Terms of Service

1. Parties and contract structure

“Customer” means the company or other legal organisation identified in an Order Form or for whose benefit an account is created. “kubbeevault” means the applicable contracting entity under these Terms. KUBBEE TECH LIMITED, an Irish private company limited by shares registered under CRO number 811108, with its registered office at 2nd Floor, 57 Mary Street, Dublin 1, D01 C6X5, Ireland, is the contracting entity for Customers in Europe. KUBBEEVAULT INOVA SIMPLES (I.S.), CNPJ 63.450.016/0001-16, municipal registration 0.322.222-5, with its address at Av. Direitos Humanos 1201, 114/4, Imirim, São Paulo - SP, 02475-000, Brazil, is the contracting entity for Customers in Brazil and all other locations outside Europe, and is the platform company.

Before acceptance, qualified counsel will review and adapt the Customer agreement for the specific transaction. The agreement consists of the Order Form, these Terms, the Acceptable Use Policy, the Data Processing Agreement when kubbeevault processes personal data for the Customer, and any service description or support schedule expressly incorporated into the Order Form. The lawyer-reviewed Order Form controls over these Terms for a specific conflict, and negotiated terms apply only to the Customer named in them.

2. Business eligibility and authority

• Accounts may be created only for a company, partnership, public body, nonprofit, or other legal organisation, not for personal, household, or consumer use.
• The person clicking to accept the agreement represents that they have authority to bind the Customer. kubbeevault will retain an auditable acceptance record identifying the Customer, accepting representative, agreement and policy versions, timestamp, and relevant technical evidence.
• The Customer is responsible for its authorised users, administrators, affiliates permitted by the Order Form, and all use of its account.
• The Customer must provide accurate company, billing, administrator, and contact information and keep it current.

3. Services and plans

kubbeevault provides a hosted business platform for storing, organising, sharing, controlling, and auditing credentials, passwords, API keys, tokens, certificates, and application secrets. Supported browser, REST API, Kubernetes, password-generation, deployment, and support capabilities depend on the selected plan and Order Form.

The available plan families are STARTER, PRO, and ENTERPRISE. Published plan descriptions are informational; the Order Form confirms the purchased limits, fees, deployment, support coverage, service level, data location, and any optional services. ENTERPRISE may include a private or on-premises deployment and custom terms. kubbeevault may improve the Services without materially reducing the core functionality purchased for the subscription term.

4. Limited right to use the Services

Subject to payment and compliance with the agreement, kubbeevault grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services for the Customer’s internal business operations and within its purchased limits.

• The Customer may not resell, rent, commercially exploit, or make the Services available to an unauthorised third party.
• The Customer may not copy, modify, translate, create derivative works from, reverse engineer, decompile, disassemble, or attempt to obtain source code, except to the limited extent a restriction is prohibited by applicable law.
• The Customer may not remove proprietary notices or use the Services to build or benchmark a competing product for replication.
• Third-party integrations may be used only as documented and with the Customer’s own valid rights and credentials.

5. Accounts and Customer responsibilities

• Designate administrators and maintain appropriate internal governance, access, approval, offboarding, and secret-rotation procedures.
• Assign individual user accounts, protect authentication factors, avoid shared login credentials, and promptly disable access that is no longer authorised.
• Configure roles, teams, workspaces, vaults, integrations, and retention settings appropriately for the Customer’s risk and legal requirements.
• Maintain lawful rights to Customer Data and provide all required notices and instructions to users and data subjects.
• Monitor audit information made available by the selected plan and promptly report suspected compromise or unauthorised use.
• Use supported clients and maintain the security of the Customer’s devices, networks, identity systems, integrations, private deployments, and recovery material.

6. Acceptable use and suspension

The Acceptable Use Policy is incorporated into these Terms. kubbeevault may suspend affected access when reasonably necessary to stop an active security threat, unlawful use, material policy breach, harm to other customers, or use materially beyond purchased limits. Where circumstances permit, kubbeevault will give notice and a reasonable opportunity to cure. Emergency suspension may occur without prior notice and will be limited in scope and duration where reasonably practicable.

7. Fees, taxes, and payment

Fees, currency, billing interval, usage limits, overages, setup charges, professional services, taxes, refunds, and payment dates are negotiated and stated in the lawyer-reviewed Order Form.

Late-payment consequences, any cure period, billing-dispute procedure, and any right to suspend for undisputed overdue amounts are negotiated and stated in the Order Form.

8. Customer Data and data protection

The Customer retains its rights in data, credentials, secrets, configurations, and other content submitted to the Services (“Customer Data”). The Customer instructs kubbeevault to host, process, transmit, back up, and otherwise use Customer Data only as needed to provide, secure, support, and comply with law in relation to the Services.

Where kubbeevault processes personal data on the Customer’s behalf, the Data Processing Agreement applies. kubbeevault does not acquire ownership of Customer Data and does not use Customer secrets for advertising. The Customer must not place data in the Services when doing so would violate law, third-party rights, or the agreement.

