Terms of Service

The Services provide authorization control-plane infrastructure intended to help organizations establish, issue, manage, verify, enforce, record, and revoke delegated authority for AI agents, applications, services, and other systems.

The specific Services available to Customer may depend on Customer’s account, plan, trial, evaluation, an applicable Order or other written agreement with Keydris, or the documentation Keydris makes available for the Services (the “Documentation”).

The Services are an evolving technology platform and may change as described in these Terms.

Unless expressly stated in an applicable Order, Customer’s purchase and use of the Services are not contingent on the delivery of any future functionality, feature, product, or integration. Statements about possible future functionality or development plans are informational only unless expressly included as a binding commitment in an Order accepted by Keydris.

The Services are designed to operate as authorization control-plane infrastructure. Unless Keydris expressly agrees otherwise in writing, Keydris does not operate Customer’s underlying execution or data plane by providing the Services.

An underlying application request, API operation, MCP tool execution, payment, transaction, database operation, deployment, communication, workflow, or other business action need not be routed through the Services merely because Keydris authorization functionality is used.

Keydris is not responsible for proxying, routing, transmitting, initiating, completing, settling, or executing Customer’s underlying business actions. As between the parties, Customer’s agents, applications, APIs, MCP servers, tools, infrastructure, networks, counterparties, and third-party systems remain responsible for executing or rejecting underlying actions.

Separation from Customer’s underlying execution or data plane does not mean that no information is processed. Keydris may process authorization-related and operational information reasonably necessary to provide the Services, including identifiers; authority grants, scopes, permissions, policies, limits, and conditions; approval, expiration, revocation, and verification information; configuration information; timestamps; and related technical records.

Keydris does not store the content of Customer’s underlying request or action payloads.

Customer represents that it is legally capable of entering into these Terms. Individuals creating or administering Keydris business accounts must be at least 18 years old, or the age of legal majority in their jurisdiction if higher.

Where accounts are available, Customer must provide accurate, complete, and reasonably current account information.

Customer is responsible for activity conducted through its account, for the individuals it authorizes to use the Services, and for ensuring that those individuals comply with these Terms. Customer must assign appropriate permissions, remove access that is no longer required, maintain appropriate internal approval and offboarding processes, and safeguard the passwords, API keys, tokens, and other credentials under its control.

Customer must promptly notify Keydris if it reasonably suspects unauthorized access to an account or compromise of credentials. Keydris may require compromised credentials to be disabled, reset, rotated, or replaced.

Subject to these Terms and any applicable plan, Order, trial conditions, usage limits, and payment obligations, Keydris grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the proprietary Services during the applicable term for Customer’s internal business purposes.

The proprietary Services are licensed, not sold. Except for rights expressly granted under these Terms or an applicable open-source license, Keydris and its licensors retain all rights, title, and interest in and to the Services, technology, documentation, and related intellectual property.

Customer may allow its authorized personnel and contractors to use the Services on its behalf, subject to these Terms, and remains responsible for their use.

Customer controls its agents, applications, systems, workflows, users, configurations, integrations, and underlying actions.

Customer is responsible for determining:

• which agents, applications, users, services, or systems may act;
• who may delegate authority, and what authority may be delegated;
• the applicable scopes, permissions, policies, and conditions;
• financial, operational, or other limits;
• expiration periods and approval requirements;
• when human review or intervention is required;
• how authorization information is evaluated and enforced; and
• whether an underlying action should ultimately be accepted, rejected, or executed.

Customer is responsible for configuring, testing, monitoring, and maintaining its implementation, and for independently determining whether the Services are appropriate for its particular use case and risk profile.

A valid authorization proof, successful verification, policy result, or other output of the Services indicates only that the authorization conditions evaluated by the Services were satisfied, according to the relevant configuration and the information available to the Services at the relevant time. It does not independently establish that an underlying action is lawful, accurate, appropriate, safe, compliant, or commercially desirable.

Nothing in these Terms makes Keydris the operator of Customer’s agents or underlying systems, or Customer’s fiduciary, payment processor, custodian, financial institution, employer, agent, or business decision-maker.

Customer will use the Services in accordance with these Terms and the Documentation, maintain reasonable security over its accounts and credentials, obtain the rights and permissions necessary for the information it provides to Keydris, and comply with applicable law in connection with its own use of the Services.

Customer must maintain appropriate safeguards for consequential agent actions and ensure that its agents and systems act only through interfaces and methods Customer is authorized to use.

