Terms & Conditions.

1. Who these Terms are between

These Terms & Conditions ("Terms") are a binding agreement between Airlock BV, a Belgian limited company having its seat at Colmarstraat 38, 9100 Sint-Niklaas, Belgium, registered with the Crossroad Bank of Enterprises under number 1037836652 ("airlock", "we", "us"), and the organization on whose behalf an Authorized Representative creates or uses an account in the airlock Control Room ("you", "Customer").

2. Acceptance

By (a) clicking "I agree" or a similar control when creating an account in the Control Room, (b) accessing or using the airlock Service in any other way, or (c) allowing any of your Authorized Representatives to do so, you accept these Terms on behalf of your organization. If you do not have authority to bind your organization, or you do not agree, do not use the Service.

If you have signed a separate written License and Subscription Agreement, Data Processing Agreement, or order form with airlock, that signed agreement governs and supersedes these public Terms to the extent of any conflict.

3. The Service

airlock is a governance and proxy plane for AI agents and the tools they use. The "Service" (also the "Platform") includes: the Control Room web application, the single MCP proxy endpoint that fronts third-party APIs and MCP servers, the versioned skill and agent catalog, the policy engine, human-in-the-loop approval workflows, the credential vault, the tamper-evident audit log, and any related documentation, APIs, SDKs, and integrations made available by us.

The Service is delivered as a multi-tenant SaaS hosted on AWS in the European Union (Frankfurt, eu-central-1). Specific features may evolve. We will not materially degrade your subscription's documented features without notice.

4. Accounts and authorized representatives

Accounts come in two forms: User Accounts (allocated to a named natural person, the "Authorized Representative") and Service Accounts (used by your own systems, not by individuals). Only Authorized Representatives may use User Accounts. You agree not to allow more than one Authorized Representative per User Account.

You are responsible for: (a) the accuracy of your account and organization information, (b) the security of your access credentials, (c) implementing appropriate security measures to prevent unauthorized access to the Service, and (d) all acts and omissions of your Authorized Representatives and Service Accounts as if they were your own. You must promptly notify us of any suspected unauthorized access. Authentication is handled by AWS Cognito (OAuth 2.0 with PKCE); airlock does not store user passwords.

5. License

Subject to your compliance with these Terms and payment of applicable fees, airlock grants you a non-transferable, non-sublicensable, non-exclusive right to access and use the Service for your internal business operations during the term of your subscription.

6. Acceptable use and restricted activities

You agree not to, and not to permit any Authorized Representative to:

• use the Service for any unlawful purpose or in violation of applicable laws;
• modify, adapt, alter, translate, or create derivative works of the Service or any of its components;
• load, run, display, store or copy the Service as part of your own products, or sublicense, distribute or otherwise transfer the Service to a third party;
• reverse-engineer, decompile, or attempt to derive source code of the Service, except where this restriction is prohibited by applicable law;
• use the Service to develop a competing product or service;
• access the Service in an automated or programmatic manner beyond its intended use, or in a way that exceeds fair-use thresholds we communicate or that places unreasonable load on our infrastructure;
• interfere with, disrupt, or attempt to gain unauthorized access to the Service, the systems of other customers, or any third-party API connected through the Service;
• interfere with or circumvent security-related features of the Service, including copy-protection or access controls;
• remove, alter, or conceal any proprietary notices on or within the Service (copyright, trademark, patent, or similar);
• transmit through the Service any viruses or content that is harmful, threatening, offensive, harassing, obscene, sexually explicit, violent, discriminatory, or a direct encouragement to harm a person or property;
• publish benchmark or performance comparisons of the Service without our prior written consent;
• use the Service to transmit, transfer, or facilitate the movement of money, funds, fiat currency, cryptocurrency, or other digital assets;
• use the Service to generate AI-synthesized images, video, or audio;
• use the Service to display, place, or facilitate advertising, sponsored content, or other paid placement;
• use the Service to generate, route, or approve actions that would breach the terms of service or acceptable use policies of any third-party API or AI provider connected through the Service.

