Terms of service.

1. Acceptance & scope

By creating a CloakAPI account or sending a request through the gateway, you agree to these Terms. Enterprise customers with a counter-signed Master Service Agreement are governed by that MSA; these Terms back-fill anything the MSA does not address.

These Terms govern the CloakAPI developer platform only: the gateway at api.cloakapi.io, official client SDKs, the local MCP server, cloak-proxy, the desktop client, the browser extension, the web chat and portal at app.cloakapi.io, the receipt-verifier, and the documentation at docs.cloakapi.io.

Fees for the platform are the markup rates at /pricing (machine-readable docs/pricing/price-book.json). End-user applications listed in the Consumer application terms are billed on those applications' own pricing pages and are not governed by the platform fee schedule below except to the extent an application, acting as a platform customer, consumes prepaid markup.

2. Customer responsibilities

• You are responsible for all traffic sent under your API keys.
• You will not use the Service to violate law, infringe rights, or transmit malicious code.
• You will not attempt to break our zero-payload logging invariant by injecting payload-bearing fields into metadata channels.
• You will keep the desktop client and your token vault secured. Loss of the recovery quorum (Shamir 3-of-3) is irrecoverable by us — that is the design.
• If you build on CloakAPI and enable usage-metadata attribution, you will disclose to your own end users that content-free usage metadata (and a pseudonym you supply) is processed by CloakAPI as your sub-processor, and you will never put personal data (name, email, phone, or any other PII) in the X-Cloak-End-User header — it must be an opaque token you control. Our guard drops PII-shaped values rather than storing them, but designing for that is your responsibility. See docs.cloakapi.io/platform/attribution.

3. Provider responsibilities

• We will operate the Service with commercial diligence and the SLOs published at status.cloakapi.io.
• We will not read your prompt or response payloads except to relay them to the AI provider you route the request to and to return the response to you. The middleware-level invariant is described in /legal/privacy and the security posture at /legal/security.
• We will give 30 days' advance notice of material changes to these Terms, sub-processors, or pricing for established accounts.

4. Fees & billing

The price book is published at /pricing and machine-readably at docs/pricing/price-book.json. CloakAPI charges a markup on the underlying provider cost: 15% for CloakAPI keys (pooled provider keys), 5% for BYOK (bring your own provider keys), 5% for Complete-local (self-hosted / desktop model).

Rate changes. We may change our markup rates and fees at any time. A change takes effect for prepaid pay-as-you-go usage on the next call made after the change is published (each call is billed at the markup in effect when the call is made, per that call's receipt), and for established accounts after 30 days' advance notice under §3. Your continued use of the Service after a change takes effect constitutes acceptance of the revised rates.

Pricing accuracy. The per-model provider prices we display — in the portal, the AI model selector, and the price book — are based on each provider's own published pricing, which we track on a best-effort basis. A displayed price may occasionally be out of date or incorrect, and some providers use dynamic, variable, or individually negotiated pricing that we can only stipulate or estimate in advance. We reserve the right to correct any displayed or quoted price. The authoritative amount charged for any individual call is the amount recorded on that call's receipt, which reflects the actual provider cost plus the applicable markup at the time of the call.

Prepaid balance accounts are debited per call. Postpaid invoiced accounts settle monthly, net-30. Disputes must be raised within 60 days of invoice date.

Taxes: prices exclude VAT. Norwegian VAT is added where applicable. Reverse charge applies for B2B EU customers with a valid VAT ID.

5. Intellectual property

You retain all rights to your prompts, responses, and any data you process through the Service. We retain all rights to the Service software, the receipt-chain protocol implementation, the detector library, and the brand. The OpenReceipt spec is licensed under CC-BY 4.0.

6. Confidentiality

Each party will protect the other party's confidential information with the same care it gives its own (and not less than reasonable). Account data, support communications, and contract terms are confidential. The receipt chain itself is public by design (the value of the spec depends on it).

7. Warranties & disclaimers

We warrant that the Service performs materially as documented. EXCEPT FOR THIS, THE SERVICE IS PROVIDED “AS IS” WITHOUT IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

7a. Scope of privacy protection — what CloakAPI does NOT protect against

CloakAPI tokenises detected personal data before it reaches the AI provider — a real but bounded guarantee. Being explicit about its limits is part of the product. The following are out of scope; evaluate them against your own threat model. The full technical threat model is public at docs.cloakapi.io/security/threat-model.

