Vaultless Guard Terms of Service

Last updated: 27 September 2026

These Terms are an agreement between Techmek LLC, postal address available on request from devopsplus11@gmail.com ("we", "us") and the organisation that accepts them ("Customer", "you"). You accept them by clicking to agree, by signing an Order Form that refers to them, or by using the Hosted Service or a paid licence. If you accept for an organisation, you confirm you have authority to bind it. These Terms are for business use only; they are not offered to consumers.

1. Definitions

Gateway: the Vaultless Guard software that runs on your own machines, inspects requests from AI clients and replaces sensitive values with tokens before a request leaves the machine.
Console: the software for central management of Gateways (fleet, rules, analytics, evidence).
Hosted Service: the Console as operated by us at vguard.techmek.io (or a successor address).
Self-Hosted Console: the Console run by you on your own infrastructure, including air-gapped installations.
Software: the Gateway, the Console software, licence files and activation certificates, and their updates and Documentation.
Service: the Hosted Service and any support we provide.
Documentation: our then-current product documentation, including the Trust page and Security Overview.
Order: a self-serve sign-up or checkout, or an Order Form signed by both parties.
Plan: Community, Team, Business or Enterprise, as described in the Documentation and your Order.
Seat: one person (the user a Gateway enrolled as) active in the last 30 days. Devices and installs are not Seats.
Authorised Users: your employees and contractors whom you allow to use the Software or Service.
Customer Data: data you or your Authorised Users submit to the Hosted Service, including account data, organisation settings, rules, device identifiers and labels, and the operational data described in section 8.2. Customer Data does not include anything that stays on your machines.
AI Provider: any AI model provider (for example Anthropic or OpenAI) that your AI clients send requests to.

2. Order of precedence

If documents conflict, this order applies: (1) an Order Form, only for that Order; (2) the Data Processing Addendum (DPA), for personal data; (3) these Terms; (4) the Service Level Agreement (SLA); (5) the Documentation. The Acceptable Use Policy, DPA and SLA are part of these Terms.

3. Licences and access

3.1 Software. Subject to these Terms and payment of fees, we grant you a non-exclusive, non-transferable, non-sublicensable licence during your subscription term to install and use the Software, for your internal business purposes, within the Seats, activations, deployment type and features of your Plan.

3.2 Open-source components. Parts of the Software may be made available under an open-source licence stated in the Software's distribution. For that code, the open-source licence governs your rights and prevails over these Terms. These Terms still govern the Service, licence keys, signed licences and activations, support, and any commercial feature not covered by that open-source licence.

3.3 Hosted Service. During your subscription term you may access and use the Hosted Service for your internal business purposes, within your Plan.

3.4 Community Plan. The Community Plan is free, for up to 3 Seats, and runs locally only (no Console). Sections 12.2 and 13.2 set a lower liability position for free use.

3.5 Seats and true-up. You may exceed your licensed Seats by up to 10% (rounded up) at no charge. Usage above that is shown to you as a true-up and, unless your Order says otherwise, is billed at your Plan's then-current per-Seat price from the month it occurs. Beyond the tolerance, the Console may refuse to enrol new people. Existing users are not cut off.

3.6 Protection is never switched off for licensing. Expiry, non-renewal, suspension or a Seat overage never stops a Gateway from detecting, tokenizing or withholding data, never disables its local audit log, and never blocks a security release. A licence problem can pause only management features (such as new enrolments, older analytics and Console evidence export) as described in the Documentation.

4. Restrictions

You will not, and will not allow anyone to: (a) use the Software or Service in breach of the Acceptable Use Policy or law; (b) resell, rent, or provide the Service to third parties as a hosted or managed service, except to your affiliates or as your Order allows; (c) circumvent licence checks, Seat counting or activation, or copy an activated installation to avoid Seat limits; (d) reverse engineer non-open-source parts of the Software except where law permits despite this restriction; (e) access the Service to build a competing product or run benchmarks for publication without our written consent; (f) remove proprietary notices. Section 4(c) does not limit rights you have under an open-source licence (section 3.2).