7. Customer Data, audit logs and access

Your configuration, connected credentials, request metadata, approval records, and audit log entries (together, "Customer Data") are processed by airlock on your behalf to provide the Service. You retain ownership of Customer Data. Derived data generated by the Service (aggregated usage analytics, model and policy performance metrics, anonymized telemetry) belongs to airlock and may be used to operate and improve the Service.

Audit logs are for your auditing. airlock personnel do not read the substantive contents of your audit logs, approval payloads, or proxied request/response data except (a) with your explicit, written approval (for example, a support ticket where you ask us to investigate a specific issue), (b) where strictly required to maintain the integrity or security of the Service, or (c) where compelled by law. Automated systems may process Customer Data to deliver the Service (routing, policy enforcement, encryption, indexing, backup).

airlock does not use Customer Data to train AI models, and does not sell Customer Data.

8. Third-party services, connected APIs and MCP servers

airlock acts as an authorized proxy for the third-party services and MCP servers you choose to connect (for example: GitHub, Linear, Google Workspace, Slack, Datadog, Zoom, OpenAPI endpoints, or MCP servers you supply). Those connected services are your tools, operated under your responsibility. Their use is governed by their own terms, and you are responsible for ensuring your usage through airlock complies with them.

For the avoidance of doubt, your use of your own business applications, MCP servers, or other tools through the Service does not constitute the engagement of those providers as airlock sub-processors. They are involved at your sole and exclusive responsibility. airlock is not responsible for the availability, accuracy, security, or behavior of any third-party service, MCP server, or AI provider connected through the Service, and offers any such integrations "as is" without guarantee of error-free operation.

9. Service level, support and maintenance

airlock will use commercially reasonable efforts to make the Service available with a target uptime of 99% on a monthly basis. This is a best-effort target only and does not constitute a guaranteed service level. Planned maintenance announced in advance, downtime caused by events outside our reasonable control, and downtime caused by you, your Authorized Representatives, your systems, or third-party services connected through the Service are not counted toward unavailability.

Technical support is provided on a best-effort basis during Belgian business days (Monday to Friday, 9:00 to 17:00 CET, excluding Belgian public holidays) at support@air-lock.ai. Response targets are targets only and failure to meet them is not a breach of these Terms.

We may perform maintenance, patches, fixes, and updates necessary or useful for the normal operation of the Service. If a change discards a function or option of the Service, we will provide at least 10 days prior notice. Changes do not entitle you to a fee adjustment unless they materially impair the agreed functionalities.

Out of scope. We are not responsible for resolving incidents or performing maintenance to the extent caused by: (i) misuse of the Service or breach of these Terms, (ii) failure to follow our reasonable instructions, (iii) problems with your own systems or with third-party software, services, or products (including connected MCP servers and APIs), or (iv) errors in Customer Data.

10. Fees, payments and free tiers

These Terms apply uniformly whether you use the Service under a paid subscription, a free tier, or a beta/pilot program. Free use does not change your obligations under these Terms, except that no fees are due for the relevant period.

Fees for paid subscriptions, billing frequency, and any usage allowances are set out at signup, in the Control Room billing area, or in any order form or quotation between the parties. Unless stated otherwise, invoices are payable within 30 days of issuance, in the currency stated, without set-off or deduction. Overdue amounts bear interest at 1% per month on the outstanding balance, and you bear reasonable collection costs (including legal fees) with a minimum lump sum of EUR 150 per invoice. Airlock BV may adjust subscription fees annually in line with the Belgian consumer price index.

We may suspend access to the Service for non-payment on at least 10 days written notice, unless the overdue amount is settled within that recovery period. We may also monitor and audit your usage of the Service to verify compliance with applicable usage limits, and invoice any shortfall identified.

11. Beta features

Features marked "beta", "preview", "limited beta", or similar are provided "as is" and "as available", without any support, SLA, or availability commitment, and may be changed, restricted, or discontinued at any time.

