Terms of service.

1. Acceptance & scope

By creating a CloakAPI account or sending a request through the gateway, you agree to these Terms. Enterprise customers with a counter-signed Master Service Agreement are governed by that MSA; these Terms back-fill anything the MSA does not address.

The Service consists of: the gateway endpoints at api.cloakapi.io, the portal at app.cloakapi.io, the desktop client, the receipt-verifier, the docs, and the public APIs documented at docs.cloakapi.io.

2. Customer responsibilities

• You are responsible for all traffic sent under your API keys.
• You will not use the Service to violate law, infringe rights, or transmit malicious code.
• You will not attempt to break our zero-payload logging invariant by injecting payload-bearing fields into metadata channels.
• You will keep the desktop client and your token vault secured. Loss of the recovery quorum (Shamir 3-of-3) is irrecoverable by us — that is the design.

3. Provider responsibilities

• We will operate the Service with commercial diligence and the SLOs published at status.cloakapi.io.
• We will not read or transmit your prompt or response payloads. The middleware-level invariant is described in /legal/privacy and the security posture at /legal/security.
• We will give 30 days' advance notice of material changes to these Terms, sub-processors, or pricing for established subscriptions.

4. Fees & billing

The price book is published at /pricing and machine-readably at docs/pricing/price-book.json. CloakAPI charges a markup on the underlying provider cost: 15% for CloakAPI keys (pooled provider keys), 5% for BYOK (bring your own provider keys), 5% for Complete-local (self-hosted / desktop model).

Pricing accuracy. The per-model provider prices we display — in the portal, the AI model selector, and the price book — are based on each provider's own published pricing, which we track on a best-effort basis. A displayed price may occasionally be out of date or incorrect, and some providers use dynamic, variable, or individually negotiated pricing that we can only stipulate or estimate in advance. We reserve the right to correct any displayed or quoted price. The authoritative amount charged for any individual call is the amount recorded on that call's signed receipt, which reflects the actual provider cost plus the applicable markup at the time of the call.

Prepaid balance accounts are debited per call. Postpaid invoiced accounts settle monthly, net-30. Disputes must be raised within 60 days of invoice date.

Taxes: prices exclude VAT. Norwegian VAT is added where applicable. Reverse charge applies for B2B EU customers with a valid VAT ID.

5. Intellectual property

You retain all rights to your prompts, responses, and any data you process through the Service. We retain all rights to the Service software, the receipt-chain protocol implementation, the detector library, and the brand. The OpenReceipt spec is licensed under CC-BY 4.0.

6. Confidentiality

Each party will protect the other party's confidential information with the same care it gives its own (and not less than reasonable). Account data, support communications, and contract terms are confidential. The receipt chain itself is public by design (the value of the spec depends on it).

7. Warranties & disclaimers

We warrant that the Service performs materially as documented. EXCEPT FOR THIS, THE SERVICE IS PROVIDED “AS IS” WITHOUT IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

7a. Scope of privacy protection — what CloakAPI does NOT protect against

CloakAPI tokenises detected personal data before it reaches the AI provider — a real but bounded guarantee. Being explicit about its limits is part of the product. The following are out of scope; evaluate them against your own threat model. The full technical threat model is public at docs.cloakapi.io/security/threat-model.

• 1. The AI's own generated output. Tokenisation protects what you send. It cannot control what the model writes back, hallucinates, or reproduces from its own training data. If a model was trained on data about you, it may surface that regardless of how your prompt is tokenised.
• 2. The structure and context of your request. The shape, length, topic and surrounding context of a prompt still reach the AI. Higher privacy tiers redact and scramble more, but some structural / contextual signal is inherent to getting a useful answer.
• 3. Data outside the detector coverage. The engine covers a defined set of entity types (names, emails, phone numbers, national IDs, cards, IBANs, addresses, organisations, and similar). Sensitive data outside those categories can pass through as plaintext.
• 4. What the upstream AI provider does with a request. Signed receipts prove what CloakAPI did; they cannot prove an upstream provider did not log the (tokenised) request, and we cannot enforce a provider's retention policy. Review each provider's DPA, and use BYOK or complete-local mode where that matters.
• 5. A compromised customer device or browser. Malware, a malicious browser extension, or XSS with full DOM access can observe data before tokenisation. Tokenisation runs in your own browser context and cannot defend a device that is already compromised.
• 6. OS-level keyloggers or screen capture. Software that reads keystrokes or screen pixels sits below the application layer and is outside CloakAPI's threat boundary.
• 7. A compromise of CloakAPI's own infrastructure. CloakAPI is a trusted intermediary; a compromise of the gateway or key-management systems would break these guarantees. Customers who cannot accept that dependency can pursue a self-hosted deployment (roadmap).
• 8. “harvest-now, decrypt-later” quantum attacks. Current transport and signature cryptography (TLS 1.3 / ECDSA P-256) is not post-quantum secure; post-quantum migration is on the roadmap.
• 9. Transparency log participation is opt-in. Receipts are always cryptographically signed, but only appear in the public transparency feed if the account has opted in.

8. Liability cap

Each party's aggregate liability under these Terms is capped at the fees paid to CloakAPI in the 12 months preceding the incident. Neither party is liable for indirect, incidental, consequential, or lost-profit damages. The cap does not apply to (a) breach of confidentiality, (b) gross negligence or wilful misconduct, or (c) IP-infringement indemnification.

9. Indemnification

We will defend you against third-party claims that the Service, used as documented, infringes their IP. You will defend us against claims arising from your use of the Service in violation of these Terms or applicable law.

10. Termination

Either party may terminate for material breach with 30 days' written notice and a cure period. You may close your account at any time from the portal. We will delete your account residuals within 30 days, retaining only what bookkeeping, tax and audit obligations require — invoices and financial records for up to 7 years, pseudonymised.

11. Governing law & venue

These Terms are governed by Norwegian law. Disputes are resolved in Oslo District Court (Oslo tingrett), subject to any consumer-protection rights you have under your country of residence.

12. Contact

Legal: legal@cloakapi.io · Privacy/DPO: dpo@cloakapi.io · Security: security@cloakapi.io

Related documents