5. Your responsibilities

5.1 You are responsible for your Authorised Users, their credentials, and their compliance with these Terms.

5.2 AI Providers are your providers. You choose and contract directly with your AI Providers. They are not our subprocessors and we are not responsible for them, their terms, their availability or what they do with data they receive.

5.3 Configuration. You decide your Gateway policies, rules, which clients are routed through the Gateway, and whether data flows outside the Gateway. Traffic that does not pass through a Gateway is not inspected.

5.4 What you send us. Do not submit to the Hosted Service the sensitive values the Gateway protects, protected health information, payment card data or special-category personal data, including in free-text fields such as device labels, organisation names or rule descriptions. The Hosted Service stores sensitive-term rules only as salted digests and refuses plaintext terms.

6. Plans and trials

6.1 Trials. We may offer a free trial of the Business Plan, normally for 30 days (we may shorten or extend it in writing, up to 90 days). Trials are provided "as is", without the SLA, support commitments, warranties or indemnities, and we may end them at any time. Unless you buy a Plan before the trial ends, trial Customer Data is deleted under section 14.4.

6.2 Plan changes. Upgrades take effect when ordered and are billed pro rata. Downgrades take effect at the next renewal.

7. Fees, renewal and taxes

7.1 Fees. You will pay the fees in your Order. Unless an Order says otherwise, fees are billed in advance (monthly or annually), in US dollars, and due within 30 days of invoice. Today we invoice manually. We may later offer card or other online payment through a third-party payment processor; if we do, its terms and our Privacy Policy will say so, and your use of it is optional unless your Order requires it.

7.2 Renewal. Subscriptions renew automatically for the same length of term unless either party gives notice of non-renewal at least 30 days before the end of the current term (self-serve monthly plans: before the next billing date). We will remind you before an annual renewal.

7.3 Price changes. We may change prices with at least 60 days' notice, effective from your next renewal. Prices in a signed Order Form are fixed for its term.

7.4 Late payment. If an undisputed amount is more than 30 days overdue, we may charge interest at 1% per month or the highest lawful rate, whichever is lower, and may suspend the Service under section 15 after notice. Dispute an invoice in good faith and in writing before its due date; we will work with you to resolve it.

7.5 Taxes. Fees exclude taxes. You pay all sales, use, VAT, GST and similar taxes on the fees, except taxes on our income. If you must withhold tax, you will gross up the payment so we receive the full amount, unless your Order says otherwise.

7.6 Fees are non-refundable except as these Terms expressly provide (sections 11.3, 12.1, 14.3 and 20.2, and service credits under the SLA).

8. Customer Data and confidentiality

8.1 Ownership. You own Customer Data. You grant us a limited right to process it only to provide, secure and support the Service, to prevent abuse, and as the DPA and law require.

8.2 What the Hosted Service receives. The Gateway processes your prompts, code, files and the values it protects locally; they are not sent to us. The Hosted Service receives only: counts per data category and outcome; Gateway versions, health and heartbeats; device identifiers and labels; audit-chain hashes; account data of Console users (name, email, roles, sign-in events, a tag derived from IP address); organisation settings; and rules (sensitive-term rules as salted digests). The Documentation lists this in full and vguard org telemetry shows the exact payload.

8.3 Personal data. The DPA applies to personal data we process for you.

8.4 Aggregated data. We may create and use aggregated statistics about use of the Service (for example, total requests protected across all customers) that do not identify you, any person, or any value, to operate and improve the Service. We will not sell Customer Data or use it to train AI models.

8.5 Confidentiality. Each party will protect the other's Confidential Information with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisers who need it and are bound by similar duties. "Confidential Information" is non-public information marked or reasonably understood as confidential, including Customer Data, pricing, and non-public security information. It excludes information that is or becomes public without breach, was already known, is independently developed, or is rightfully received from a third party. A party may disclose Confidential Information if required by law, after giving the other party prompt notice where lawful.

