Terms of Service

To access the Service, you must register for an account by providing accurate, complete, and current information. You agree to maintain and promptly update your account information to keep it accurate and current.

You are solely responsible for:

• Maintaining the confidentiality and security of your account credentials, API tokens, and identity access material
• Maintaining robust multi-factor authentication (MFA) on your SanctiKey account and securing the devices and methods used for MFA
• All activity that occurs under your account, whether or not authorized by you
• Immediately notifying SanctiKey at security@sanctikey.com if you suspect unauthorized access to your account or any security incident

SanctiKey enforces multi-factor authentication at the platform level. You are responsible for securing your MFA devices, backup codes, and recovery methods. SanctiKey cannot be held liable for unauthorized access resulting from your failure to maintain the security of your credentials or MFA materials.

You agree not to:

• Share your account credentials or API tokens with unauthorized parties
• Create accounts by automated means or under false pretenses
• Use another user’s account without permission
• Attempt to circumvent authentication or access controls

SanctiKey provides a managed cryptographic services platform offering encryption, key management, and security tooling to businesses. The Service is provided on a subscription basis as described in our pricing documentation and your applicable subscription plan.

SanctiKey may provide a demonstration environment ("Demo Environment") for prospective customers to evaluate the Service. The Demo Environment is provided for evaluation purposes only and is governed by SanctiKey's Demo Environment Terms, which are incorporated herein by reference. In summary:

• The Demo Environment is a shared environment and is the sole exception to the Service’s dedicated single-tenant account model; demo users are isolated from one another at the application layer
• You must not enter any sensitive, confidential, proprietary, personal, or production data into the Demo Environment
• Demo accounts and all associated data are automatically and permanently deleted 14 days after account creation
• SanctiKey provides no SLA with respect to the Demo Environment and may reset, modify, or terminate it at any time without notice

SanctiKey reserves the right to modify, update, or discontinue the Service or any feature thereof at any time. For material changes that adversely affect your use of the Service, we will provide at least 30 days' advance notice by email. We will not be liable to you or any third party for any modification, suspension, or discontinuation of the Service.

SanctiKey will use commercially reasonable efforts to maintain Service availability in accordance with our Service Level Agreement, which is incorporated herein by reference. Scheduled maintenance windows will be communicated in advance where reasonably practicable.

Programmatic access to the Service via SanctiKey's developer APIs is governed by SanctiKey's API Terms of Use, which are incorporated herein by reference. In the event of a conflict between these Terms and the API Terms of Use with respect to API access, the API Terms of Use control.

Your continuity rights in the event SanctiKey ceases operations, including the Keyout right, are governed by SanctiKey's Business Continuity and Keyout Policy, which is incorporated herein by reference.

SanctiKey is responsible for:

• Security of the SanctiKey platform infrastructure, including underlying cloud infrastructure, application code, authentication systems, and network controls
• Maintaining the non-extractable key architecture such that SanctiKey personnel and systems cannot extract or export your cryptographic key material in plaintext
• Operating your keys solely to perform the operations you request through the Service’s API, and retaining no API payload content, plaintext or ciphertext, beyond the transient staging required for optional asynchronous operations
• Providing and maintaining the security controls described in our Security Policy
• Handling personal information as described in our Privacy Policy, including the retention and deletion commitments in that policy
• Notifying you of security incidents that materially affect your account in accordance with our Incident Response Policy, without undue delay after confirmation of the incident

You are solely responsible for:

• Securing your SanctiKey account credentials, API tokens, and all identity access material used to authenticate to the Service
• Securing the devices, applications, and methods used for multi-factor authentication on your account
• Managing which of your users, employees, or systems are granted access to key partitions and associated resources within your account
• Securing your own systems, applications, and infrastructure that integrate with or consume the Service
• Ensuring that your use of the Service complies with all applicable laws and regulations
• Implementing appropriate incident response procedures on your end in the event of a suspected compromise of your account credentials or MFA materials

SanctiKey cannot be held liable for any security incident, data breach, key compromise, or loss arising from your failure to fulfill the responsibilities enumerated in this Section 5.2.

Access to the Service requires a paid subscription. Fees are set forth in your applicable subscription plan and are subject to change with 30 days' advance notice.

Subscriptions are billed in advance at the beginning of each billing period, on the billing term you select at signup: monthly, or annually at the rates in the Pricing Schedule (twelve months of service for the price of eleven, with rates locked for the term). Your first charge will occur upon activation of your subscription. Subsequent charges will occur on the same day of each following month, or on the anniversary of activation for annual terms.

Your subscription renews automatically each billing period and your payment method will be charged at the start of each period until you cancel. You may cancel at any time through the account portal; cancellation takes effect at the end of the current billing period (for annual terms, the end of the paid annual term), and you will not be charged again after that. Unused months of a cancelled annual term are not refunded pro rata, except as provided in Section 7.6. Cancellation online is no more difficult than the signup process. No long-term commitment is required to use the Service month to month, and there is no early-termination fee on either term.

