Effective date: August 4, 2026

These Terms of Service ("Terms") are a legal agreement between Orthalon, Inc. ("Orthalon," "we," "us," or "our") and the person or organization that accesses or uses Orthalon's websites, hosted services, browser extension, desktop agent, AI gateway, MCP discovery agent, connectors, and related software and support (collectively, the "Services").

If you use the Services for an organization, you represent that you have authority to bind that organization. In that case, "Customer" and "you" refer to the organization. If you do not have that authority, you may not accept these Terms on its behalf.

An order form, data processing agreement, service-level agreement, or other written agreement signed by Orthalon may supplement these Terms. If there is a conflict, the signed agreement controls for that conflict.

1. Eligibility and accounts

You must be legally able to enter into a binding contract and be at least 18 years old. You must provide accurate account information, keep it current, and protect account credentials, recovery methods, API keys, sensor keys, and administrator access.

You are responsible for activity under your accounts and organization, except to the extent caused by Orthalon's breach of these Terms. Notify security@orthalon.com promptly if you suspect unauthorized access or credential exposure.

Organization administrators may manage users, policies, integrations, data, and access. If your account is managed by an organization, that organization may access, restrict, export, or delete your account and associated data.

2. The Services

Orthalon helps organizations discover AI use, evaluate content against security policies, redact or block sensitive data, manage approvals, inventory supported AI and MCP connections, and produce security and compliance records.

Coverage depends on the selected plan, configuration, deployment, supported applications, and whether traffic reaches the relevant Orthalon protection layer. The browser extension cannot cover unsupported browsers or native applications. Desktop protection covers compatible clients configured to use the local proxy. The AI gateway covers only requests routed through it. MCP discovery inventories supported configurations but does not authorize or block individual MCP tool calls.

Orthalon may improve or change the Services. We will not materially reduce paid core functionality during a current subscription term without reasonable notice, except where needed to address security, legal, or third-party platform changes.

3. License and permitted use

Subject to these Terms and payment of applicable fees, Orthalon grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services for Customer's internal business purposes.

Customer may install the provided agents and extension on authorized devices and may make a reasonable number of backup copies of distributable software solely for deployment and disaster recovery. Orthalon and its licensors retain all rights not expressly granted.

4. Acceptable use

You must not, and must not allow others to:

use the Services unlawfully or to violate another person's rights;
access another customer's account, tenant, data, or systems without authorization;
bypass plan limits, access controls, policy enforcement, security controls, rate limits, or usage restrictions;
probe, scan, or test the vulnerability of the Services except under a written Orthalon security-testing authorization;
introduce malware, destructive code, or content intended to disrupt the Services;
reverse engineer, decompile, or attempt to derive source code from proprietary portions of the Services, except to the limited extent that law prohibits this restriction;
resell, lease, sublicense, or provide the Services as a standalone service without written permission;
use the Services or their output to build a competing product through systematic extraction or automated replication; or
use the Services for high-risk decisions about a person without appropriate human review and a lawful basis.

Orthalon may investigate suspected violations and may suspend affected access when reasonably necessary to prevent harm.

5. Customer responsibilities

Customer is responsible for:

selecting lawful policies, monitoring modes, retention periods, users, integrations, and protected environments;
providing employees and other users with legally required notices and obtaining any required consent before monitoring;
ensuring it has rights and a lawful basis to submit Customer Data;
testing policies with synthetic data before enabling blocking or redaction in production;
maintaining alternative access and incident procedures appropriate to its business;
securing endpoint deployment, provider credentials, secrets, and integration permissions; and
reviewing events and automated classifications before taking employment, disciplinary, legal, or other consequential action.

Customer must not submit unnecessary sensitive information and should configure data minimization appropriate to its environment.

6. Customer Data and privacy

"Customer Data" means data, content, configurations, and records submitted to or generated for Customer through the Services. As between the parties, Customer retains its rights in Customer Data.

Customer grants Orthalon a limited right to host, copy, transmit, inspect, modify, and otherwise process Customer Data only as necessary to provide, secure, support, and improve the Services; comply with law; and prevent abuse. Orthalon will not use customer prompt content or customer security-event content to train general-purpose AI models without Customer's separate, explicit authorization.

Our Privacy Policy explains how we handle personal information. Where Orthalon processes personal data on Customer's behalf, the parties may enter into a data processing agreement. Customer remains responsible for its instructions, legal basis, notices, and responses to individual-rights requests unless a written agreement states otherwise.

7. Feedback and usage data

If you provide suggestions or feedback, you grant Orthalon a perpetual, irrevocable, worldwide, royalty-free right to use it without restriction or compensation, provided we do not identify you publicly without permission.

Orthalon may collect and use service telemetry and aggregated or de-identified data to operate, secure, analyze, and improve the Services. We will not attempt to re-identify data treated as de-identified except to test whether our de-identification measures work.

8. Third-party services

The Services may interoperate with identity providers, model providers, payment processors, cloud platforms, enterprise directories, and other third-party services selected by Customer. Those services are governed by their own agreements and privacy practices.

Orthalon is not responsible for third-party services, provider model output, or changes that a third party makes to its APIs or products. Customer is responsible for maintaining valid third-party accounts, permissions, and licenses.

9. Fees, plans, and trials

Paid plans are billed according to the pricing page or an order form. Fees are stated exclusive of applicable taxes unless expressly stated otherwise. Customer authorizes Orthalon and its payment provider to charge the selected payment method for recurring fees, usage, seats, and taxes.

