Terms of Service

1. The agreement, and who it is with

These Terms of Service ("Terms") are a binding agreement between you ("you", "Customer") and Umang Kumar, trading as Cirvix, a sole proprietor established in India ("Cirvix", "we", "us"), governing your use of Cirvix AgentControl and any related software, documentation, and websites (together, the "Software").

Cirvix is not an incorporated company. We state that plainly because you are entitled to know the legal nature of your counterparty before you contract with it.

By installing, accessing, or using the Software, or by completing a purchase, you accept these Terms. If you do not accept them, do not use the Software. If you are accepting on behalf of an organisation, you represent that you are authorised to bind it, and "you" means that organisation.

2. Purchases are made through Dodo Payments

Paid plans are sold by Dodo Payments Inc. ("Dodo Payments") acting as the Merchant of Record. When you buy a paid plan, your contract of sale is with Dodo Payments, not with us. Dodo Payments is the seller, charges your payment method, issues the invoice, and is responsible for applicable sales tax, VAT and GST in your jurisdiction.

Dodo Payments' own Buyer Terms and privacy notice apply to the transaction alongside these Terms. Where they conflict with these Terms on a matter of the sale itself — payment, invoicing, tax, or refund mechanics — their terms govern that matter.

We never receive your card or bank details. Payment credentials are collected and processed by Dodo Payments and its payment processors and are not transmitted to us at any point.

Invoices and receipts are issued electronically, by email.

3. Licence

Two licences apply, and which one you are under depends on which part you are using.

The enforcement engine is open source. The policy evaluator, risk classifier, secret detection and handle substitution, local control socket, MCP gateway, audit chain, scanner and cirvix CLI — published as @cirvix_ai/agent-control and cirvix on PyPI — are licensed under the Apache License 2.0. Your rights in that code come from Apache 2.0 and not from these Terms, including the right to read it, modify it, fork it, and run it in production without payment. Nothing in this section takes any of that away. It is the part that decides whether a tool call runs, and a security control nobody is allowed to read is one you are being asked to take on faith.

The control plane is not. Multi-tenant policy distribution, the team vault, SSO and SCIM, the approvals workflow, hosted audit retention and export, compliance evidence reporting, fleet telemetry and billing are proprietary. Subject to these Terms and to payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to install and use that software for your internal business purposes, within the limits of the plan you hold.

The free tier is the Apache-licensed engine in full. It is not a reduced build of the paid product, it enforces the same decisions, and it does not report usage to us.

4. What you may not do

These restrictions apply to the proprietary control plane and the paid services. They do not apply to the Apache-licensed engine, whose terms are set by Apache 2.0 alone.

You may not, and may not permit any third party to:

• resell, sublicense, rent, lease, or provide the control plane as a hosted or managed service to a third party, except as expressly permitted in writing;
• reverse engineer, decompile, or disassemble the control plane, except to the extent that restriction is prohibited by applicable law;
• remove, obscure, or alter any proprietary notice, licence header, or attribution — including the attribution required by Apache 2.0 section 4 when you redistribute the engine;
• circumvent or disable a server-side entitlement control, or use the paid services beyond the limits of your plan;
• use the paid services unlawfully, or in breach of applicable export control or sanctions law.

Two restrictions that used to sit here have been removed rather than quietly narrowed, because they cannot coexist with an Apache 2.0 grant and it would be dishonest to leave them where a reader might think they still bind: you may develop a competing policy-enforcement engine from this code, and you may modify the free tier's local decision counter. That counter lives in a file on your own machine and is honour-system metering, which the source says in as many words. What is not honour-system is anything the control plane decides — shared policy, team approvals, the org vault, hosted audit retention — because those are enforced on our side of the boundary.

5. Your responsibilities

The Software enforces the rules that you write. Its usefulness is a direct function of your policy configuration, and configuring it is your responsibility, not ours.

• You author and maintain your policy. A rule set that permits something it should not will permit it. We do not review, approve, or audit your policy.
• You manage your own keys. CIRVIX_MASTER_KEY is customer-managed. There is no escrow and no recovery path. If you lose it, we cannot restore access to anything encrypted with it, and we are not liable for that loss.
• You operate your own deployment. In a self-hosted deployment, availability, backups, patching, network posture and access control are yours.
• You are responsible for your users. Including anyone you grant access to your deployment.

6. What the Software does not promise

This section is the most important one in this document. Read it before you rely on the Software for anything that matters.

Cirvix AgentControl is a policy enforcement and audit tool. It is not a guarantee of security, safety, correctness, or compliance, and must not be relied on as one.

• We do not warrant that the Software will prevent any particular attack, exfiltration, misuse, or loss. An AI agent operating within your systems may act in ways no rule anticipated.
• We do not warrant that the Software will not block a legitimate action, or that it will be free of false positives or false negatives.
• We make no certification claim. We are not SOC 2 or ISO 27001 certified. Reports the Software generates describe coverage and never assert compliance, and you must not present them as certification.
• We publish no availability or uptime commitment unless one is separately agreed in a signed written contract.
• Performance figures are design targets or measurements of a specific environment, not guarantees of performance in yours.

