Terms of Service

Plain-English summary (binding text is below this box, not in it): you can use the open-source enclawed-oss code for free under MIT. If you want the proprietary enclawed-enclaved build and vendor support — signed binaries, hardening reviews, dedicated engineer hours, OSCAL emission help, accreditation work — you take out a paid subscription. All enclawed-enclaved subscriptions are business-to-business and sold only under an individually negotiated order form or Master Services Agreement (MSA); there are no self-serve plans, no public tiers, and no fixed list prices. Scope, term, deployment count, unlocked primitives, support level, fees, renewal, and refunds are all set in your signed agreement. Paddle remains our Merchant of Record for invoiced payments. Vulnerability disclosures are always free.

1. Acceptance and scope

These Terms of Service (the “Terms”) form a binding agreement between Enclawed LLC, a California limited liability company (“Enclawed”, “we”, “us”), and the individual or legal entity (“you”, “Customer”) that takes out a paid enclawed-enclaved Subscription under an order form or Master Services Agreement (MSA) with us. By signing that agreement, or otherwise using a paid Subscription, you accept these Terms.

If you do not agree, do not subscribe. The MIT-licensed enclawed-oss source code remains available for free use under the terms of the MIT License regardless of whether you accept these Terms.

If you are agreeing on behalf of a company or other legal entity, you represent that you have authority to bind that entity to these Terms.

2. Definitions

• “Open Source Software” or “OSS” means the enclawed-oss source code distributed under the MIT License at github.com/enclawed/enclawed-oss. The Open Source Software is distributed with zero vendor support; the only standing channel for users of the Open Source Software is [email protected] for vulnerability disclosure and security-relevant bug reports.
• “Proprietary Software” means enclawed-enclaved: the closed-source production build derived from the Open Source Software, distributed as signed binaries to Customers with any active paid Subscription, with proprietary source-code access additionally provided, where your order form or MSA expressly includes it, under a separate Non-Disclosure Agreement (“NDA”) and Non-Compete Agreement (“NCA”) referenced in that agreement. Both instruments must be signed by every individual who will receive access to the proprietary source.
• “Subscription” means a paid enclawed-enclaved engagement provided under an individually negotiated order form or Master Services Agreement (“MSA”). There are no fixed public tiers and no published list prices; all commercial terms are quoted and agreed per engagement. There are no paid plans for the Open Source Software.
• “Vendor-Delivered Support” means support, services, and access reserved to active Subscribers of enclawed-enclaved: email tickets, response SLAs, advance security advisories, hardening reviews, accreditation-engineer hours, OSCAL emission guidance, custom security features, and any other engineering time delivered by us. No Vendor-Delivered Support is provided for the Open Source Software at any tier; the only support channel for the Open Source Software is the vulnerability-disclosure inbox referenced above.
• “Subscription Term” means the period during which a Subscription is in force, beginning on the start date stated in your order form or MSA and continuing until validly cancelled in accordance with section 4 and that agreement.
• “Minimum Commitment” means the minimum subscription period (if any) stated in your order form or MSA.
• “Consumer” or “B2C Customer” means a natural person acting wholly or mainly outside that person’s trade, business, craft, or profession.
• “Business Customer” or “B2B Customer” means a Customer that is a legal entity, or a natural person acting in the course of a business, trade, or profession.
• “Merchant of Record” or “MoR” means Paddle.com Market Limited (“Paddle”), the third-party seller of record for the invoiced payments on your Subscription.

2A. Paddle as Merchant of Record; B2B vs B2C

2A.1 Merchant of Record. All paid enclawed-enclaved Subscriptions are sold under an individually negotiated order form or MSA and billed through Paddle, our Merchant of Record. Paddle is the seller of record for tax purposes, collects all applicable value-added tax (VAT), goods and services tax (GST), and US state sales tax on Enclawed’s behalf, and issues your receipt. The legal services agreement governing your access to the Subscription is between you and Enclawed (governed by these Terms together with your signed order form or MSA, which supplements and, where it conflicts, prevails over these Terms); the payment transaction is between you and Paddle. Payments flow through Paddle Invoicing (wire transfer, ACH, or card via invoice email) on the schedule set in your order form or MSA, governed by Paddle’s invoiced-consumer-terms.

