at any time on reasonable notice (or, where the risk requires it, immediately) where we determine in good faith that your continued use presents a legal, regulatory, security, reputational, or operational risk to the Service, to other users, to third parties, or to us. Where termination is for this reason and you have been compliant with these Terms, we will refund pro-rata any pre-paid fees for the unperformed period.

On termination we will delete your account data per the Privacy Policy retention schedule.

Survival of terms

The following sections survive termination of the Agreement and continue in effect: "What Dokima is — and what it is not"; "Public-interest publication + good faith"; "Notice of complaint about a score"; "Voluntary correction request"; "Intellectual property complaints"; "Intellectual property"; "Disclaimers"; "No reliance"; "Limitation of liability"; "Indemnification by you"; "Survival of terms" (this section); "Severability + entire agreement + third-party rights"; "Governing law and jurisdiction"; "Dispute resolution"; "Time limit on claims"; "Contact". Any other provision that by its nature is intended to survive termination will do so.

Changes to these Terms

We will give 30 days' prior notice by email of any material change to these Terms. Continued use of the Service after the notice period takes effect constitutes acceptance of the changed Terms. If you do not accept a material change, you may terminate your account before the change takes effect; we will refund any pre-paid unused subscription fees pro-rata.

Severability + entire agreement + third-party rights

Severability. If any provision of these Terms is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, the remaining provisions will continue in full force and effect.

Entire agreement. These Terms (together with the Privacy Policy, Acceptable Use Policy, and any tier-specific addendum or Data Processing Agreement we have signed with you) constitute the entire agreement between you and us regarding the Service and supersede all prior agreements, communications, and understandings.

Third-party rights. A person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of these Terms.

Time limit on claims (business users)

For business users (any user not dealing as a consumer): notwithstanding the Limitation Act 1980, any claim arising out of or in connection with the Agreement must be brought within one (1) year of the date the cause of action accrued. After that period, the claim is time-barred. This clause does not apply to consumers, whose statutory limitation periods (typically six years for contract and tort claims under the Limitation Act 1980) are unaffected.

Dispute resolution

Informal resolution first. Before commencing formal proceedings, both parties agree to attempt to resolve any dispute by good-faith discussions. Send a written notice describing the dispute to [email protected] with subject line "Dispute notice". The parties will use reasonable efforts to resolve the dispute within 30 days of the notice.

Arbitration (business users only). If informal resolution fails, business users agree that any dispute arising out of or in connection with the Agreement (including non-contractual disputes) will be referred to and finally resolved by arbitration under the LCIA Rules in force at the time. The seat of arbitration is London, England. The language is English. The number of arbitrators is one. The arbitration award is final and binding. This arbitration agreement is severable from the rest of the Agreement and survives termination.

Consumer carve-out. The arbitration provision above does NOT apply to you if you are dealing as a consumer. Consumers may bring claims in any court having jurisdiction under applicable consumer protection law (including the courts of your habitual residence) and are not required to arbitrate. Nothing in this clause prevents either party from seeking urgent injunctive or equitable relief in any court of competent jurisdiction.

Governing law and jurisdiction

These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes or claims) are governed by, and construed in accordance with, the law of England and Wales. Subject to the Dispute resolution clause above (where arbitration applies to business users), the courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim, except that nothing in this clause prevents you (where you are a consumer) from bringing proceedings in the courts of your habitual residence as required by applicable consumer protection law.

Contact

General questions about these Terms: [email protected]. Defamation notices and legal correspondence: [email protected]. Intellectual property complaints: [email protected]. Score appeals: [email protected]. Postal address available on request.