Terms of Service

AegisRail is an AI TrustOps platform operated by Eastbase Studio ("Eastbase Studio", "AegisRail", "we", "us", "our"). These Terms of Service ("Terms") govern your access to and use of the AegisRail platform, SDK, APIs, and websites (together, the "Service").

By creating a workspace or using the Service you agree to these Terms. If you use the Service on behalf of an organization, you confirm you are authorized to accept these Terms for that organization, and "you" refers to that organization.

AegisRail provides AI observability and trace metadata, evaluations and model-graded rubrics, release and eval gates, incident tracking, Trust Score, a public Trust Center, a tamper-evident proof chain with public verification manifests, evidence bundles, EU AI Act Annex IV technical file support, compliance framework mappings, alerts, and signed webhooks.

These capabilities help your team observe, evaluate, govern, and prove how your AI systems behave. They are operational tooling. They are not a substitute for your own engineering, security, legal, and compliance judgment.

Access is organization-scoped. Workspace owners and admins manage membership, roles, data retention settings, API keys, notification and webhook destinations, and which features are enabled.

You are responsible for the activity of your users and for keeping account credentials secure. You must ensure everyone you invite is authorized and uses the Service in line with these Terms.

You retain ownership of the data you and your users submit to the Service ("Customer Data"). We process Customer Data to provide, secure, support, and improve the Service, as described in the Privacy Policy and any applicable agreement.

You are responsible for having the rights, permissions, and notices required to submit Customer Data, including AI traces, evaluation cases, user feedback, evidence, and operational metadata, and for your use of any outputs.

AegisRail is designed to avoid raw prompt and completion storage by default, but you control what you submit. You must not send secrets, credentials, API keys, raw personal data, regulated data, confidential customer content, prompts, completions, or sensitive evidence unless approved retention, redaction, access controls, and disclosure processes are in place for that data.

By default the Service stores metadata such as cost, latency, token counts, model and provider names, risk flags, and summaries, rather than raw model inputs and outputs.

Raw trace payload storage, data retention windows, and redaction behavior are workspace settings under your control. Retention is enforced per organization, and raw payload retention is controlled separately from trace metadata.

You are responsible for choosing settings that match your privacy commitments and legal obligations, and for reviewing them before sending production data.

API keys are secrets. Scope them to what they need, store them securely, and rotate them if they may be exposed. You are responsible for all activity performed with your keys.

Ingestion and API use are subject to plan quotas and rate limits. You must not attempt to bypass authentication, authorization, plan limits, rate limits, or other controls.

AegisRail provides decision-support signals and gate verdicts, but you remain responsible for implementing, testing, and honoring gates in your own CI/CD or deployment workflows.

AegisRail does not guarantee that unsafe, non-compliant, incorrect, or harmful AI behavior will be detected or prevented. Gate results are inputs to your release process, not a guarantee of safety or correctness.

Evaluations run on a deterministic runner by default. When you enable model-graded evals, selected eval content may be sent to the AI providers you configure, such as Google Gemini or OpenAI.

AegisRail does not train its own models on your trace or eval content. For production you should use paid, billing-enabled Gemini API and OpenAI API settings that do not use API data for training by default. Provider-side handling is governed by the relevant provider terms, and we do not make commitments on a provider’s behalf beyond those terms.

If you publish a Trust Center or share evidence, public Trust Centers, trust manifests, verification endpoints, evidence summaries, and shared evidence links may be indexed, cached, copied, screenshotted, or accessed by third parties outside AegisRail’s control.

You are responsible for not publishing confidential, sensitive, regulated, proprietary, or third-party data through these public surfaces.

You are responsible for maintaining account security, managing workspace membership, rotating API keys, configuring approved integration destinations, and limiting raw trace retention to approved use cases.

We may suspend or restrict access to protect the Service, our customers, or third parties from abuse, security incidents, or legal risk.

You must not use the Service to break the law, infringe rights, transmit malware, probe or breach security or authentication, interfere with or place undue load on the Service, or access another customer’s data.

You must not rely on the Service as the sole basis for safety-critical, legal, or high-impact decisions without your own validation and human review.

Paid plans are billed in advance on a recurring monthly cycle through Lemon Squeezy, our merchant of record. Lemon Squeezy handles checkout, payment methods, applicable sales tax or VAT, invoices, and refund execution.

Plan limits and feature gates follow your current subscription state and are enforced by the Service. You are responsible for charges incurred under your account until the subscription is cancelled.

You can cancel a paid plan at any time, and access continues until the end of the period you have already paid for. Refund eligibility, processing, and the cancellation flow are described in the Refund & Cancellation Policy.

AegisRail may help organize materials mapped to SOC 2, ISO 27001, NIST AI RMF, GDPR, and the EU AI Act, but it does not provide legal, audit, compliance, security certification, or regulatory advice.

AegisRail does not certify compliance and does not guarantee audit success, buyer acceptance, or legal classification. You remain responsible for final regulatory interpretations, audit submissions, customer-facing disclosures, and AI system decisions.

The Service is provided on an "as is" and "as available" basis. We do not commit to a specific uptime or availability level unless a separate written agreement says otherwise, and we may perform maintenance that temporarily affects availability.

We may suspend or terminate access for breach of these Terms, non-payment, security or legal risk, or abuse. You may stop using the Service and cancel at any time.

On termination, your right to use the Service ends. Data handling after termination follows the Privacy Policy and, where applicable, the Data Processing Addendum.

To the maximum extent permitted by law, the Service is provided without warranties of any kind, whether express or implied, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

You remain responsible for how you build, test, deploy, and operate your AI systems and for the decisions you make using the Service.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill.

To the maximum extent permitted by law, AegisRail’s total aggregate liability arising out of or relating to the Service will not exceed the greater of the amount you paid to AegisRail in the 3 months before the claim or USD $100.

These Terms are governed by the laws of Vietnam, without regard to conflict-of-laws rules. The courts of Vietnam have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service.

Before filing a claim, the parties will try in good faith to resolve the dispute informally by contacting support@eastbase.studio.

Nothing in these Terms limits any non-waivable rights you may have under applicable consumer protection or data protection laws.

We may update these Terms as the product and our operations evolve. We will communicate material changes through the product, by email, or through your customer agreement, and continued use after changes take effect means you accept them.

Questions about these Terms can be sent to support@eastbase.studio.