2A.2 Business-to-business only. enclawed-enclaved Subscriptions are offered and sold solely to Business Customers under a signed order form or MSA. Enclawed does not offer a self-serve or Consumer (B2C) Subscription, and there is no consumer checkout. Accordingly:

• Because there is no Consumer Subscription, no statutory consumer refund / withdrawal window arises on any Subscription. Cancellation, renewal, and refund mechanics are governed by section 4 of these Terms and by your signed order form or MSA; see also the Refund Policy.
• To the extent any natural person nonetheless qualifies as a Consumer under EU Directive 2011/83/EU, the UK Consumer Rights Act 2015, the California Consumer Legal Remedies Act, the Australian Consumer Law, or an equivalent statute, that person’s mandatory consumer-protection rights apply and cannot be waived; where any provision of these Terms would purport to waive such a right against a Consumer, that provision is void to the extent of the conflict only.
• The limitation-of-liability cap in section 11, the warranty disclaimer in section 10.2, the arbitration provision in section 15.3, and the no-class-action provision in section 15.4 apply in full to Business Customers.
• Every Customer signing an order form or MSA is presumed to be a Business Customer and acknowledges that it is contracting in the course of a business, trade, or profession.

3. Subscription, billing, taxes

3.1 Scope of engagement. The scope of your Subscription — the deployment count, the hardening primitives unlocked, the accreditation depth, the support level, the term, and the fees — is set out in your individually negotiated order form or MSA. There are no fixed public tiers; pricing is quoted per engagement.

3.2 Billing. All paid Subscriptions are billed through Paddle (our Merchant of Record) in the amount and on the cadence stated in your order form or MSA, via Paddle Invoicing (wire transfer, ACH, or card via invoice email). There is no public price list; the fees are those agreed in your signed order form or MSA.

3.3 Renewal. Renewal of a Subscription is governed by the term and renewal provisions of your signed order form or MSA. Where your agreement provides for automatic renewal, and for California Subscribers, the renewal disclosure in your order form constitutes the clear and conspicuous disclosure required by California Business and Professions Code §§ 17601–17606 (the California Automatic Renewal Law).

3.4 Fee changes. Fees for a contracted term are fixed for that term. Any change to fees applies only at renewal and only as provided in your order form or MSA, on at least thirty (30) days’ written notice.

3.5 Taxes. Listed prices are exclusive of taxes, duties, levies, or similar charges. You are responsible for any sales tax, VAT, GST, or withholding tax applicable in your jurisdiction. Where we are required by law to collect such taxes (for example, US states where we have economic nexus, or EU Member States under the One-Stop Shop scheme), we will add them to your invoice.

3.6 Late payment. Invoices not paid within fifteen (15) days of issuance accrue interest at the lesser of 1.5% per month or the maximum rate permitted by California law. We may suspend Vendor-Delivered Support and Proprietary Software access while any invoice is past due.

4. Cancellation and refunds

4.1 Governed by your agreement. Cancellation, renewal, term, and refund mechanics for every enclawed-enclaved Subscription are governed by the signed order form or MSA for that Subscription; the contract is the contract. Because all Subscriptions are business-to-business (section 2A.2), no statutory consumer refund window applies. All cancellation, milestone, and refund terms are individually negotiated and assumed to be the product of bargaining between sophisticated commercial parties.

4.2 No pro-rata refunds unless agreed. Except where your order form or MSA provides otherwise, fees for the then-current billing period are non-refundable. Cancellation stops future charges as provided in your agreement; it does not refund a partially-used period. To cancel or raise a refund-eligibility question, email [email protected].

4.3 Discretionary refunds via Paddle. Where Paddle, at its sole discretion under its own refund policy, issues a refund notwithstanding the absence of a statutory or contractual entitlement, Enclawed will not contest that refund, and the seller-side cancellation mechanics in your signed agreement continue to apply to any unpaid balance.

4.4 Termination for cause by Customer. You may terminate immediately, without further obligation, if we materially breach these Terms or your order form / MSA and fail to cure the breach within thirty (30) days of written notice. In that event you are entitled to a pro-rata refund of any prepaid fees corresponding to the period after termination.

4.5 Termination for cause by Enclawed. We may terminate any Subscription immediately for: non-payment continuing more than thirty (30) days past due; violation of section 6 (Acceptable Use); a breach of confidentiality under section 8 that we deem material; or compliance with law, regulation, or court order. Termination under this paragraph does not waive your payment obligations for the contracted term set out in your order form or MSA.