12. Free tools (AI Policy Generator and similar)

airlock makes free tools available on this site, including the AI Acceptable Use Policy generator at air-lock.ai/ai-policy. These tools produce templates and drafts only. They are not legal advice, do not create a lawyer-client relationship, and do not guarantee compliance with the EU AI Act, GDPR, or any other law, regulation, standard, or contract that applies to you.

You are solely responsible for reviewing, adapting, and approving any output before relying on it or using it inside your organization. We strongly recommend review by your DPO, legal counsel, and management. To the maximum extent permitted by law, airlock disclaims all liability for: (i) regulatory or contractual compliance gaps in, or arising from, any generated output; (ii) acts or omissions of your employees, contractors, or agents in following, ignoring, or applying that output; (iii) errors, omissions, or hallucinations in AI-generated content; and (iv) any direct or indirect damages resulting from your use of, or inability to use, these free tools. The warranty and liability provisions in sections 14 and 15 apply to free tools as well, and in addition to those, free tools are provided without any support, SLA, or availability commitment.

13. Intellectual property

The Service and its original content, design, and software (including the airlock wordmark and brand) are owned by Airlock BV and protected by international copyright, trademark, and other intellectual property laws. airlock grants you a non-exclusive, non-transferable, revocable right to access and use the Service in accordance with these Terms. Nothing in these Terms transfers any intellectual property right to you other than the limited license expressly granted.

You retain all rights in Customer Data and in any skills, agents, configurations, or content you create or upload. You grant airlock a limited, non-exclusive license to host, process, transmit, and create the derived data described in section 7 solely to operate and improve the Service.

14. Warranties and disclaimers

airlock will provide the Service with commercially reasonable skill and care. Except as expressly stated in these Terms, the Service is provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement.

Without limiting the foregoing, airlock makes no warranty as to:

• the accuracy or completeness of Customer Data, third-party data, or any other information transmitted through the Service;
• the availability, accuracy, security, or behavior of any third-party service, MCP server, AI provider, or other integration connected through the Service, which are offered "as is" without guarantee of error-free operation and may change or become unavailable independently of us;
• that the Service will be uninterrupted, error-free, or that all defects will be corrected.

In the event of a defect or bug in the Service, airlock's sole obligation is to use commercially reasonable efforts to repair the error or replace the affected part of the Service.

15. Limitation of liability

To the maximum extent permitted by law, airlock shall not be liable for any indirect, incidental, special, consequential, or punitive damages, loss of profits or revenue, loss of data, loss of use, loss of goodwill, increased operating costs, lost savings, diminished goodwill, or any other intangible loss arising out of or related to the Service or these Terms, whether based in contract, tort, or otherwise, even if airlock has been advised of the possibility of such damages.

airlock's total aggregate liability for any and all claims arising out of or relating to these Terms or the Service in any 12-month period will not exceed the fees you paid to airlock for the Service in the 12 months immediately preceding the event giving rise to the claim, or one hundred euros (EUR 100) if no fees have been paid in that period. These limitations do not apply in cases of gross negligence, intentional misconduct, or fraud.

Contractual liability only. The parties agree that damage caused by a contractual breach may only form the basis for a contractual liability claim, even if such breach also constitutes a wrongful act. Each party excludes any extra-contractual (tort) liability related to the formation, performance, or termination of these Terms, to the fullest extent permitted by law.

airlock will in no event be liable for damage resulting from:

• your failure to incorporate any relevant fix, patch, or modification we have provided or communicated with reasonable notice, or your failure to take a specified avoidance action previously agreed with us;
• misuse of the Service by you or any Authorized Representative, including violations of these Terms, applicable law, or restricted activities;
• any third-party actions resulting from use of the Service with your permission;
• downtime that was duly notified in accordance with section 9;
• an event of force majeure (section 17).

