Legal · Terms of Service
Effective June 8, 2026. These terms govern your organization's use of pactflow. They are written to be read the same way our audit logs are: complete, specific, and short on surprises.
These Terms of Service are a contract between pactflow, Inc., a Delaware corporation ("pactflow", "we"), and the organization that creates a workspace or executes an order form referencing these terms ("you", the "customer"). The person who accepts them represents that they have authority to bind that organization; pactflow is built for teams governed by compliance, IT, and risk functions, and we contract with the organization, not the individual who typed the signup email.
The full agreement is these terms, your order form (if any), and the policies referenced here, including our privacy notice at privacy.html and security practices at security.html. If an order form conflicts with these terms, the order form controls for that order. Anything a salesperson said that did not make it into an order form is not part of the agreement.
pactflow is a business service. It is not offered to consumers, and consumer-protection regimes written for personal use do not apply to a workspace governing production agents at a bank. If you are evaluating on your own initiative inside an organization, the sandbox terms in section 2 cover you until your organization signs something.
"Agent" means an AI-driven workload you register in Agent OS. "Policy" means the rules you author in the .pact language and compile with pactflow compile. "Customer data" means the data you or your agents submit to or generate in the service, including policies, prompts, completions, configurations, and audit records. "Order form" means a mutually executed ordering document referencing these terms. Your affiliates may use the service under your workspace; you are responsible for their compliance as if their use were yours.
pactflow is a control plane for AI agents. The service comprises Agent OS the agent registry, the policy compiler, identity resolution through your IdP, and inline enforcement of compiled policy on every agent call and Change Control diffing, review routing, versioning, one-click rollback, and a signed audit log streamable to your SIEM. Deployment options (managed SaaS or in-VPC self-hosted) are described on pricing.html and in your order form.
The service connects to systems you control your IdP for identity (for example, Okta), your SIEM for audit streaming, your repositories for policy source. Those connections run under credentials you grant and can revoke; keeping them current is part of operating the service.
One boundary matters more than any other in this section: pactflow is not a model provider. You bring your own accounts with model vendors, and agent calls to those models are made under your credentials and your contracts. Our policy engine decides whether a call is permitted; the model vendor decides everything about what happens inside the model. You remain bound by each provider's terms for every model you route through pactflow, and nothing here transfers those obligations to us.
Sandbox and trial workspaces are provided for evaluation, without uptime commitments, and their contents policies, registered agents, and logs may be deleted after 30 days of inactivity. Do not run production agents in a sandbox; that is what the word means.
Features marked beta or preview are provided for testing, may change or be withdrawn without notice, and are excluded from the warranty in section 10 and any service levels in your order form. Enforcement of a beta policy construct is still enforcement, though: if you compile it into a production policy, section 4 applies in full.
All paid plans include support through the dashboard and hello@pactflow.xyz; enterprise response targets live in your order form. Support can explain what your policy did and why the audit log makes that a short conversation but support does not write, review, or approve your policies. That separation is deliberate, and section 4 explains why.
Seats are for named individuals in your organization, provisioned and deprovisioned through SSO and SCIM where configured. Sharing a seat between people defeats the identity binding that our enforcement depends on scopes are granted to who, not just what and is prohibited. When someone leaves your organization, deprovisioning them in your IdP is what revokes their access; do it promptly.
Workspace roles (admin, approver, developer) are assigned by you through RBAC. Approver assignments matter contractually: when your policy routes a change to "risk", the people your admins placed in that group are the human review these terms and section 5 keep referring to. Staffing an approver group with people who rubber-stamp is a policy-quality problem, and section 4 says whose problem that is.
Agents themselves receive machine identities in the registry, distinct from human seats and priced per plan. An agent identity carries only the scopes its bound policy grants; it cannot be widened at runtime, only through a policy change that flows through Change Control. Registering a production workload under a human seat to avoid an agent identity is a misuse of both.