Customer remains responsible for its underlying agents, applications, instructions, systems, decisions, transactions, and actions.

Customer will not, and will not permit any user or third party to, use the Services to:

• violate applicable law or regulation;
• violate third-party intellectual-property, privacy, publicity, contractual, or other rights;
• impersonate or misrepresent a person, organization, authority, instruction, permission, approval, or the source of an action;
• knowingly facilitate unlawful, deceptive, harmful, or unauthorized activity;
• access another customer’s account, information, systems, or environment without authorization;
• interfere with or disrupt the availability, integrity, security, or performance of the Services;
• circumvent security measures, access controls, rate limits, usage limits, or other technical restrictions;
• introduce malware or other harmful code;
• conduct unauthorized vulnerability testing, probing, scanning, or denial-of-service activity;
• use automated methods other than through interfaces and methods made available or authorized for that purpose;
• reverse engineer, decompile, or disassemble proprietary portions of the Services, except to the limited extent applicable law expressly permits despite this restriction;
• remove or obscure proprietary notices;
• resell, sublicense, white-label, lease, or provide proprietary Services to third parties without Keydris’s written authorization; or
• use proprietary portions of the Services to build or operate a directly competing proprietary authorization-infrastructure service.

These restrictions do not limit rights expressly granted under an applicable open-source license.

“Customer Data” means information, content, or data that Customer or its authorized users submit, transmit, make available, or direct Keydris to process through the Services. As between the parties, Customer retains its rights in Customer Data, and Keydris does not acquire ownership of Customer Data by processing it through the Services.

Customer authorizes Keydris to process Customer Data as reasonably necessary to provide, operate, maintain, and secure the Services; to troubleshoot and provide support; to detect and prevent misuse; to comply with applicable law; and to perform Keydris’s obligations under the applicable customer relationship.

Customer is responsible for ensuring that it has the rights, permissions, notices, consents, and legal bases necessary for Customer Data to be provided to and processed by Keydris as contemplated by these Terms.

Customer should configure integrations so that information unnecessary to an authorization decision or to the operation of the Services is not transmitted to Keydris. Unless a particular Service is specifically designed and documented to receive them, Customer should not submit passwords, private keys, signing keys, payment-card credentials, or other secrets through the Services or general support channels.

Keydris may generate or receive technical and operational information about the provision, security, reliability, performance, configuration, and use of the Services (“Service Data”), such as technical logs, request and event identifiers, usage statistics, performance measurements, error information, and security events.

Keydris may process Service Data as reasonably necessary to provide, operate, secure, and maintain the Services; to prevent fraud, abuse, and unauthorized use; to troubleshoot and provide support; to measure usage and administer plans and billing; to monitor reliability and performance; and to develop and improve the Services. Service Data does not give Keydris ownership of Customer Data.

Keydris will not use Customer Confidential Information or Customer Data to train generalized artificial-intelligence or machine-learning models unless Customer expressly agrees otherwise in writing.

Where Service Data contains personal information, Keydris will process that information in accordance with the Keydris Privacy Policy. Keydris may use information that has been aggregated or de-identified so that it does not reasonably identify Customer or an individual for security, analytics, development, and operational purposes.

Where access to a Service is subject to usage limits, credits, actions, transactions, requests, tokens, API calls, or another usage metric, Keydris may measure usage through the Services. Unless an applicable Order provides otherwise, Keydris’s reasonable records of Service usage determine usage for account administration and billing, subject to correction of material errors.

Customer is responsible for monitoring its own use of the Services and the limits applicable to its account. Keydris may apply reasonable technical limits to protect the Services, prevent abuse, enforce plan limits, or maintain reliability.

“Confidential Information” means non-public information disclosed by one party to the other that is identified as confidential or that reasonably should be understood to be confidential under the circumstances. Customer Data is Customer Confidential Information. Keydris Confidential Information includes non-public technical, security, product, pricing, and business information, proprietary software, and documentation.

The receiving party will use Confidential Information only in connection with the parties’ relationship, protect it using at least reasonable care, and disclose it only to employees, contractors, affiliates, service providers, auditors, and professional advisers who reasonably need access and are bound by appropriate confidentiality obligations.

Confidential Information does not include information that the receiving party can demonstrate: (i) became publicly available without breach of an obligation; (ii) was lawfully known without confidentiality restriction before disclosure; (iii) was independently developed without use of the Confidential Information; or (iv) was lawfully received from another source without confidentiality restriction.