All payments are processed by Stripe, Inc. By providing payment information, you authorize SanctiKey to charge your payment method through Stripe for all applicable fees. You agree to Stripe's terms of service in connection with payment processing. SanctiKey does not store your payment card information.

Fees do not include applicable taxes. You are responsible for all taxes, levies, or duties imposed by taxing authorities in connection with your use of the Service, excluding taxes based on SanctiKey's net income.

If payment fails or is not received by the due date, SanctiKey reserves the right to suspend your access to the Service after providing notice. Continued failure to pay may result in termination of your account. You remain liable for all amounts owing.

• Cancellation: You may cancel your subscription at any time as described in Section 7.2. On cancellation, the Service remains available through the end of the paid billing period.
• Subscription fees already charged are non-refundable. On the monthly term your maximum exposure is the current month; on the annual term it is the current annual period, which you accepted in exchange for the annual rate and price lock.
• Prepaid operation blocks: Unused prepaid operation capacity does not roll over as cash value and is not refunded on cancellation, except that if SanctiKey terminates your account without cause or discontinues the Service, SanctiKey will refund the unused portion of any prepaid amounts on a pro-rata basis.
• Billing errors: If you believe you have been charged in error, submit a billing inquiry through the account portal within 60 days of the charge. Verified billing errors are refunded in full to the original payment method.
• Nothing in this section limits refunds expressly required by applicable law.

The Service, Site, and all content, features, functionality, software, algorithms, designs, trademarks, and other materials made available by SanctiKey are owned by SanctiKey or its licensors and are protected by applicable intellectual property laws. These Terms do not grant you any ownership rights in the Service or SanctiKey's intellectual property.

Subject to your compliance with these Terms and payment of applicable fees, SanctiKey grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service solely for your internal business purposes during the term of your subscription.

You agree not to:

• Copy, modify, distribute, sell, sublicense, or create derivative works of the Service or any part thereof
• Reverse engineer, decompile, disassemble, or attempt to derive the source code of the Service
• Access the Service to build a competitive product or service
• Remove or obscure any proprietary notices or labels on the Service
• Use the Service in any manner that violates applicable law

You retain all ownership rights in data, content, and materials you submit to or process through the Service ("Customer Data"). You grant SanctiKey a limited license to store, process, and transmit Customer Data solely as necessary to provide the Service. SanctiKey does not claim any ownership rights in Customer Data.

To the maximum extent permitted by applicable law, SanctiKey shall not be liable to you for any indirect, incidental, special, consequential, punitive, or exemplary damages, including but not limited to loss of profits, loss of revenue, loss of data, loss of business opportunity, regulatory fines or penalties, reputational harm, or cost of substitute services, arising out of or related to these Terms or your use of or inability to use the Service, even if SanctiKey has been advised of the possibility of such damages.

To the maximum extent permitted by applicable law, SanctiKey's total cumulative liability to you for any and all claims arising out of or related to these Terms or the Service shall not exceed the total fees paid by you to SanctiKey in the twelve (12) months immediately preceding the event giving rise to the claim.

The limitations in Sections 10.1 and 10.2 do not apply to:

• SanctiKey’s liability for gross negligence or willful misconduct
• SanctiKey’s liability for fraud or fraudulent misrepresentation
• Either party’s liability for death or personal injury caused by that party’s negligence
• Either party’s indemnification obligations under Section 11
• Your payment obligations under Section 7

SanctiKey's liability shall be further limited or eliminated entirely with respect to any claim arising from:

• Your failure to secure your account credentials, API tokens, or identity access material
• Your failure to maintain and secure multi-factor authentication on your account
• Unauthorized access to your account resulting from your failure to follow reasonable security practices
• Your misconfiguration of internal access grants within your account
• Any breach, loss, or damage originating from your own systems, applications, users, or downstream services
• Your sharing of credentials or access tokens with unauthorized parties

The parties acknowledge that the limitations of liability in this Section 10 reflect a reasonable allocation of risk and are an essential element of the basis of the bargain between the parties. SanctiKey would not provide the Service without these limitations.

No software system is impenetrable. SanctiKey represents that it has implemented commercially reasonable, industry-standard security measures consistent with its published Security Policy. SanctiKey does not warrant that the Service is free from all security vulnerabilities or that it will be uninterrupted or error-free. You accept the residual risk inherent in any internet-connected system.