API keys and service tokens (including the tokens issued by pactflow login) are your responsibility to safeguard. Actions taken with your credentials are attributed to you. If you believe a key is compromised, rotate it immediately and notify security@pactflow.xyz; we will help you scope the exposure from the audit log, which is rather the point of having one.
pactflow enforces the policy you compile. Our engine evaluates every agent call against the rules in your .pact files exactly as written, fails closed on un-governed deploys, and quarantines unregistered agents. What it cannot do is know what your rules should have said. You are responsible for the correctness, completeness, and lawfulness of your policies, including their allow-lists, redaction rules, review-routing, and scopes.
The compiler catches what a compiler can: type errors, unresolvable model and tool references, unsigned artifacts, a change block that routes to no one. It does not catch a scope that is lawful, well-formed, and wrong for your business. Both stages produce evidence the compile result is recorded, and every runtime allow or block decision is written to the signed audit log with the policy version that made it.
# the compiler rejects what it can prove wrong $ pactflow compile ✗ policy "finance-strict": tool "wire.send" has no review route ✗ compile failed · 1 violation · nothing deployed # it cannot reject a rule that is well-formed and unwise tools: allow("refund.lt(50000)") # compiles. yours.
Rollback restores the prior compiled artifact and re-binds it atomically; agents governed by the rolled-back policy pick it up on their next call. The audit log records the mistake, the rollback, and who did both. That record is your friend in an incident review use it.
We may publish reference policies and blueprints (see examples.html). These are starting points, not legal or compliance advice; adopting one unmodified is still your decision and your policy.
You will use pactflow only to govern lawful agent activity. In particular, you will not use pactflow to launder accountability: routing a decision through a governed agent does not convert it into someone else's decision. Where your regulators require human review such as decisions with legal or similarly significant effect on individuals under GDPR Article 22, the EU AI Act, or fair-lending and employment rules pactflow's approval routing can implement that review, but configuring it, and honoring it, is your obligation.
You will respect the terms of every third-party model, tool, and integration your agents reach through the control plane, and you will not use pactflow to circumvent rate limits, usage restrictions, or acceptable-use policies those providers impose. Credentials your agents use to reach third-party tools are yours to provision and lawfully hold; pactflow scoping a credential does not mean pactflow issued it.
You may not operate agents for harassment or intimidation of individuals; for unlawful surveillance or tracking; or for any activity that violates applicable sanctions or export-control law, including provisioning access from or on behalf of sanctioned parties or embargoed territories. The service itself is subject to U.S. export law, and you will not export or re-export it in violation of that law. We may suspend workspaces engaged in prohibited use under section 13.
Writing a policy that permits a prohibited use does not make it permitted. Section 4 makes your policies your actions; it does not make them our terms.
You own your data: your policies, your prompts and completions, your agent configurations, and your audit records. We claim no rights in them beyond the limited license needed to operate the service for you. Audit records are written append-only and signed; we will not alter them for you, for us, or for anyone an audit log you can edit is a diary.
You can export your data at any time through the dashboard, CLI, or API including after termination, during the window described in section 13. Policies export as the .pact source you wrote; audit records export as signed JSONL with verification material, so the evidence stays evidence outside our system.
# take your records with you, signatures intact $ pactflow export --audit --from 2026-01-01 --format jsonl ✓ 1,204,318 records · signatures verified · export.jsonl.zst
For our own analytics and service improvement we use only aggregated, de-identified telemetry (for example, enforcement-decision latency across all customers). We do not train models on your prompts, completions, or policies, and we do not sell your data. Our subprocessors, retention periods, and data-subject request handling are listed in privacy.html.
If you deploy in-VPC, your agent traffic prompts, completions, tool calls never reaches our infrastructure at all. The control plane runs inside your boundary, models can be pinned in-boundary, and what we receive is limited to licensing and, if you enable it, de-identified operational telemetry.
Fees are set per plan on pricing.html or in your order form. Order-form (enterprise) invoices are due net 30 from the invoice date. Self-serve plans bill in advance each cycle to your payment method on file. Quoted fees never include taxes; whatever sales tax, VAT, or similar levy applies is on you, while taxes on our income stay on us. Trials convert to paid plans only when you affirmatively subscribe; a trial that expires simply expires, subject to the sandbox deletion window in section 2.