A party may disclose Confidential Information where required by applicable law, subpoena, court order, or other valid legal process, and will, where legally permitted, provide reasonable notice before the compelled disclosure.

Keydris will maintain reasonable administrative, technical, and organizational measures appropriate to the nature of the Services and the information processed. No internet-based service, software platform, network, or electronic storage system can be guaranteed to be completely secure, uninterrupted, or error-free.

Customer remains responsible for securing its own systems, agents, applications, accounts, credentials, endpoints, integrations, policies, configurations, and data-access practices, and should maintain the backups, monitoring, recovery procedures, access controls, approval mechanisms, and business-continuity arrangements appropriate for its use case.

Security concerns involving Keydris may be reported to security@keydris.com.

The Services may connect with, rely on, or operate alongside third-party applications, APIs, AI models, protocols, networks, software, infrastructure, or other services (“Third-Party Services”). Third-Party Services are governed by their own terms, policies, and practices.

Customer is responsible for deciding whether to use Third-Party Services and for maintaining the accounts, rights, permissions, consents, and agreements they require.

Keydris does not control and is not responsible for the availability, security, accuracy, functionality, actions, or omissions of Third-Party Services, and changes to Third-Party Services may affect interoperability with Keydris.

Keydris may designate certain Services or functionality as beta, preview, trial, proof-of-concept, experimental, evaluation, or early access (“Evaluation Services”). Keydris’s free developer preview tier (the “Developer Preview”) is an Evaluation Service.

Evaluation Services may be incomplete, contain errors or defects, change materially, have reduced availability or limited support, or be modified or discontinued.

Unless Keydris expressly agrees otherwise in writing, Evaluation Services should not be relied upon for production or other consequential uses where an error, interruption, or change could reasonably cause material loss, liability, security exposure, or regulatory exposure. Evaluation Services are provided without service-level, availability, support, warranty, or indemnity commitments unless expressly stated otherwise in an applicable Order.

A Service provided under a paid plan or an applicable Order for production use is not an Evaluation Service merely because Keydris describes its platform as early stage or as a developer preview, unless the applicable plan or Order designates it as such.

Keydris may make Services available under free, trial, promotional, usage-based, subscription, enterprise, or other plans. The Developer Preview is made available without charge. Paid plans are established through an applicable Order or other written agreement with Keydris.

An applicable plan, Order, or other written agreement may specify the Services purchased, features, usage allowances, credits, limits, fees, billing arrangements, payment terms, trial conditions, subscription periods, renewal provisions, support commitments, and other commercial terms.

Where fees apply, Customer will pay them in accordance with the applicable plan or Order. Except where required by applicable law or expressly stated otherwise in an Order, fees paid are non-refundable and non-creditable.

Customer is responsible for applicable taxes associated with its purchases and use of the Services, other than taxes imposed on Keydris’s net income, property, or employees. If Customer is legally required to withhold taxes from a payment, Customer will provide reasonable documentation of the withholding.

Keydris may introduce new plans, usage metrics, pricing models, fees, or commercial structures and may modify existing pricing as the Services evolve.

If Keydris increases a fee, introduces a new fee for a Service Customer is already using, or otherwise changes pricing in a manner that increases the amount Customer must pay for its existing use, Keydris will provide at least 30 days’ advance notice by email before the change becomes effective, unless applicable law requires a longer notice period. The notice will identify the pricing change and its effective date. Pricing changes do not apply retroactively.

Unless an applicable Order provides otherwise, Customer’s continued use of the affected paid Services after the effective date constitutes acceptance of the revised pricing. If Customer does not agree to revised pricing, Customer may discontinue the affected Service before the revised pricing takes effect, subject to any committed term or other obligation in an applicable Order.

Pricing expressly fixed for a specified committed term in an Order remains effective for that committed term unless the Order provides otherwise. Keydris may reduce prices, offer promotions, issue credits, waive fees, or provide additional Services without charge, without advance notice.

Keydris may suspend or restrict Customer’s access to all or part of the Services if Keydris reasonably believes that: (i) Customer’s use violates these Terms or applicable law; (ii) Customer’s use creates a material security, legal, technical, or operational risk, or threatens Keydris, another customer, or a third party; (iii) Customer materially exceeds applicable technical or usage limits in a manner that threatens the Services; (iv) Customer has materially overdue undisputed payment obligations; (v) suspension is required by law or a valid governmental order; or (vi) immediate action is reasonably necessary to protect the Services.