5. License grants

5.1 Open Source Software. The Open Source Software is licensed under the MIT License at the file LICENSE in the repository. These Terms do not modify, restrict, or supersede that license. You may use, copy, modify, and redistribute the Open Source Software in accordance with the MIT License whether or not you have an active Subscription. The Open Source Software is provided without vendor support; the only standing channel for users of the Open Source Software is [email protected] for vulnerability disclosure and security-relevant bug reports. The Open Source Software may lag behind the Proprietary Software. enclawed-enclaved is the bleeding-edge development head: new hardening primitives, accreditation features, threat-model updates, and FIPS / FedRAMP submission artefacts land in the Proprietary Software first. Snapshots are exported from the Proprietary Software into the Open Source Software at Enclawed’s sole discretion and on no fixed cadence; at any given moment the Open Source Software may be days, weeks, or months behind the current Proprietary Software, and Enclawed makes no representation or warranty as to feature parity between the two.

5.2 Proprietary Software. Every active Subscription grants you a non-exclusive, non-transferable, non-sublicensable, time-limited license to use the Proprietary Software (the signed enclawed-enclaved production binary, including the proprietary hardening primitives unlocked under your agreement) for the duration of your active Subscription, solely for your internal business purposes. Proprietary source-code access is provided only where your order form or MSA expressly includes it, and only to individuals who have executed both: (i) a Non-Disclosure Agreement (“NDA”) covering the proprietary source and any non-public technical information; and (ii) a Non-Compete Agreement (“NCA”) prohibiting that individual, for the agreed term and territory, from designing, developing, or contributing to a product or service that materially replicates the features of enclawed-enclaved using knowledge acquired from the proprietary source. Both NDA and NCA are referenced in your order form or MSA and must be signed before any source-code access is granted. Where your agreement does not include source-code access, your Subscription is limited to the signed binary plus the documentation distributed with it, and no NDA or NCA is therefore required.

You may not: (a) sublicense, resell, lease, or distribute the Proprietary Software; (b) use it to create a product or service that competes with enclawed-enclaved; (c) reverse engineer or decompile it except to the extent expressly permitted by applicable law; or (d) remove or alter any proprietary notices.

5.3 Trademarks. “enclawed”, “enclawed-oss”, and “enclawed-enclaved” are trademarks of Enclawed LLC. Nothing in these Terms grants any right to use those marks except as necessary to identify our products and services accurately.

6. Acceptable use

You agree not to use any Subscription, or any Proprietary Software you access through it, to:

• Resell or redistribute Vendor-Delivered Support, the Proprietary Software, or proprietary documentation to any third party not covered by your Subscription;
• Circumvent or attempt to circumvent the deployment caps, seat limits, or other usage limits associated with your tier;
• Build a product or service that materially replicates the features of enclawed-enclaved from the Proprietary Software made available to you under section 5.2;
• Probe, scan, or test the vulnerability of our systems except via the responsible-disclosure process at [email protected];
• Violate applicable law, regulation, export-control restriction, or third-party rights through your use of any product or service provided by us;
• Use the Proprietary Software, proprietary source access (where granted under section 5.2), or accreditation hours after the Subscription has terminated.

7. Vendor-Delivered Support scope

7.1 Entitlements set by your agreement. Vendor-Delivered Support is delivered at the level set out in your order form or MSA. We make best efforts to honour the response windows stated in your agreement, but, except where stated as a contractual SLA in that agreement, response windows are targets, not guarantees.

7.2 No obligation to provide individualised support outside Subscription. The Open Source Software is provided free under the MIT License, which expressly disclaims warranty and support. We have no obligation to provide individualised guidance, troubleshooting, feature workarounds, bug fixes, code review, deployment assistance, or one-off engineering help to any person or entity that does not hold an active paid Subscription. The publication of documentation, the test suite, the OSCAL artefacts, and the academic papers does not create such an obligation.

7.3 Vulnerability disclosure is free. Notwithstanding section 7.2, you may submit security-vulnerability reports to [email protected] regardless of Subscription status. We will acknowledge receipt and engage in good-faith responsible disclosure under our published process.

7.4 Out of scope. Unless explicitly included in your tier or order form, Vendor-Delivered Support does not include: on-site engagement; production-environment access; data-recovery services; legal or compliance advice; certification of any third-party software; or work on systems other than the enclawed framework itself.