Self-serve pricing moves only on 30+ days' notice and only at the boundary of a billing cycle never in the middle of one. Enterprise pricing changes only at renewal or as your order form provides. Fees are non-refundable except where these terms or the law say otherwise.
Plans meter human seats and registered agent identities. If your usage exceeds your committed quantities, we true up at your contracted per-unit rate at the next invoice we do not retroactively reprice the plan, and we do not silently upgrade you. The registry makes the count unambiguous, which is one more reason to keep it accurate.
If you dispute an invoice in good faith, tell us in writing within the payment period with the specifics; the disputed portion is not "past due" for section 13 while we resolve it, and the undisputed portion remains payable on schedule.
We own the service: the platform, the .pact policy language, the compiler, the SDKs, the enforcement engine, and all improvements to them. Your subscription is a right to use them, not a transfer of them. Feedback you volunteer about the service may be used by us without restriction or obligation.
Your policy content is yours. The rules you express in the policy language your allow-lists, scopes, redaction rules, review routes are your work product and your confidential information, in your repositories, under your control. Owning the grammar does not give us a claim on your sentences.
The service includes open-source components licensed under their own terms, which govern those components; a manifest ships with the SDKs. Nothing in this agreement restricts rights those licenses grant you.
Both of us commit to guarding the other side's confidential information as carefully as we guard our own (and never less than reasonably), and to using it solely for purposes of this agreement. Your policies, agent configurations, and audit records are your confidential information; our non-public product, security, and pricing information is ours. The obligation runs for 5 years from disclosure, and for trade secrets, as long as they remain trade secrets. Standard exclusions apply (independently developed, publicly available, rightfully received). Compelled disclosures require notice to the other party where lawful.
On written request after termination, each party will delete or return the other's confidential information, except copies in routine backups (deleted on schedule) and records retained to meet legal obligations which, for your audit exports, is exactly what they are for.
We promise that the service will operate in material conformance with its documentation, and that we will not materially weaken the security practices described at security.html during your subscription. Your exclusive remedy for breach of this warranty is re-performance or, failing that, termination and a pro-rated refund of prepaid fees.
Otherwise the service is supplied as-is, with no further warranties of any kind, express or implied. The models your agents call are third-party systems we do not control and do not warrant. Enforcement decisions are only as good as the policy you compiled. We do not warrant that governed agents will be error-free, that policy enforcement will prevent every harmful output, or that the service will be uninterrupted. Governance reduces risk; it does not abolish it, and we will not pretend otherwise in writing merely because a warranty section is a customary place for pretending.
Model providers retire and change models on their own schedules. Pinning a model version in your policy controls what your agents may call; it does not oblige the provider to keep serving it. When a pinned model reaches end of life upstream, the failure mode is the safe one your policy blocks calls to a model that no longer matches its pin until you review and update it.
Uptime commitments and support response times for enterprise plans are set in your order form, with service credits as the exclusive remedy for missing them. Self-serve plans carry no SLA. For in-VPC deployments, availability of the control plane inside your boundary depends on infrastructure you operate; our SLA covers what we run.
To the fullest extent the law allows, neither of us is responsible to the other for consequential, special, exemplary, incidental, or punitive losses, or for lost profits, lost revenue, or lost data, whether or not the possibility was foreseeable. Each party's cumulative liability under this agreement will not exceed the amounts paid or payable for the service in the twelve months before the first event giving rise to the claim.
Three things sit outside the cap and the exclusions: unpaid fees, a breach of the confidentiality commitments in section 9, and the defense obligations in section 12 plus, of course, willful misconduct, fraud, and anything the law refuses to let parties limit.
This allocation of risk is priced in. A control plane that charged per-seat fees while insuring the downstream conduct of every agent it governs would have to charge like an insurer; sections 4, 11, and 12 together are why we do not.