Where reasonably practical, Keydris will provide notice and limit the suspension to the affected Services or conduct. Suspension does not waive Customer’s accrued payment obligations or Keydris’s other rights.

These Terms begin when Customer first accepts them and continue until terminated. An applicable Order may establish a separate term for particular Services.

Either party may terminate an applicable agreement for material breach if the breach is not cured within 30 days after written notice describing the breach in reasonable detail. Keydris may suspend or terminate access immediately where continued use is unlawful or creates a material security or legal risk. Customer may stop using the Services at any time, subject to its obligations under an applicable Order.

Upon expiration or termination, Customer’s right to use the terminated proprietary Services ends, Customer will stop using them, and accrued payment obligations remain due. Customer is responsible for retrieving Customer Data during any applicable access period.

Keydris may retain information after termination to the extent reasonably necessary for security, legal compliance, dispute resolution, fraud prevention, backups, or the other purposes described in the Privacy Policy.

Provisions that by their nature should survive termination will survive, including those relating to confidentiality, intellectual property, accrued payment obligations, disclaimers, liability, indemnification, and general legal terms.

As between the parties, Keydris retains its rights in the Services, proprietary software, APIs, SDKs, the Documentation, authorization technology, designs, interfaces, trademarks, and other Keydris materials. These Terms do not transfer ownership of Customer Data to Keydris.

Some components of the Services may be made available under open-source licenses. To the extent an applicable open-source license conflicts with these Terms, that license controls solely with respect to the relevant open-source component.

No rights to Keydris trademarks or branding are granted except with Keydris’s written permission.

If Customer voluntarily provides ideas, suggestions, recommendations, feature requests, comments, or other feedback concerning the Services (“Feedback”), Customer grants Keydris a worldwide, perpetual, irrevocable, royalty-free, fully paid-up right to use, reproduce, modify, distribute, and otherwise use that Feedback for any purpose, without compensation or attribution.

Customer Data and Customer Confidential Information are not Feedback.

The Services are early stage and will continue to evolve. Keydris may develop, add, improve, modify, replace, restrict, suspend, or discontinue APIs, SDKs, authorization and verification functionality, policies, integrations, interfaces, dashboards, the Documentation, usage limits, and other features or Services.

Keydris may make changes without advance notice where the change adds or improves functionality without materially reducing Customer’s existing use; addresses a vulnerability or security threat; prevents fraud, abuse, or unauthorized use; is required by applicable law; concerns Evaluation Services; or does not materially reduce core functionality of a paid Service Customer actively uses.

Where reasonably practicable, Keydris will provide advance notice of a change that materially reduces core functionality of a paid Service Customer actively uses.

Nothing in this Section creates a service-level commitment or guarantees the future availability of a particular feature.

Keydris may update these Terms as the Services, technology, business, commercial model, security environment, or applicable requirements evolve. Updated Terms will identify their effective date.

If an update materially reduces Customer’s rights or materially increases Customer’s obligations regarding a paid Service, Keydris will provide reasonable advance notice by email, through the Services or the website, or by another reasonable method. Changes reasonably necessary to address security threats, fraud, abuse, legal requirements, or urgent operational matters may take effect immediately or on shorter notice where reasonably necessary.

Customer’s continued use of the Services after updated Terms become effective constitutes acceptance where permitted by applicable law. Price increases and new fees affecting Customer’s existing use remain subject to the 30-day advance email notice requirement in Section 16.

Customer agrees that Keydris may provide account, operational, contractual, security, billing, and legal communications electronically — by email, through Customer’s account or the Services, or by posting through an appropriate Keydris service or website.

Customer is responsible for keeping its account contact information reasonably current.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES, INCLUDING EVALUATION SERVICES, ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

KEYDRIS DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AVAILABILITY, AND SECURITY, TO THE EXTENT PERMITTED BY LAW.

KEYDRIS DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, COMPLETELY SECURE, OR APPROPRIATE FOR EVERY USE CASE.

KEYDRIS DOES NOT GUARANTEE THAT THE SERVICES WILL:

• PREVENT OR DETECT EVERY UNAUTHORIZED, ERRONEOUS, MALICIOUS, OR HARMFUL ACTION;
• PRODUCE A PARTICULAR AUTHORIZATION, POLICY, OR VERIFICATION OUTCOME;
• CAUSE AN AGENT, PERSON, SYSTEM, OR THIRD PARTY TO ACT AS INTENDED;
• SATISFY ALL OF CUSTOMER’S SECURITY, LEGAL, REGULATORY, INSURANCE, OR COMPLIANCE REQUIREMENTS;
• MAKE AN UNDERLYING ACTION LAWFUL, ACCURATE, SAFE, OR APPROPRIATE; OR
• ELIMINATE THE NEED FOR CUSTOMER’S OWN SECURITY, GOVERNANCE, APPROVAL, OR OVERSIGHT MEASURES.