8.6 Feedback. You may give us suggestions. We may use them freely without obligation to you.

9. Intellectual property

We and our licensors own the Software, Service, Documentation and all improvements to them. You own your Customer Data, your rules, your policies and your organisation signing keys. Except as stated in these Terms (and any open-source licence under section 3.2), no rights are granted by implication.

10. Security

We maintain the technical and organisational measures described in the DPA (Annex 2) and the Security Overview. We may update them if the overall level of protection does not decrease.

11. Warranties

11.1 Mutual. Each party warrants that it has the authority to enter into these Terms.

11.2 Ours. During a paid term we warrant that (a) the Software and Service will perform materially as described in the Documentation, and (b) we will not materially decrease the security of the Hosted Service.

11.3 Remedy. If we breach section 11.2 and you tell us within 30 days of discovering it, we will use reasonable efforts to fix the problem. If we cannot within 30 days, either party may terminate the affected subscription and we will refund prepaid fees for the unused remainder of the term. This is your exclusive remedy for breach of section 11.2.

11.4 No tool catches everything. Detection is based on patterns, checksums, dictionaries and models. It can miss values in formats it has not been taught, values split across text, identity described in prose, content in languages or file types it cannot inspect, and anything sent outside the Gateway. It does not protect a compromised machine. We do not warrant that the Software will detect or protect every sensitive value, that no sensitive data will reach an AI Provider, or that use of the Software will make you compliant with any law, standard or contract (including GDPR, HIPAA or PCI DSS). Control mappings and evidence packs support your compliance work; they are not certifications or legal advice. You remain responsible for your own compliance, for your policies, and for testing (for example with vguard prove) that the Software meets your needs.

11.5 Disclaimer. Except as expressly stated in these Terms, the Software and Service are provided "as is" and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, title, non-infringement and uninterrupted or error-free operation, to the extent law allows.

12. Indemnities

12.1 By us. We will defend you against any third-party claim that the Software or Service, as we provide it, infringes that third party's patent, copyright or trademark or misappropriates its trade secret, and pay damages and costs finally awarded or agreed in settlement. We have no obligation for claims arising from: your modifications; combination with anything we did not provide, where the claim would not exist without the combination; use in breach of these Terms; a version we told you to update where the update would have avoided the claim; or open-source components provided free of charge. If a claim is made or likely, we may obtain the right for you to continue, modify the Software to be non-infringing, or end the affected subscription and refund prepaid fees for the unused remainder of the term. This section states our entire liability for infringement claims.

12.2 Free use. Section 12.1 does not apply to the Community Plan or trials.

12.3 By you. You will defend us against any third-party claim arising from Customer Data, your use of the Service in breach of the Acceptable Use Policy or law, or your AI Providers' claims arising from your use of their services, and pay damages and costs finally awarded or agreed in settlement.

12.4 Process. The indemnified party must give prompt notice (delay only relieves the indemnifying party to the extent it is prejudiced), give sole control of the defence and settlement to the indemnifying party (no settlement may admit fault of, or impose obligations on, the indemnified party without its consent), and give reasonable help at the indemnifying party's expense.

13. Limitation of liability

13.1 Excluded losses. Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data (other than the cost of restoring data from our backups), even if advised of the possibility.

13.2 Cap. Each party's total liability arising out of or relating to these Terms is limited to the fees paid and payable by you for the Service in the 12 months before the event giving rise to the liability. For the Community Plan and trials, our total liability is limited to USD 100.

13.3 Carve-outs. Sections 13.1 and 13.2 do not limit: (a) indemnity obligations under section 12; (b) your obligation to pay fees; (c) a party's liability for breach of section 8.5 (confidentiality), other than a breach relating to Customer Data, which is subject to the cap in section 13.2 unless an Order Form sets a separate higher cap; (d) a party's fraud, gross negligence or wilful misconduct; (e) your breach of section 4; or (f) liability that cannot be limited by law.

13.4 These limits apply to all causes of action together, whether in contract, tort (including negligence) or otherwise.

14. Term and termination

14.1 Term. These Terms last while you have an active subscription, trial or Community use.

14.2 For cause. Either party may terminate a subscription if the other materially breaches these Terms and does not cure the breach within 30 days of written notice, or becomes insolvent or subject to bankruptcy or similar proceedings. You may stop using the Community Plan at any time.