If a third party alleges that the service itself, used within these terms, infringes their patent, copyright, or trademark, or misappropriates their trade secret, the defense is ours: we take over the claim and cover the damages and settlements that result. If such a claim looks likely, we may modify the service, procure rights, or terminate the affected service and refund prepaid unused fees. We have no obligation for claims arising from your policies, your data, or combinations with systems we did not supply.
The mirror image applies to claims a third party brings over your agents' conduct, the policies you compiled and their consequences, your data, or a violation of section 5: those claims are yours to take over, and the resulting damages and settlements are yours to cover. The division of labor mirrors section 4: we answer for the engine; you answer for what you told it to allow. Whoever is being protected must promptly flag the claim, hand the defending party the steering wheel, and cooperate reasonably along the way.
This section states each party's exclusive remedy for the third-party claims it covers. In any dispute about whether an agent action was authorized, the signed audit record of the enforcement decision and the policy version behind it is presumptively accurate; both parties agreed to run a system that keeps receipts.
Self-serve plans can be cancelled whenever you like and lapse once the current billing cycle closes. Order-form subscriptions run their stated term and renew as the order form provides. If either side commits a material breach and lets 30 days pass after written notice without curing it, the other side may end the agreement. Enterprise customers may purchase wind-down assistance policy source handoff, audit re-verification, in-VPC decommissioning at then-current professional-services rates.
We may suspend a workspace where it presents a genuine security risk to the service or other customers (for example, a compromised key actively being exploited, or prohibited use under section 5), or where undisputed fees are more than 15 days past due after notice. Suspension is scoped and lifted when the cause is resolved; it is a circuit breaker, not a negotiating tactic. During a suspension your audit log remains readable and exportable suspending your agents is a remedy, hiding your evidence never is.
On termination, your access to run agents ends, but your audit records remain exportable for 30 days regulators do not accept "we cancelled the subscription" as a records policy, and neither do we. After that window, customer data is deleted on the schedule in privacy.html; we will confirm deletion in writing on request. Sections 6 (ownership), 8 through 12, and this section survive termination.
Washington law governs this agreement, conflict-of-laws principles notwithstanding, and the 1980 Vienna Convention (CISG) is expressly excluded. Any dispute belongs exclusively to the state or federal courts sitting in King County, Washington, and each party submits to personal jurisdiction there. Either party may seek injunctive relief in any court of competent jurisdiction to protect its confidential information or IP.
Before filing anything, the parties will spend 30 days trying to resolve the dispute through people with authority to settle it. Most disagreements about an enforcement decision end when both sides read the same audit record.
These terms can change, but never quietly: workspace administrators get email plus a dashboard banner at least 30 days before a new version takes effect. Changes are never retroactive: the version in force when an event occurred is the version that governs it, the same rule our audit log applies to your policies. Should an update materially cut back your rights, you can exit the agreement before the new version bites and take a pro-rated refund of anything prepaid. Continued use after the effective date is acceptance. Prior versions remain available on request to legal@pactflow.xyz we diff our terms, too.
# how a terms change reaches you notice: email to admins + dashboard banner · T-30 days effective: next version governs conduct from its date only objection: material reduction → terminate + pro-rated refund
Assignment requires the other side's consent, with a carve-out for affiliates and for a merger, acquisition, or sale of substantially the whole business (notice required). Delays caused by events genuinely outside a party's control are excused invoices, however, are not. Notices to us go to legal@pactflow.xyz; notices to you go to your workspace administrators' email on file. If a provision is unenforceable, the rest stands; a waiver must be in writing to be one. We may identify you as a customer by name and logo only with your written consent (an order form checkbox counts). This agreement is the parties' entire agreement about the service and supersedes prior discussions.
Questions about these terms go to legal@pactflow.xyz. Security disclosures go to security@pactflow.xyz; privacy requests to privacy@pactflow.xyz. We answer legal mail with the same SLA we expect from our own approvers.
Our handling of personal data is documented at privacy.html. For how we secure the service, see security.html. For what the service actually does before agreeing to terms about it, start with documentation.html.