CUSTOMER IS RESPONSIBLE FOR INDEPENDENTLY EVALUATING THE SERVICES AND ITS OWN AGENTS, SYSTEMS, POLICIES, CONFIGURATIONS, APPROVALS, AND UNDERLYING ACTIONS.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OR FOR LOST PROFITS, REVENUE, BUSINESS, GOODWILL, OR DATA ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, KEYDRIS’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICES, OR AN APPLICABLE ORDER WILL NOT EXCEED:

• (A) FOR PAID SERVICES, THE FEES ACTUALLY PAID BY CUSTOMER TO KEYDRIS FOR THE AFFECTED SERVICES DURING THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR
• (B) FOR SERVICES PROVIDED WITHOUT CHARGE, US$100.

These limitations apply regardless of the form of action, whether in contract, tort, negligence, strict liability, or otherwise.

Nothing in these Terms excludes or limits liability that applicable law does not permit to be excluded or limited.

Customer will defend, indemnify, and hold harmless Keydris and its affiliates, officers, directors, employees, and contractors from third-party claims, damages, losses, liabilities, costs, and reasonable legal fees arising from: (i) Customer Data’s actual or alleged infringement, misappropriation, or violation of third-party rights; (ii) Customer’s unlawful use of the Services; (iii) Customer’s agents, applications, workflows, systems, instructions, configurations, policies, or underlying actions; or (iv) Customer’s material breach of these Terms.

Keydris will provide reasonable notice of an indemnified claim and reasonable cooperation. Customer may control the defense and settlement of the claim, but may not settle a claim in a manner that admits fault by, imposes liability on, or materially restricts Keydris without Keydris’s prior written consent.

Each party will comply with the laws applicable to its own performance under these Terms.

Customer must not use the Services in violation of applicable export-control, trade-control, or economic-sanctions laws, and represents that it will not knowingly use the Services for the benefit of a person or organization where doing so would be prohibited by applicable sanctions law.

Keydris may provide notices through the Services, Customer’s account, email, the Keydris website, or the contact information identified in an applicable Order. Customer is responsible for maintaining accurate contact information.

Security concerns and notices to Keydris may be submitted to security@keydris.com. Unless an applicable Order requires another method, electronic notice sent to the applicable contact address is sufficient where permitted by law.

These Terms and disputes arising out of or relating to these Terms or the Services are governed by the laws of the State of Delaware, without regard to its conflict-of-law principles.

The parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Delaware for disputes arising out of or relating to these Terms or the Services.

The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Order of Precedence

These Terms, applicable Orders, and any terms expressly incorporated by reference constitute the agreement governing the applicable Services. If an Order expressly states that it overrides a provision of these Terms, the Order controls solely with respect to that conflict. If a Data Processing Addendum applies to processing of personal information and conflicts with these Terms solely regarding that processing, the Data Processing Addendum controls for that conflict.

A purchase order issued by Customer is for administrative convenience only and does not modify these Terms unless Keydris expressly agrees in writing.

Assignment

Customer may not assign or transfer these Terms without Keydris’s prior written consent. Keydris may assign these Terms in connection with a merger, acquisition, financing, corporate reorganization, or sale of all or substantially all relevant assets or business.

Force Majeure

Neither party is responsible for failure or delay caused by events beyond its reasonable control, except for payment obligations.

Severability

If a provision of these Terms is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain effective.

Waiver

Failure to enforce a provision does not waive that provision or any other right.

Relationship

The parties are independent contractors. These Terms do not create a partnership, joint venture, employment relationship, agency, fiduciary relationship, franchise, or other special relationship, and neither party may bind the other except where expressly agreed.

No Third-Party Beneficiaries

These Terms do not create third-party beneficiary rights except where expressly stated.

Headings

Section headings are provided for convenience and do not affect interpretation.

Entire Agreement

These Terms, applicable Orders, and documents expressly incorporated by reference constitute the entire agreement between the parties concerning the applicable Services and supersede prior or contemporaneous understandings concerning those Services.