Terms of Service

1. Acceptance of Terms & Eligibility

By registering an account, connecting a CLI client, authorizing an MCP agent, or otherwise accessing ApiVault, you agree to be bound by these Terms and our Privacy Policy. If you are accepting on behalf of an employer, company, or legal entity, you represent and warrant that you possess full legal authority to bind that organization.

You must be at least 13 years of age (or the minimum age of digital consent in your jurisdiction) to use ApiVault. If you do not agree to all terms and conditions set forth herein, you must immediately discontinue access and use of the service.

2. Description of the Service

ApiVault provides encrypted cloud secret storage, environment variable management, and programmatic access tools designed for developers, engineering teams, and autonomous AI coding agents:

• Web Dashboard: Graphical interface at apivault.tech for secret lifecycle management, team environments, audit logs, and security controls.
• Command-Line Interface (apivault): Open-source CLI for terminal workflows, browser-based authentication, and in-memory child process secret injection (apivault run).
• Remote MCP Server: Standardized Model Context Protocol endpoint at https://mcp.apivault.tech/mcp enabling AI coding assistants (such as Cursor, Claude Desktop, and Windsurf) to securely query masked metadata and decrypt secrets via OAuth 2.1.
• Official AI Agent Skills: Structured guidelines and automated runbooks for AI assistants.

3. Account Security & Authentication

You are solely responsible for maintaining the confidentiality and integrity of your account credentials, active browser sessions, FIDO2/WebAuthn Passkeys, TOTP authenticator devices, and CLI access tokens. You accept full responsibility for all actions, API calls, and secret modifications occurring under your account credentials.

You agree to notify us immediately at support@apivault.tech upon discovering any unauthorized account access, credential compromise, or security anomaly.

4. Zero-Knowledge Cryptography & Vault Key Disclaimer

You retain sole ownership of all secrets, API tokens, and credentials stored in ApiVault. When using **Custom Encryption Mode**, your secrets are encrypted and decrypted client-side using keys derived from your personal master vault passphrase:

• Irrecoverability: ApiVault does not transmit, receive, store, or escrow your custom vault key. If you lose, forget, or misplace your custom vault key, your encrypted secrets cannot be recovered or restored by ApiVault or any third party.
• Backup Responsibility: You are strictly responsible for maintaining independent backups of all mission-critical credentials and master passphrases. ApiVault disclaims all liability for permanent data loss resulting from forgotten vault keys or forgotten master passphrases.

5. AI Coding Agents & MCP Tool Usage

When you connect third-party AI assistants or autonomous coding agents to the ApiVault Remote MCP Server or execute commands via apivault run:

• OAuth Scope Delegation: You are solely responsible for reviewing and granting OAuth 2.1 permissions (keys:read, keys:write, keys:reveal) to connected AI agents.
• Third-Party Execution: ApiVault provides a secure credential retrieval pipeline, but does not control and is not liable for how external AI assistants (e.g., Cursor, Anthropic Claude, OpenAI, Windsurf) store, display, log, or process decrypted values within their prompt transcripts.
• Process Memory Injection: The CLI command apivault run passes secrets directly into child process memory. You are responsible for ensuring that injected child commands do not unsafely echo or output credentials to insecure public logs.

6. Acceptable Use Policy

You agree not to use ApiVault to:

• Violate any local, national, or international law, regulation, or third-party rights
• Store, transmit, or manage credentials intended for malicious software, botnets, or ransomware
• Attempt unauthorized penetration testing, vulnerability scanning, or denial-of-service attacks against our systems
• Circumvent API rate limits, authentication barriers, or cryptographic controls
• Impersonate any person, entity, or service provider
• Resell, white-label, or redistribute the proprietary web dashboard without express written permission

7. Intellectual Property & Open-Source Components

ApiVault, the ApiVault web dashboard, proprietary backend algorithms, logos, domain names, and visual assets are the exclusive intellectual property of TLB-STATION.

The official CLI (github.com/TLB-STATION/apivault), MCP server (github.com/TLB-STATION/apivault-mcp), and Agent Skill (github.com/TLB-STATION/apivault-skill) are distributed under the terms of the open-source MIT License.

8. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE APIVAULT PLATFORM, WEB APP, CLI, AND MCP SERVER ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.

9. Limitation of Liability

IN NO EVENT SHALL APIVAULT, TLB-STATION, ITS DIRECTORS, EMPLOYEES, PARTNERS, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION, LOSS OF PROFITS, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM (A) YOUR ACCESS TO OR USE OF OR INABILITY TO ACCESS OR USE THE SERVICE; (B) ANY THIRD-PARTY CONDUCT OR CONTENT ON THE SERVICE; (C) UNAUTHORIZED ACCESS, USE, OR ALTERATION OF YOUR TRANSMISSIONS OR CONTENT; OR (D) FORGOTTEN OR LOST CUSTOM ENCRYPTION VAULT KEYS.

OUR AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATING TO THESE TERMS SHALL NOT EXCEED THE GREATER OF THE TOTAL AMOUNTS PAID BY YOU TO APIVAULT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR ONE HUNDRED UNITED STATES DOLLARS (USD $100.00).

10. Indemnification

You agree to defend, indemnify, and hold harmless ApiVault, TLB-STATION, and their respective officers, contractors, and employees from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses, or fees (including reasonable legal fees) arising out of or relating to your violation of these Terms, your use of the service, or your stored vault secrets.

11. Termination & Account Cancellation

You may terminate your agreement with ApiVault at any time by deleting your account through the web dashboard Settings. We reserve the right to suspend or terminate your account immediately, without prior notice or liability, in the event of any material breach of these Terms.

Upon termination, all licenses granted to you terminate immediately, and all provisions of these Terms which by their nature should survive termination (including ownership provisions, warranty disclaimers, indemnity, and limitations of liability) shall survive.

12. Changes to Terms

We reserve the right to modify these Terms at any time. When material updates occur, we will revise the “Last updated” date at the top of this document and provide notice where feasible. Your continued use of ApiVault following the posting of revised Terms constitutes your acceptance.

13. Contact & Support

If you have questions, concerns, or legal notices regarding these Terms of Service, please reach out to us at support@apivault.tech.