9. Security and service management

kubbeevault will maintain technical and organisational measures appropriate to the nature of the Services and the risks of processing, as described in the Security Policy and Data Processing Agreement. No security measure eliminates all risk. The Customer remains responsible for secure configuration and for determining whether the Services are appropriate for its legal, regulatory, and operational requirements.

Availability targets, support coverage, response times, service credits, backup or recovery commitments, maintenance notice, and incident-notification commitments apply only when stated in the selected plan, Order Form, or Data Processing Agreement. Service credits are the Customer’s exclusive financial remedy for an availability SLA failure unless an Order Form states otherwise.

10. Confidentiality

Each party will protect the other party’s non-public business, technical, security, financial, and product information using at least reasonable care and will use it only to perform or receive the Services. Confidential information may be shared with personnel, advisers, and service providers who need it and are bound by appropriate confidentiality duties, or when disclosure is legally required. If legally permitted, the receiving party will give advance notice of compelled disclosure.

These duties do not apply to information independently developed without use of the other party’s information, lawfully received without confidentiality restriction, or publicly available without breach. Trade secrets and Customer secrets remain protected for as long as they remain trade secrets or confidential; other confidential information remains protected for five years after termination.

11. Intellectual property and feedback

kubbeevault and its licensors retain all rights in the Services, software, APIs, interfaces, architecture, documentation, algorithms, security methods, brands, updates, and improvements. Except for the limited use right in section 4, no intellectual-property right is transferred to the Customer.

If the Customer provides suggestions or feedback, kubbeevault may use it without restriction or payment, provided it does not identify the Customer or disclose Customer Data. Custom development, plugins, and deliverables remain kubbeevault property unless an Order Form expressly assigns ownership in writing.

12. Term, renewal, termination, and exit

The subscription start, committed term, renewal, cancellation, notice and cure periods, termination rights, and any early-termination charge are negotiated and stated in the lawyer-reviewed Order Form.

After termination, access, export availability, and deletion timing follow the periods negotiated in the Order Form, subject to backup cycles, mandatory legal retention, and data the Customer has deployed outside kubbeevault’s control. The Customer is responsible for exporting data within the agreed period.

13. Warranties and disclaimers

kubbeevault warrants that it will provide the Services with reasonable skill and care and that the Services will materially conform to applicable documentation during the subscription term. Remedies for a verified breach, including any correction, re-performance, termination, credit, or refund, are those negotiated in the lawyer-reviewed Customer agreement.

Except for express warranties in the agreement and to the maximum extent permitted by law, the Services are provided “as is.” kubbeevault disclaims implied warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation. kubbeevault is not responsible for third-party services, Customer systems, unsupported configurations, or loss caused by the Customer’s failure to follow security guidance.

14. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, exemplary, punitive, or consequential loss, or for lost profit, revenue, goodwill, or anticipated savings. This exclusion does not apply where applicable law prohibits it.

Except for excluded claims below, each party’s total aggregate liability arising from the agreement will not exceed the fees paid or payable for the affected Services during the 12 months before the event giving rise to liability. The cap does not apply to fraud, wilful misconduct, death or personal injury caused by negligence, infringement or misuse of the other party’s intellectual property, breach of confidentiality, the Customer’s payment obligations, or liability that cannot lawfully be limited. Data-protection liability is subject to applicable law and any specific cap in an Order Form.

15. Third-party claims

kubbeevault will defend the Customer against a third-party claim that the paid Services, when used as authorised, infringe that third party’s intellectual-property rights, and will pay finally awarded damages or an approved settlement. kubbeevault may modify or replace the affected Service or terminate it with a refund of prepaid fees for the unused period. This does not cover claims caused by Customer Data, Customer modifications, combinations not supplied by kubbeevault, or continued use after notice of an available remedy.

The Customer will defend kubbeevault against third-party claims arising from unlawful Customer Data, the Customer’s breach of the Acceptable Use Policy, or use of the Services in violation of third-party rights. Each indemnity requires prompt notice, control of the defence by the indemnifying party, and reasonable cooperation; no settlement may admit fault or impose a non-monetary obligation on the other party without consent.

16. General terms

Neither party is liable for delay caused by events beyond its reasonable control, except payment obligations. Neither party may assign the agreement without consent, except to an affiliate or successor in a merger, acquisition, or sale of substantially all relevant assets that assumes the agreement. The parties are independent contractors. Failure to enforce a term is not a waiver. Invalid terms will be narrowed or severed while the rest remains effective.

Notices must be sent using the addresses in the Order Form, with legal notices copied to the approved kubbeevault legal contact. kubbeevault may update online policies prospectively. Material changes will be notified before they take effect and will not materially reduce the Customer’s rights during a current committed term unless required by law or agreed by the parties.

For European Customers contracted through KUBBEE TECH LIMITED, governing law, courts, and dispute-resolution terms are determined in the lawyer-reviewed Customer agreement before electronic acceptance. For Customers in Brazil and all other locations outside Europe contracted through KUBBEEVAULT INOVA SIMPLES (I.S.), the agreement is governed by Brazilian law and the courts of São Paulo, São Paulo, Brazil have exclusive jurisdiction, unless the lawyer-reviewed Order Form expressly states another negotiated arrangement.