Terms of Service

1. Agreement & acceptance

These Terms of Service (these "Terms") are a binding agreement between Castawaze LLC ("we", "us", "our"), which operates Opsybots (the "Service"), and the organization or person that accesses or uses the Service. By signing up for an account, clicking to accept these Terms, or otherwise accessing or using the Service, you agree to be bound by these Terms. If you are entering into these Terms on behalf of an organization, you represent that you have authority to bind that organization, and "you" and "your" refer to that organization.

These Terms incorporate by reference, and you also agree to, the following documents, each of which forms part of this agreement:

• our Privacy Policy at /legal/privacy,
• our Data Processing Addendum (DPA) at /legal/dpa,
• our Sub-processor list at /legal/subprocessors, and
• our Refund & Cancellation Policy at /legal/refunds.

If you do not agree to these Terms, you must not access or use the Service. If there is a conflict between these Terms and an incorporated document, these Terms control except as expressly stated in that document (for example, the DPA controls over these Terms for the processing of personal data).

2. Definitions

The following defined terms apply throughout these Terms and across the documents incorporated by reference. This section is the canonical source of these definitions for the Opsybots document set.

• "Castawaze LLC," "we," "us," "our" — Castawaze LLC, the company operating the Service.
• "Opsybots" or the "Service" — the hosted Opsybots offering at app.opsybots.com, including the hosted dashboard and its associated read-only scanning agents.
• "Customer," "you," "your" — the organization or person that subscribes to or uses the Service.
• "Authorized User" — an individual whom you permit to access and use the Service under your account.
• "Plan" — the subscription tier your Workspace is on. The Plan is the unit of billing, and each Plan includes a stated number of Connected Accounts and an unlimited number of Authorized Users.
• "Workspace" — your isolated environment within the Service (internally, a tenant).
• "Connected Account" — an AWS account that you link to the Service for read-only scanning.
• "Customer Account Metadata" — the AWS infrastructure metadata that the Service reads from a Connected Account, including resource configurations, IAM settings, cost and usage figures, and security posture. It is infrastructure metadata, not your application data, and it is not intended to contain personal data or protected health information (PHI).
• "Findings" — the structured results produced from Customer Account Metadata. Findings are written to, and remain in, your own AWS account, as are the weekly reports composed from them; we store no copy of either, as described in our Privacy Policy.
• "Sub-processor" — a third party we engage to process personal data on our behalf.
• "Effective Date" — the date stated at the top of the applicable document.

3. The Service

Opsybots is a hosted dashboard layered over a fleet of read-only AWS scanning agents. The agents run inside your own AWS account, under access that you grant, and are strictly read-only: they make only read, describe, and list calls against the resources in a Connected Account in order to identify cost waste, IAM risk, and security-posture issues. The agents write the structured Findings they produce to storage in your own AWS account. The agents never create, modify, or delete resources in your account, and they never access your application data.

The hosted dashboard reads your Findings at the time you view them, on demand, through a cross-account read-only role that you authorize, and renders them for you. The dashboard is the primary interface for reviewing Findings, managing suppressions, and administering your Workspace and Connected Accounts.

We may improve, modify, or discontinue features of the Service from time to time. We will use commercially reasonable efforts to avoid materially degrading the core functionality of the Service during a paid term, and we will provide notice of material changes as described in Section 15.

4. Accounts, eligibility, and Plans

To use the Service, you must be at least 18 years of age and capable of forming a binding contract. The Service is intended for business use and is not directed to individuals under 18.

You are responsible for your Workspace and for all activity that occurs under it, including the acts and omissions of your Authorized Users. You must ensure that each Authorized User keeps their credentials confidential and complies with these Terms. You are responsible for promptly removing Authorized Users who should no longer have access. You must provide accurate account and billing information and keep it current.

Fees are charged on your Workspace's Plan, not on the number of Authorized Users (see Section 7). You may add and remove Authorized Users freely and at no additional charge; every Plan includes an unlimited number of them. What each Plan limits is the number of Connected Accounts you may have linked at one time. If you need to connect more accounts than your Plan includes, you change Plan, subject to the billing terms below.

5. Customer authorization & acceptable use

When you link a Connected Account, you grant the Service read-only access to that AWS account for the purpose of scanning and rendering Findings. You represent and warrant that you own or otherwise control each Connected Account and that you are authorized to grant the Service read-only access to it. You must not configure, point, or otherwise direct the Service at any AWS account that you do not own or control, or for which you lack authority to authorize scanning.

You must not, and must not permit any Authorized User or third party to:

• use the Service to access, scan, or attempt to scan any account, system, or data without authorization;
• copy, modify, reverse-engineer, decompile, or disassemble the hosted Service, or attempt to derive its source code, except to the extent this restriction is prohibited by applicable law (note that the open-source components described in Section 9 are governed by their own licenses);
• resell, sublicense, rent, lease, or otherwise make the hosted Service available to any third party except your Authorized Users;
• interfere with, disrupt, or impair the integrity, security, or performance of the Service, or attempt to gain unauthorized access to it or its related systems;
• use the Service in violation of applicable law or any third party's rights, or to transmit malicious code; or
• circumvent or attempt to circumvent any usage limits, access controls, or billing mechanisms of the Service.

6. Customer responsibilities

You are responsible for the configuration and security of your own AWS environment, including the trust policy and credentials of the cross-account role you grant to the Service. You should grant only the read-only access that the Service requires, and you may revoke that access at any time (doing so will prevent the Service from reading new Findings).

You must not submit, expose, or cause the Service to process protected health information (PHI) or other data that requires a Business Associate Agreement (BAA) or comparable regulated-data arrangement. Customer Account Metadata is intended to be infrastructure metadata only. You are responsible for ensuring that the resources and metadata the Service reads from your Connected Accounts do not contain such regulated data. This responsibility ties to the disclaimers in Section 11.