Subscriptions renew automatically for successive periods equal to the initial billing period unless Customer cancels before renewal. Changes in seats or usage may be charged or credited according to the plan. Except where law requires otherwise or an order form states otherwise, fees are non-refundable and cancellation takes effect at the end of the paid period.

A trial is provided for evaluation and may have limits. Orthalon may end or modify a trial where permitted by law. Continued use after a trial requires a paid plan; otherwise access may be limited or disabled.

We may change future pricing with reasonable advance notice. Price changes normally apply at the next renewal and do not override a signed fixed-price term.

10. Confidentiality

Each party may receive non-public information that is marked confidential or should reasonably be understood to be confidential. The receiving party will use it only to perform or exercise rights under the agreement, protect it with reasonable care, and disclose it only to personnel and providers who need it and are bound by confidentiality obligations.

Confidential information does not include information that the receiving party can document was already lawfully known, becomes public without breach, is received lawfully without a duty of confidentiality, or is independently developed. A party may disclose information when legally required after giving notice where permitted.

11. Security

Orthalon will maintain reasonable administrative, technical, and organizational safeguards designed to protect Customer Data. Customer acknowledges that no service is completely secure. Customer must use available security controls, limit privileges, rotate secrets, install supported updates, and promptly report suspected vulnerabilities or incidents.

12. Intellectual property

Orthalon, its software, documentation, designs, models, detection logic, and related technology are owned by Orthalon or its licensors and are protected by intellectual-property laws. No trademark or branding rights are granted except as necessary to identify Orthalon as the service provider.

If a third party claims that the paid Services infringe its intellectual property rights, Orthalon may obtain the right for Customer to continue using the Services, modify or replace the affected feature, or terminate it and refund prepaid fees for the unused part of the applicable term. This section states Customer's exclusive remedy for such a claim, except as otherwise provided in a signed agreement.

13. Suspension and termination

Customer may stop using the Services at any time and may cancel a subscription through the available account or billing controls.

Either party may terminate for a material breach that is not cured within 30 days after written notice. Orthalon may suspend access immediately when reasonably necessary to address a security risk, unlawful use, material acceptable-use violation, non-payment, or harm to the Services or others. Where practicable, we will give notice and limit the suspension to the affected portion.

On termination, Customer's right to use the Services ends. Customer should export needed data before termination. Orthalon may delete Customer Data after a reasonable retrieval period, subject to contractual retention terms, backups, and law. Provisions that by their nature should survive will survive, including payment obligations, confidentiality, intellectual property, disclaimers, liability limits, and dispute terms.

14. Disclaimers

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, ORTHALON DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

Orthalon is a security control, not a guarantee that every AI application, secret, sensitive record, policy violation, or threat will be detected or blocked. Classifications may contain false positives or false negatives. Orthalon does not provide legal advice, does not make Customer compliant with any framework by itself, and is not responsible for decisions made solely from automated events or reports.

15. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, EVEN IF ADVISED THAT SUCH DAMAGES WERE POSSIBLE.

EXCEPT FOR CUSTOMER'S PAYMENT OBLIGATIONS, A PARTY'S FRAUD OR WILLFUL MISCONDUCT, BREACH OF CONFIDENTIALITY, INFRINGEMENT OR MISAPPROPRIATION OF THE OTHER PARTY'S INTELLECTUAL PROPERTY, OR LIABILITY THAT CANNOT LEGALLY BE LIMITED, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF THE SERVICES AND THESE TERMS WILL NOT EXCEED THE AMOUNTS CUSTOMER PAID OR PAYABLE TO ORTHALON FOR THE SERVICES DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. FOR FREE SERVICES, ORTHALON'S TOTAL LIABILITY WILL NOT EXCEED US$100.

Some jurisdictions do not allow certain exclusions or limits, so parts of this section may not apply.

16. Indemnification

Customer will defend and indemnify Orthalon and its personnel from third-party claims, damages, and reasonable costs arising from Customer Data, Customer's unlawful deployment or monitoring, Customer's violation of acceptable use, or Customer's infringement of another person's rights. Orthalon will promptly notify Customer and provide reasonable cooperation. Customer may not settle a claim in a way that admits fault by or imposes obligations on Orthalon without Orthalon's written consent.

17. Governing law and disputes

These Terms are governed by the laws of the jurisdiction in which Orthalon, Inc. is incorporated, without regard to conflict-of-law rules. The courts in that jurisdiction will have exclusive jurisdiction, unless mandatory law requires another forum.

Before filing a formal claim, each party will give the other written notice and make a good-faith effort for at least 30 days to resolve the dispute. Nothing in these Terms prevents either party from seeking urgent injunctive relief or using a small-claims process where eligible.

An order form may specify a different governing law and venue for a particular Customer.

18. General

Neither party is liable for delay caused by events beyond its reasonable control, except payment obligations. Customer may not assign these Terms without Orthalon's consent, except with a merger or sale of substantially all assets where the successor is not an Orthalon competitor. Orthalon may assign these Terms as part of a reorganization, merger, sale, or transfer of the Services.

These Terms and incorporated written agreements are the entire agreement about the Services and supersede earlier discussions on that subject. If a provision is unenforceable, it will be modified to the minimum extent necessary and the rest will remain effective. Failure to enforce a provision is not a waiver. Headings are for convenience only.

19. Changes and contact

We may update these Terms. We will post the revised version and update the effective date. For material changes, we will provide reasonable advance notice where practicable. Changes apply prospectively. If you do not agree, you must stop using the Services before the changes take effect.

Questions and legal notices may be sent to security@orthalon.com. You may use that address to request Orthalon's current registered postal address for formal notices.