• 1. The AI's own generated output. Tokenisation protects what you send. It cannot control what the model writes back, hallucinates, or reproduces from its own training data. If a model was trained on data about you, it may surface that regardless of how your prompt is tokenised.
• 2. The structure and context of your request. The shape, length, topic and surrounding context of a prompt still reach the AI. Higher privacy tiers redact and scramble more, but some structural / contextual signal is inherent to getting a useful answer.
• 3. Data outside the detector coverage. The engine covers a defined set of entity types (names, emails, phone numbers, national IDs, cards, IBANs, addresses, organisations, and similar). Sensitive data outside those categories can pass through as plaintext.
• 3a. Writing in scripts the on-device name detector does not fully cover. The name detector is dictionary- and model-bound. Thai and Khmer writing on a page may still be present in the request after detected names have been replaced. CloakAPI does not refuse the send on that leftover writing. A receipt records that on-device tokenisation ran for that send; it is not a claim that every name in every script was found. Limits of coverage are stated here, not in the receipt.
• 4. What the upstream AI provider does with a request. Receipts record what CloakAPI did; they cannot prove an upstream provider did not log the (tokenised) request, and we cannot enforce a provider's retention policy. Review each provider's DPA, and use BYOK or complete-local mode where that matters.
• 5. A compromised customer device or browser. Malware, a malicious browser extension, or XSS with full DOM access can observe data before tokenisation. Tokenisation runs in your own browser context and cannot defend a device that is already compromised.
• 6. OS-level keyloggers or screen capture. Software that reads keystrokes or screen pixels sits below the application layer and is outside CloakAPI's threat boundary.
• 7. A compromise of CloakAPI's own infrastructure. CloakAPI is a trusted intermediary; a compromise of the gateway or key-management systems would break these guarantees. Customers who cannot accept that dependency can pursue a self-hosted deployment (roadmap).
• 8. “harvest-now, decrypt-later” quantum attacks. Current transport and signature cryptography (TLS 1.3 / ECDSA P-256) is not post-quantum secure; post-quantum migration is on the roadmap.
• 9. Transparency log participation is opt-in. Receipts use ECDSA P-256 / SHA-256 when they are issued, but only appear in the public transparency feed if the account has opted in.

7b. Known limitations

Personal-data detection runs on the client device and is best-effort and probabilistic. It can miss personal data, and it can incorrectly flag ordinary text. Results can vary by data type, language or script, and formatting, including punctuation, spacing, line breaks, and address layout. The service does not perform server-side PII detection or tokenisation of user content. Review the content your client displays before sending; detection does not guarantee that every personal-data value will be found or removed. Where this site describes personal data as replaced or removed before content leaves your device, it refers to the values the detector finds; it does not promise that all personal data is found.

Measured examples

• Addresses: In a test of 12 synthetic address formats using TypeScript SDK 1.3.30 and engine 1.6.1, address fragments remained in four formats: a Norwegian street and number split by a line break; a Swedish number before the street name; a US P.O. Box with postal code; and a German Postfach with number. Each of those four misses appeared in 3 of 3 positive requests in both BALANCED and MAX; the tested negative controls had 0 of 3 raw matches. A separate wire test using SDK 1.3.29, then pinned by the apps, measured misses in 9 of 12 tested formats. These are results for the named versions, routes, and fixtures only.
• Names in convert: In a limited test of the CloakAPI convert app in BALANCED mode, names in ordinary TXT and Markdown content were missed in all 6 tested cases for each format. PDF text, DOCX, HTML, and EML each passed 6 of 6 cases in that same test; this does not guarantee coverage in those formats. MAX was only partly measured (PDF text and DOCX), and the negative and rejection controls were not measured.

These measurements describe the listed test material. They are not an estimate of the share of all requests that contain missed data, and they do not guarantee results for other content, routes, or versions.

File and image content

Handling of file and image content differs between clients and file types. Review of the prepared content before sending has only been tested for plain-text files, in test builds of two clients (the browser extension and CloakAPI Convert); it has not been tested for other file types, images or routes, or for every released build, and not every client shows the prepared content before sending. The browser extension's test of PDF files used a fixed synthetic substitute, so extraction, review and sending of real PDF and image content have not been tested end to end. Some clients, such as the browser extension, can let you choose to send a file unchanged when it cannot be processed; in that case the original file goes to the AI provider you chose. Check what your client shows before you send, and do not send files or images you are not prepared to share with the provider.

8. Liability cap

Each party's aggregate liability under these Terms is capped at the fees paid to CloakAPI in the 12 months preceding the incident. Neither party is liable for indirect, incidental, consequential, or lost-profit damages. The cap does not apply to (a) breach of confidentiality, (b) gross negligence or wilful misconduct, or (c) IP-infringement indemnification.

9. Indemnification

We will defend you against third-party claims that the Service, used as documented, infringes their IP. You will defend us against claims arising from your use of the Service in violation of these Terms or applicable law.

10. Termination

Either party may terminate for material breach with 30 days' written notice and a cure period. You may close your account at any time from the portal. We will delete your account residuals within 30 days, retaining only what bookkeeping, tax and audit obligations require — invoices and financial records for the Bokføringsloven statutory minimum of 5 years (plus any legal-hold), pseudonymised.

11. Governing law & venue

These Terms are governed by Norwegian law. Disputes are resolved in Oslo District Court (Oslo tingrett), subject to any consumer-protection rights you have under your country of residence.

12. Contact

Legal: legal@cloakapi.io · Privacy/DPO: dpo@cloakapi.io · Security: security@cloakapi.io

Related documents