16. Indemnification

You will defend, indemnify, and hold airlock harmless against any third-party claims, losses, damages, costs, and expenses (including reasonable legal fees) arising from or related to:

• your misuse of the Service or breach of these Terms;
• any restricted activity carried out by you or your Authorized Representatives;
• any claim concerning Customer Data, content, prompts, requests, responses, or instructions processed through the Service;
• your violation of any law or third-party rights;
• your use of any third-party service, MCP server, AI provider, or other integration connected through the Service (including any breach of their terms).

You must notify us of any such (impending) third-party claim within 10 business days following receipt or acknowledgement of the claim. We are not liable for any additional damage caused by an untimely notification.

17. Force majeure

Neither party is liable for failure or delay in performance to the extent caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, strikes, governmental action, internet or telecommunications failures, failures of upstream cloud providers, or large-scale third-party outages. If such an event prevents performance for a continuous period of more than 3 months, either party may terminate the affected portion of the Service by written notice, without compensation.

18. Confidentiality

Each party will protect the other's non-public information disclosed in connection with the Service with the same degree of care it uses to protect its own confidential information of like kind (and no less than a reasonable standard of care), use it only to perform under these Terms, and not disclose it to third parties except to representatives bound by equivalent confidentiality obligations on a need-to-know basis. These obligations apply throughout the term and for 5 years after termination, or until the information no longer qualifies as confidential, whichever occurs first.

19. Term, termination and data export

These Terms apply from the moment you first accept them or use the Service, and remain in force for as long as you have an active account or subscription. You may stop using the Service and close your account at any time.

We may suspend or terminate your access to the Service for material breach of these Terms (including non-payment) on reasonable notice where practicable, or immediately where required to protect the Service or other customers. Either party may terminate with immediate effect in the event of the other party's bankruptcy, insolvency, liquidation, or cessation of business.

On termination, your right to use the Service ends. We will make Customer Data available for export for at least 60 days following termination, after which all Customer Data will be deleted, except (i) aggregated, anonymized or pseudonymized derived data and (ii) data we are legally required to retain (such as billing records).

Sections that by their nature should survive termination will survive, including sections 7 (Customer Data), 13 (IP), 14 (Warranties), 15 (Limitation of Liability), 16 (Indemnification), 18 (Confidentiality), and 21 (Governing Law).

20. Privacy and data protection

Our processing of personal data is described in our Privacy Policy. Where airlock processes personal data on your behalf as a processor, processing is governed by our Data Processing Agreement, which forms an integral part of these Terms. You are responsible, as controller, for determining whether your deployment involves special category data (Art. 9 GDPR), criminal-offence data (Art. 10 GDPR), automated decision-making with legal effects (Art. 22 GDPR), or a high-risk AI system under the EU AI Act, and for completing any applicable DPIA, Fundamental Rights Impact Assessment (FRIA), and transparency obligations.

21. Governing law and jurisdiction

These Terms are governed by the laws of Belgium, without regard to conflict-of-law principles. Any dispute arising out of or in connection with these Terms will be finally settled by the courts of Antwerp, Belgium, except where you have mandatory consumer-protection rights to litigate in your place of residence.

22. Miscellaneous

Entire agreement. These Terms (together with the Privacy Policy, DPA, and any order form or signed agreement) constitute the entire agreement between the parties with respect to the Service and supersede any prior arrangements on the same subject.

Severability. If any provision is held invalid or unenforceable, the remainder of these Terms remains in effect, and the parties will negotiate in good faith to replace the invalid provision with one that reflects the original intent.

No waiver. A failure to enforce any right is not a waiver of that right.

Assignment. You may not assign these Terms without our prior written consent. airlock may assign these Terms to an Affiliate or in connection with a merger, acquisition, or sale of assets.

Reference. Unless you object in writing, airlock may identify you as a customer (including using your name and logo) on its website and in marketing materials, and may confirm to inquirers that you are a customer of the Service.

23. Changes to these Terms

We may modify these Terms from time to time. Material changes will be announced at least 30 days before they take effect (by email to administrators and/or in-product notice). Continued use of the Service after the effective date constitutes acceptance of the updated Terms.

24. Contact

For questions about these Terms, contact legal@air-lock.ai.