You agree to indemnify, defend, and hold harmless SanctiKey and its officers, directors, members, employees, agents, and successors from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

• Your use of the Service in violation of these Terms or applicable law
• Your violation of the Acceptable Use Policy
• Your Customer Data, including any claim that Customer Data infringes or misappropriates any third-party intellectual property right
• Your failure to fulfill your responsibilities under the Shared Responsibility Model in Section 5.2
• Any breach of your representations or warranties under these Terms
• Any willful misconduct or gross negligence by you or your users

SanctiKey agrees to indemnify, defend, and hold harmless you from and against any third-party claim that the Service, as provided by SanctiKey and used in accordance with these Terms, infringes any United States patent, copyright, or trademark. This obligation does not apply if the claim arises from: (a) your modification of the Service; (b) your combination of the Service with third-party products or services not provided or approved by SanctiKey; or (c) your use of the Service in violation of these Terms.

The indemnified party must: (a) promptly notify the indemnifying party of the claim; (b) give the indemnifying party sole control of the defense and settlement of the claim; and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle any claim that imposes liability, obligation, or restriction on the indemnified party without the indemnified party's prior written consent.

These Terms are governed by and construed in accordance with the laws of the Commonwealth of Massachusetts, without regard to its conflict of law provisions.

Any dispute, claim, or controversy arising out of or relating to these Terms or the Service that cannot be resolved informally shall be subject to the exclusive jurisdiction of the state and federal courts located in Middlesex County, Massachusetts. Each party irrevocably consents to the personal jurisdiction and venue of such courts.

Before filing any legal action, the parties agree to attempt to resolve any dispute informally by contacting SanctiKey at legal@sanctikey.com. The parties will make a good-faith effort to resolve the dispute within 30 days of the initial notice. This informal resolution requirement does not apply to requests for emergency injunctive or equitable relief.

Nothing in these Terms prevents either party from seeking emergency injunctive or equitable relief from a court of competent jurisdiction to prevent irreparable harm, including in connection with a breach of confidentiality obligations or intellectual property rights.

Any claim arising out of or related to these Terms must be brought within one (1) year after the cause of action accrues, or such claim is permanently barred.

These Terms commence on the date you first accept them and continue until terminated in accordance with this Section 13.

You may terminate your subscription at any time through your account settings. Termination will take effect at the end of your current billing period. No refunds are provided for the remaining portion of a billing period.

SanctiKey may suspend or terminate your account and access to the Service:

• Immediately, without notice, for violation of the Acceptable Use Policy or material breach of these Terms
• Upon 30 days’ written notice for convenience
• Immediately if required by law or to protect the security or integrity of the Service or other customers

Upon termination:

• Your license to use the Service immediately terminates
• You remain liable for all fees accrued through the termination date
• SanctiKey will retain and then delete your Customer Data in accordance with our Data Retention Policy
• Sections 8, 9, 10, 11, 12, 13.4, and 15 survive termination

Each party represents and warrants that: (a) it has the legal authority to enter into these Terms; (b) its performance under these Terms does not violate any agreement to which it is a party or applicable law; and (c) these Terms constitute a valid, binding, and enforceable obligation.

You further represent and warrant that:

• You are located within the United States and are not subject to any United States export restrictions or sanctions
• Your use of the Service and your Customer Data does not infringe any third-party intellectual property rights
• You will use the Service in compliance with all applicable laws and regulations

The Service is provided "as is" and "as available." To the maximum extent permitted by applicable law, SanctiKey disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement. SanctiKey does not warrant that the Service will meet your requirements or that operation of the Service will be uninterrupted or error-free.

These Terms, together with the Privacy Policy, Acceptable Use Policy, Service Level Agreement, API Terms of Use, Business Continuity and Keyout Policy, and, where applicable, the Demo Environment Terms, constitute the entire agreement between you and SanctiKey with respect to the Service and supersede all prior agreements, representations, and understandings.

SanctiKey may amend these Terms at any time by posting the updated Terms on the Site and notifying you by email. Your continued use of the Service after the effective date of the amendment constitutes acceptance. If you do not agree to the amended Terms, you must stop using the Service and terminate your subscription.

Failure to enforce any provision of these Terms does not constitute a waiver of that provision or any other provision.

If any provision of these Terms is held invalid or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force and effect.

You may not assign or transfer your rights or obligations under these Terms without SanctiKey's prior written consent. SanctiKey may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets. Any attempted assignment in violation of this provision is void.

Neither party will be liable for delays or failures in performance resulting from causes beyond that party's reasonable control, including acts of God, natural disasters, government actions, labor disputes, internet or infrastructure outages not caused by that party, or denial of service attacks. This provision does not excuse payment obligations.

Notices to SanctiKey under these Terms must be sent to legal@sanctikey.com. Notices to you will be sent to the email address associated with your account. Notices are effective upon transmission for email.

The Service involves cryptographic technology subject to United States export control laws, including the Export Administration Regulations (EAR). You agree to comply with all applicable export control laws and regulations in connection with your use of the Service.