You remain solely responsible for your own security posture, your regulatory obligations, and for any decision you take on the basis of the Software's output.

7. Fees, renewal, and changes

Paid plans are billed in advance on the cycle you select at checkout and renew automatically until cancelled. You may cancel at any time; cancellation takes effect at the end of the paid period then in progress, and the Software remains available to you until then.

We may change prices for future billing periods. Where we do, existing subscribers will be given reasonable notice before the change takes effect, and may cancel before renewal if they do not accept it.

Each plan includes a daily allowance stated on the pricing page. There is no overage charge on any plan. Once the allowance for a day is spent, further decisions are refused until the counter resets at 00:00 UTC; you are never billed for usage beyond what your plan includes, and no charge can arise that you did not choose at checkout.

8. Refunds

Refunds are governed by our Refund Policy, which forms part of these Terms, and are processed by Dodo Payments as Merchant of Record.

9. Intellectual property

The Software, and all intellectual property in it, remains ours or our licensors'. These Terms grant a licence, not a sale, and no rights are granted except those expressly stated.

Your data is yours. We claim no ownership of your policies, audit records, configuration, or any data processed by your deployment.

If you send us feedback or suggestions, you grant us a perpetual, irrevocable, royalty-free licence to use them without obligation or attribution.

10. Disclaimer of warranties

THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY. To the maximum extent permitted by law we disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, accuracy, and any warranty arising from course of dealing or trade usage.

We do not warrant that the Software will be uninterrupted, timely, secure, or error-free, or that defects will be corrected.

Some jurisdictions do not allow the exclusion of certain warranties. Where that is so, the exclusions above apply to the fullest extent permitted, and nothing in these Terms limits rights that cannot lawfully be limited.

11. Limitation of liability

To the maximum extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profit, revenue, business, goodwill, anticipated saving, or data, however caused and on any theory of liability, whether or not we were advised of the possibility.

Our total aggregate liability arising out of or relating to these Terms or the Software, for all claims in aggregate, will not exceed the greater of (a) the total fees you actually paid for the Software in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) USD 100.

Where the Software is provided free of charge, our total aggregate liability is limited to USD 100.

These limits apply even if a limited remedy fails of its essential purpose. They reflect a deliberate allocation of risk between us and are a fundamental basis of the pricing: without them, the Software would not be offered at these prices.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that applicable law does not permit to be limited. If you are a consumer, your statutory rights are unaffected.

12. Indemnity

You will indemnify, defend, and hold us harmless from and against any claim, demand, loss, liability, damage, cost, or expense (including reasonable legal fees) arising out of or relating to: (a) your use of the Software; (b) your policy configuration and the actions it permitted or denied; (c) your breach of these Terms or of applicable law; or (d) any claim by a third party, including any of your own customers, users, or regulators, relating to your deployment.

13. Suspension and termination

You may stop using the Software at any time. We may suspend or terminate your licence on notice if you materially breach these Terms, use the Software unlawfully, or fail to pay.

On termination, your licence ends and you must cease use. Sections that by their nature should survive — including 9 (Intellectual property), 10 (Disclaimer), 11 (Limitation of liability), 12 (Indemnity), and 15 (Governing law) — survive termination.

14. Export control and sanctions

You represent that you are not located in, and are not a national or resident of, any country subject to comprehensive trade sanctions, and that you are not on any restricted-party or denied-persons list. You will not export or re-export the Software in breach of applicable export control law.

15. Governing law and disputes

These Terms are governed by the laws of India, without regard to conflict-of-law rules. The courts of India have exclusive jurisdiction, and you consent to that jurisdiction and venue.

If you are a consumer resident in the European Union or the United Kingdom, this clause does not deprive you of the protection of the mandatory consumer law of your country of residence, or of the right to bring proceedings there.

Any claim must be brought within one (1) year of the event giving rise to it, or be permanently barred, except where applicable law does not permit that limit.

16. General

• Changes. We may update these Terms. Material changes will be notified by updating the effective date at the top of this page and, for paid subscribers, by reasonable notice before renewal. Continued use after the change takes effect is acceptance.
• Entire agreement. These Terms, together with the Privacy Policy and Refund Policy, are the entire agreement between us on this subject, and supersede prior discussions.
• Severability. If a provision is held unenforceable, it is modified to the minimum extent necessary and the rest remains in force.
• No waiver. A failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these Terms without our written consent. We may assign them in connection with a reorganisation or a sale of the business.
• Force majeure. Neither party is liable for a failure caused by events beyond its reasonable control.
• No agency. Nothing here creates a partnership, agency, or employment relationship.

17. Contact

Questions about these Terms: [email protected], or via the contact form.

Questions about a payment, invoice, or refund should go to Dodo Payments, who are the seller of record, or to us and we will direct them.