7.5 Customer-data access — paperwork is the Customer’s responsibility. Enclawed LLC does not handle Customer data in the ordinary course of business: the Subscription is self-deployed by you and the runtime never sends data to us. If, at your request, Vendor-Delivered Support does involve Enclawed personnel accessing your data, configurations, logs, or other regulated material (for example a custom hardening review or an embedded engineering engagement under your agreement), you are responsible for providing, before any access begins, the agreements your compliance regime requires for that access not to break your own certification. This includes, where applicable:

• a Business Associate Agreement (BAA) under HIPAA for Protected Health Information;
• a Data Processing Agreement (DPA) compliant with GDPR Article 28 for personal data of EU / EEA / UK data subjects;
• a Standard Contractual Clauses (SCC) addendum or equivalent transfer mechanism for cross-border personal-data transfers;
• a non-disclosure agreement (NDA) sufficient under your trade-secret or classified-information regime;
• any sector-specific control overlay (CJIS Security Addendum, IRS Publication 1075, ITAR Technical Assistance Agreement, etc.) you require for your industry.

If you have not provided the necessary paperwork prior to engagement, Enclawed will decline to access the relevant data. Where we have provided a template (BAA, DPA, NDA), countersigning the template is sufficient; where your regime requires a bespoke document, providing the document is your responsibility. We will not be liable for any breach of your certification or compliance posture arising from your failure to put adequate paperwork in place.

8. Confidentiality

For Subscriptions that include access to the Proprietary Software or to non-public technical information (the “Confidential Information”), you agree to: (a) hold Confidential Information in strict confidence; (b) use it solely for the internal business purposes contemplated by your Subscription; (c) protect it with at least the same degree of care you use for your own confidential information of similar sensitivity, but no less than reasonable care; and (d) disclose it only to your employees and contractors who have a need to know and who are bound by written confidentiality obligations at least as protective as these Terms.

Confidential Information does not include information that: is or becomes publicly known through no fault of yours; was rightfully known by you before disclosure; is rightfully received from a third party without confidentiality obligation; or is independently developed without reference to the Confidential Information.

The obligations of this section survive termination of any Subscription for a period of five (5) years, except that trade secrets remain protected for as long as they qualify as trade secrets under applicable law.

9. Intellectual property

As between you and us, we retain all right, title, and interest in and to the enclawed-oss source code, the Proprietary Software, the documentation, the academic papers, the trademarks, and any improvements or derivative works we create. Nothing in these Terms transfers any ownership to you, except for the licenses expressly granted in section 5.

You retain all right, title, and interest in and to any data, configurations, manifests, or content you create or supply through your use of the Subscription (your “Customer Content”). You grant us a non-exclusive, royalty-free license to use Customer Content solely as necessary to provide the Subscription, including to triage support tickets and to fulfil our obligations under these Terms.

10. Warranties and disclaimers

10.1 Limited warranty. We warrant that we will perform Vendor-Delivered Support in a professional and workmanlike manner consistent with industry practices. Your exclusive remedy for breach of this warranty is, at our option, re-performance of the affected support or a pro-rata refund of fees corresponding to the affected period.

10.2 Disclaimer. EXCEPT FOR THE LIMITED WARRANTY IN SECTION 10.1, THE OPEN SOURCE SOFTWARE, THE PROPRIETARY SOFTWARE, AND ALL VENDOR-DELIVERED SUPPORT ARE PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, OR UNINTERRUPTED OR ERROR-FREE OPERATION. WE DO NOT WARRANT THAT ANY ENCLAWED PRODUCT WILL CAUSE YOU TO PASS ANY CERTIFICATION OR AUDIT; CERTIFICATION OUTCOMES DEPEND ON FACTORS OUTSIDE OUR CONTROL, INCLUDING THE QUALITY OF YOUR OWN INFORMATION-SECURITY MANAGEMENT SYSTEM, THE COMPLETENESS OF YOUR EVIDENCE PACKAGE, AND THE JUDGEMENT OF YOUR AUDITOR OR CERTIFICATION BODY.

11. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR EXEMPLARY DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, USE, GOODWILL, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATING TO THESE TERMS OR ANY SUBSCRIPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

OUR TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS, ANY SUBSCRIPTION, OR ANY VENDOR-DELIVERED SUPPORT WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID US IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE THOUSAND U.S. DOLLARS (US $1,000).

