DRAFT — requires lawyer review. Not legal advice.

Dropwarden Terms of Service

Effective date: TBD

These Terms of Service ("Terms") are an agreement between TBD, TBD ("we", "us") and the organization or person that creates an account ("Customer", "you"). They govern your use of Dropwarden: the SFTP and FTPS service at sftp.dropwarden.com, the customer portal and web file client at app.dropwarden.com, the management API at api.dropwarden.com, and the website at dropwarden.com (together, the "Service").

If you accept these Terms for an organization, you confirm that you have authority to bind it. The Service is for business use. You must be at least 18 years old to create an account.

These documents form part of the Terms:

• the Acceptable Use Policy ("AUP");
• the Data Processing Addendum ("DPA"), which applies whenever we process personal data on your behalf;
• the Privacy Policy, which explains how we handle personal data as a controller;
• the plan description and limits shown on the pricing page at https://dropwarden.com/pricing and in the portal at the time you subscribe ("Plan").

If these Terms and the DPA conflict on the processing of personal data, the DPA wins.

1. The Service

1.1 What we provide. A hosted file transfer service: SFTP, FTPS (explicit TLS only) and HTTPS web access to files stored for your organization, with user and folder permissions, activity notifications, an audit log and a management API. Features depend on your Plan.

1.2 Plan limits. Each Plan has limits (for example credentials, storage, file count, included downloads, audit retention and fair-use request volumes). The current limits are published on the pricing page and returned by our API. They are not repeated in these Terms. Usage above an included allowance may be billed as overage at the rates published for your Plan. "No connection cap" means we do not set an artificial limit on concurrent connections. Fair-use limits still apply to protect the Service for all customers.

1.3 Availability. We run the Service with a 99.5% uptime target (no high availability). The Service runs on a single compute instance, so planned maintenance and failures of that instance cause downtime. We announce planned maintenance in advance where we can and publish status at https://status.dropwarden.com. The uptime target is a goal, not a guarantee, and does not entitle you to service credits unless a separate signed order says so.

1.4 Static IP. We publish the IP address that the Service uses for inbound connections and outbound webhooks. We will give at least 90 days' notice by email before changing it, except where an emergency change is needed to keep the Service secure or available.

1.5 Changes to the Service. We may add, change or remove features. If we remove a material feature of your paid Plan, we will give you at least 30 days' notice. If you do not accept the change, you may cancel and receive a pro-rata refund of prepaid fees for the unused term.

1.6 Beta features. Features labelled beta or preview are provided as-is, may change or end at any time, and are excluded from any uptime target.

2. Accounts and security

2.1 You are responsible for the accounts, users, partners, credentials, SSH keys, API keys and permissions in your organization, and for everything done through them.

2.2 You must keep credentials confidential, use two-factor authentication for administrators where available (we recommend enabling the organization-wide "require 2FA" setting), and tell us promptly at [email protected] if you suspect unauthorized access.

2.3 Organization owners and admins can invite external users ("partners"). You are responsible for having the right to give them access and for their compliance with the AUP.

2.4 Support access. Our support staff see account metadata only. They can access file contents only inside a time-boxed support session that an owner of your organization grants and can revoke at any time. Support sessions are recorded in your audit log.

3. Free trial

3.1 New organizations can use a free trial for 7 days. No payment card is required. The trial has reduced limits and some features are disabled, as described on the pricing page. We allow one trial per organization and may refuse or end trials we reasonably believe are abusive.

3.2 If you do not subscribe by the end of the trial, your organization is locked: SFTP, FTPS, web and API file access stops, but your data is kept. Subscribing unlocks it immediately.

3.3 Data of a locked trial organization is permanently deleted 90 days after the lock. We send reminder emails before the trial ends and several warning emails before deletion to the organization's owners. Deletion is described in section 7.

4. Fees, billing and taxes

4.1 Paid Plans are billed in advance, monthly or annually, through our payment processor Stripe. Prices are those published on the pricing page or in a signed order when you subscribe. Payment card details are entered directly with Stripe. We never see or store full card numbers.

4.2 Plan changes take effect immediately and are prorated by Stripe. Overage, if any, is billed in arrears.

4.3 Fees exclude taxes. We collect sales tax, VAT or similar taxes where required, calculated by Stripe Tax based on the billing details you provide.

4.4 We may change prices for future billing periods with at least 30 days' notice by email. The change applies from your next renewal after the notice period.

4.5 Failed payments. If a payment fails, we retry and email you. If payment is still outstanding at the end of the retry period, your organization is locked as described in section 7.

4.6 Except where these Terms or the law say otherwise, fees are non-refundable.

5. Your data

5.1 Ownership. You (or your licensors) own the files and other content you or your users upload ("Customer Data"). We claim no ownership of Customer Data.

5.2 Our licence to process it. You grant us a limited licence to host, copy, transmit, scan for malware and otherwise process Customer Data only as needed to provide, secure and support the Service, to follow your instructions, and as required by law. The DPA governs any personal data in Customer Data.