14.3 Effect. When a subscription ends: your rights to the Hosted Service and paid features end; unpaid fees for the term become due; and, if we terminate for your uncured breach, fees for the remainder of the term become due. If you terminate for our uncured breach, we refund prepaid fees for the unused remainder. Gateways continue to protect locally (section 3.6), and you may continue using the Community Plan within its limits.

14.4 Data return and deletion. You may export Customer Data from the Hosted Service using the Console at any time during the term and for 30 days after it ends. At the end of those 30 days we delete Customer Data from the live Hosted Service. Encrypted backups containing it expire and are deleted no later than 90 days after that. On your written request we will delete sooner. Deletion of your organisation erases every row the Hosted Service holds for it; data on your own machines is unaffected. We may keep records we must keep by law (for example invoices), and the activation records for air-gapped licences for the life of the licence.

14.5 Survival. Sections 4, 7 (for amounts owed), 8, 9, 11.4, 11.5, 12, 13, 14.3 to 14.5, 17 and 19 to 21 survive.

15. Suspension

We may suspend access to the Hosted Service, in whole or part, if: (a) an undisputed amount is more than 30 days overdue and remains unpaid 10 days after we give notice; (b) your use breaches the Acceptable Use Policy or threatens the security, integrity or availability of the Service or other customers; or (c) law or a government order requires it. We will give notice before suspending where practicable (and in any case promptly after), limit the suspension to what is needed, and lift it once the cause is resolved. During a suspension for non-payment the Console becomes read-only and new enrolments pause; Gateways continue to protect, heartbeat and receive signed rules.

16. Support

We provide support as described for your Plan in the Documentation or Order. Availability commitments for the Hosted Service are in the SLA.

17. Export control and sanctions

The Software includes encryption and may be subject to export control and sanctions laws of the United States and other countries. You will not export, re-export or provide access to the Software or Service in breach of those laws, including to any embargoed country or region or to any person on a restricted-party list. Each party represents that it is not on such a list or owned or controlled by a listed person.

18. Publicity

We will not use your name or logo in marketing without your prior written consent.

19. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, United States, excluding its conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods does not apply. The courts of the state and federal courts located in the State of Delaware have exclusive jurisdiction, except that either party may seek urgent injunctive relief in any competent court.

20. Changes to these Terms

20.1 We may update these Terms. We will post the new version with its "Last updated" date and, for changes that materially reduce your rights, give at least 30 days' notice by email to your account owner or in the Console.

20.2 Changes do not apply to a signed Order Form's current term unless you agree in writing. For other paid subscriptions, if a material change is adverse to you, you may terminate the affected subscription within the notice period and receive a pro rata refund of prepaid fees for the unused remainder. Otherwise the new version applies from its effective date. Changes needed for legal reasons or to address a security issue may take effect sooner.

21. General

21.1 Assignment. Neither party may assign these Terms without the other's consent, except to a successor in a merger, acquisition or sale of substantially all relevant assets, with notice.

21.2 Force majeure. Neither party is liable for delays caused by events beyond its reasonable control (this does not excuse payment obligations).

21.3 Notices. Notices to us go to postal address available on request from devopsplus11@gmail.com or devopsplus11@gmail.com (privacy matters) or devopsplus11@gmail.com (security matters); notices to you go to your account owner's email or the address in your Order. Email notices are effective when sent unless a bounce is received.

21.4 Subcontractors. We may use subcontractors and subprocessors (listed in the Subprocessors page) and remain responsible for them.

21.5 Relationship. The parties are independent contractors. There are no third-party beneficiaries.

21.6 Entire agreement. These Terms, with the documents in section 2, are the entire agreement on their subject and replace prior discussions. Terms in your purchase orders or vendor portals do not apply, even if accepted electronically.

21.7 Severability and waiver. If a provision is unenforceable, the rest remains in force. Failure to enforce a provision is not a waiver.