These limitations apply regardless of the theory of liability, whether in contract, tort, negligence, strict liability, or otherwise, and survive any termination of the Subscription. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above limitations may not apply to you to the extent so prohibited.

12. Indemnification

12.1 By Enclawed. We will defend you against any third-party claim alleging that the Proprietary Software, when used in accordance with these Terms and the documentation, infringes that third party’s patent, copyright, trademark, or trade secret, and pay any damages finally awarded against you (or settled by us) on such claim. We have no obligation under this paragraph for any claim arising from: (a) your use of the Open Source Software (covered by the MIT License); (b) your modifications to or combinations of any enclawed product; (c) Customer Content; or (d) your use of any enclawed product after we have notified you to stop because of a potential infringement claim.

12.2 By Customer. You will defend us against any third-party claim arising from: (a) your Customer Content; (b) your use of any enclawed product in violation of these Terms or applicable law; or (c) your use of any enclawed product to provide services to your own customers, and pay any damages finally awarded against us (or settled by you) on such claim.

12.3 Procedure. The indemnifying party’s obligations under this section are conditioned on the indemnified party: (i) promptly notifying the indemnifying party in writing of the claim; (ii) giving the indemnifying party sole control of the defence and settlement; and (iii) providing reasonable cooperation at the indemnifying party’s expense.

13. Modifications to these Terms

We may modify these Terms at any time. Material changes will be announced at enclawed.com/terms.html and, where we have your email on file, sent to you by email at least thirty (30) days before they take effect. Continued use of a Subscription after a modification takes effect constitutes acceptance of the modified Terms. If you do not accept a modification, your sole remedy is to cancel the Subscription at the end of the then-current billing cycle without further obligation beyond any uncompleted Minimum Commitment.

14. Term and termination

These Terms remain in force for as long as you maintain an active Subscription, and survive termination as to: section 5.2 (Proprietary Software license restrictions), section 8 (Confidentiality), section 9 (Intellectual property), section 10 (Warranties and disclaimers), section 11 (Limitation of liability), section 12 (Indemnification), and section 15 (Governing law).

Upon termination, all rights to access the Proprietary Software and to receive Vendor-Delivered Support cease, but your rights to the Open Source Software under the MIT License remain in force.

15. Governing law and dispute resolution

15.1 Governing law. These Terms are governed by the laws of the State of California, United States, without regard to its conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15.2 Venue. Any action to enforce or interpret these Terms not subject to arbitration under section 15.3 must be brought exclusively in the state or federal courts located in San Francisco County, California, and each party consents to the personal jurisdiction of those courts.

15.3 Arbitration (optional, for non-consumer Subscribers). If both parties are businesses (neither is a consumer), any dispute arising out of or relating to these Terms will be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, before a single arbitrator in San Francisco, California, with the arbitrator’s award enforceable in any court of competent jurisdiction. Nothing in this section prevents either party from seeking injunctive or equitable relief in court for breaches of confidentiality or intellectual-property rights.

15.4 No class actions. Each party agrees that any dispute will be resolved on an individual basis only, and not as part of any class, consolidated, or representative action.

16. Miscellaneous

16.1 Entire agreement. These Terms, together with any order form, MSA, NDA, NCA, or separate license referenced in your Subscription, constitute the entire agreement between you and us regarding the subject matter and supersede any prior or contemporaneous communications.

16.2 Severability. If any provision of these Terms is held unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full force.

16.3 No waiver. No failure or delay by either party in exercising any right under these Terms operates as a waiver of that right.

16.4 Assignment. You may not assign these Terms or any rights or obligations under them without our prior written consent, except to a successor in connection with a merger, acquisition, or sale of all or substantially all of your assets. We may assign without restriction.

16.5 Force majeure. Neither party is liable for any failure to perform caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, labour disruption, internet or telecommunications failures, or government action. Payment obligations are not excused by force majeure.

16.6 Independent contractors. The parties are independent contractors. Nothing in these Terms creates an agency, partnership, joint venture, or employment relationship.

16.7 Notices. Legal notices to us must be sent to [email protected]. Legal notices to you may be sent to the email address on file with your Subscription.

17. Contact

Enclawed LLC
A California limited liability company
General: [email protected]
Legal: [email protected]
Billing: [email protected]
Security: [email protected]
Privacy: [email protected]