5.3 What we do not do. We do not sell Customer Data, use it for advertising, or use file contents to train machine-learning models. We never log file contents. Our audit log records events (for example who uploaded, downloaded, deleted or renamed which file, when, from which IP address and over which protocol), not what is inside files.

5.4 Meaning of "read". In notifications and the audit log, a "read" or "download" means a completed file download. SFTP has no separate "opened" or "viewed" event, and directory listings are not reported as reads.

5.5 Your responsibilities for Customer Data. You are responsible for the lawfulness of Customer Data, for having the rights and notices or consents needed to upload it and share it with your users and partners, and for keeping your own copies of data you cannot afford to lose. We protect stored files using the durability of our storage provider. We do not keep separate backup copies of your files unless your Plan includes versioning or replication.

5.6 Regulated data. Unless a separate signed agreement with us expressly allows it, you must not upload payment cardholder data, protected health information or other data whose hosting requires certifications or contract terms we do not offer. See the AUP.

5.7 Export. Owners can export organization metadata, the audit log and files through the portal and API at any time, including while the organization is locked.

6. Acceptable use, suspension and freezing

6.1 You must follow the AUP and make sure your users and partners do too.

6.2 We may suspend or freeze your organization, or a user in it, without prior notice if we reasonably believe that it breaches the AUP or the law, threatens the security or integrity of the Service or other customers, or exposes us to legal liability. A freeze disconnects active sessions and blocks all access. Where the law and the circumstances allow, we will tell you why and give you a chance to respond, and we will restore access once the issue is resolved.

6.3 We may remove or quarantine specific files that our malware scanning flags or that we are legally required to remove.

7. Term, cancellation, lock and deletion

7.1 These Terms apply from account creation until your organization is deleted.

7.2 Cancellation. You may cancel at any time in the portal. The Service continues until the end of the paid period. After that, the organization is locked.

7.3 Lock and deletion for paid organizations. When a paid organization is locked (cancellation, unpaid invoices or at your request), file access stops but data is kept for 90 days so you can pay, resubscribe or export it. After that period we permanently delete it.

7.4 What deletion covers. Deletion removes all files stored under your organization (including any versions and quarantined files), your users and their credentials, notification rules and the organization's audit log, and removes personal data from our records. We keep only the minimum records the law requires or permits (for example invoices, tax records and a record that deletion took place, which contains no personal data). Encrypted database backups that contain your account metadata expire on their own within 35 days and are not restored except to recover the Service from a disaster. We email the organization's owners when deletion is complete.

7.5 We may terminate these Terms for material breach that is not cured within 30 days of notice, or immediately for serious or repeated AUP breaches.

7.6 Sections 4 (for fees already due), 5.1, 7.4, 8, 9, 10 and 12 survive termination.

8. Confidentiality and security

8.1 Each party will protect the other's confidential information with reasonable care and use it only to perform under these Terms.

8.2 We maintain the technical and organizational measures described in the Security Overview and Annex II of the DPA. We may improve them over time but will not materially reduce the overall level of protection during your subscription.

8.3 We will notify you of a security incident affecting your Customer Data as set out in the DPA.

9. Warranties and disclaimers

9.1 Each party confirms it has the authority to enter these Terms.

9.2 Except as expressly stated in these Terms, the Service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, or that malware scanning will detect every malicious file.

10. Liability

10.1 Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or goodwill, even if advised of the possibility.

10.2 Each party's total liability arising out of these Terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim. For free trials, our total liability is limited to the amount stated in TBD.

10.3 The limits in 10.1 and 10.2 do not apply to your payment obligations, to either party's indemnification obligations, or to liability that cannot be limited by law.

11. Indemnity

11.1 You will defend and indemnify us against third-party claims arising from Customer Data or from your or your users' breach of the AUP.

11.2 We will defend and indemnify you against third-party claims that the Service, as we provide it, infringes their intellectual property rights, subject to the usual exclusions and procedures (to be completed in legal review).

12. General

12.1 Governing law and disputes. These Terms are governed by TBD. The courts of TBD have exclusive jurisdiction, except that either party may seek urgent injunctive relief anywhere. Mandatory consumer or data-protection law that applies to you is not affected.

12.2 Changes to these Terms. We may update these Terms. For material changes we will email account owners at least 30 days before they take effect. Continued use after that date means acceptance. If you object, you may cancel before the change takes effect and receive a pro-rata refund of prepaid fees.

12.3 Open-source software. The Service uses open-source components, including an SFTP server licensed under the GNU Affero General Public License v3. We use it unmodified. Notices and licence texts are available on request at [email protected].

12.4 Export controls and sanctions. You will not use the Service in breach of applicable export control or sanctions laws.

12.5 Notices. We send notices to the email addresses of your organization's owners. You send notices to [email protected] and, for legal notices, to TBD.

12.6 Assignment, force majeure, entire agreement. Neither party may assign these Terms without the other's consent, except to a successor in a merger or sale of substantially all relevant assets. Neither party is liable for delays caused by events beyond its reasonable control. These Terms, with the documents listed at the top, are the entire agreement about the Service and replace earlier discussions. If any provision is unenforceable, the rest remains in effect.

Questions: [email protected].