7. Fees & billing

The Service is offered on a subscription basis, billed in advance through our payment processor, Stripe. Fees are charged on your Plan, and each Plan is defined by the number of Connected Accounts it includes. Every Plan includes an unlimited number of Authorized Users, so adding people to your Workspace never changes your bill. The current Plans are:

Your subscription auto-renews for successive periods at the then-current Plan and price until you cancel. A free time-limited demo is available without a credit card, as described in our Refund & Cancellation Policy; the demo is populated with sample data and does not include connecting a Connected Account. Charges begin only when you start a paid subscription.

When you change Plan during a billing period, the change is prorated by Stripe in accordance with its proration handling, and your next invoice reflects the adjusted Plan. Attempting to connect more Connected Accounts than your Plan includes requires moving to a Plan that includes them. You are responsible for any sales, use, value-added, or similar taxes associated with your subscription, exclusive of taxes based on our net income. If we are required to collect such taxes, they will be added to your charges.

Subscriptions are billed in advance and are non-refundable. You may cancel at any time through the Stripe Customer Portal; cancellation stops future renewals, and your access continues until the end of the then-current paid billing period. We do not provide refunds or credits for partial billing periods or downgrades, except where required by law.

For the full cancellation, proration, failed-payment, and chargeback terms, see our Refund & Cancellation Policy at /legal/refunds.

8. Data & privacy

The Service reads Customer Account Metadata from your Connected Account both when you view it and on an automated schedule to compose your weekly brief, and renders Findings on demand. Your Findings are written to, and remain in, your own AWS account, and the weekly reports composed from them are written back to that same storage. We do not keep a copy of your findings history or of your reports; the only data we persist is the limited account-administration data described in the Privacy Policy.

How we handle the limited account-administration data we do collect — such as user and Workspace records, Connected-Account configuration, and billing identifiers — is described in our Privacy Policy at /legal/privacy. Where we act as a processor of personal data on your behalf, our Data Processing Addendum at /legal/dpa governs that processing and incorporates the applicable Standard Contractual Clauses.

9. Intellectual property

As between you and us, Castawaze LLC owns the Service, including the hosted dashboard, its underlying software, and all related intellectual property, except for the open-source components described below. We grant you a limited, non-exclusive, non-transferable, revocable right to access and use the hosted Service during your subscription, solely in accordance with these Terms. No rights are granted except as expressly stated.

The open-source Opsybots scanning agents and the single-account edition of the dashboard are made available separately under the Apache License, Version 2.0, and your use of those components is governed by that license rather than by these Terms.

As between you and us, you own your own data, including your Customer Account Metadata, your Findings, and your weekly reports (all of which remain in your AWS account). Nothing in these Terms transfers ownership of your data to us. You grant us only the limited rights necessary to provide the Service to you: reading your Findings in order to render them, composing the weekly brief from them, writing the resulting report back to your own storage, and delivering that brief to you as described in our Privacy Policy.

10. Third-party services

The Service depends on third-party services and Sub-processors, including Amazon Web Services (AWS) for hosting, identity, email, and AI inference, and Stripe for billing. A current list is maintained at /legal/subprocessors. Your use of those third-party services through the Service may be subject to the third parties' own terms and policies, which apply to their respective portions of the overall offering. We are not responsible for the acts, omissions, or terms of third parties, and the availability of the Service may depend on the availability of those third-party services.

11. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL IMPLIED WARRANTIES, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT IT WILL MEET YOUR REQUIREMENTS.

Findings are advisory only. They are produced by automated scanning and AI-assisted review and are intended to help you identify potential cost waste, IAM risk, and security-posture issues. Findings are not a guarantee of security, compliance, or the absence of risk, and they are not a substitute for your own security review, professional judgment, or compliance program. You are solely responsible for the decisions you make and the actions you take based on Findings.

Opsybots is designed to be HIPAA-conscious and runs its AI inference on Amazon Bedrock, which is HIPAA-eligible under AWS's Business Associate Addendum. However, Castawaze LLC does not currently offer a Business Associate Agreement (BAA), and Opsybots is not certified or represented as "HIPAA-compliant." You must not submit, expose, or cause the Service to process protected health information (PHI) or other data that requires a BAA.

12. Limitation of liability

To the maximum extent permitted by law, Castawaze LLC's total aggregate liability arising out of or relating to the Service or these Terms will not exceed the greater of (a) the total fees you paid to us for the Service in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) one hundred U.S. dollars (US$100). Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits or revenues, even if advised of the possibility.

The limitations and exclusions in this Section apply to the fullest extent permitted by applicable law and regardless of the form of action, whether in contract, tort (including negligence), strict liability, or otherwise. Some jurisdictions do not allow certain limitations or exclusions, so some of the above may not apply to you; in that case, our liability is limited to the maximum extent permitted by law.

13. Indemnification

You will defend, indemnify, and hold harmless Castawaze LLC and its officers, members, employees, and agents from and against any third-party claims, damages, liabilities, losses, and reasonable expenses (including reasonable attorneys' fees) arising out of or relating to: (a) your misuse of the Service; (b) your Customer Account Metadata, your Connected Accounts, or the content the Service reads from them; or (c) your breach of these Terms, including in particular your representations and obligations under Section 5 (Customer authorization & acceptable use). We will promptly notify you of any claim subject to this Section, allow you to control its defense (provided that any settlement that imposes a non-monetary obligation on us requires our prior written consent), and reasonably cooperate with you at your expense.

14. Term & termination

These Terms remain in effect for as long as you use the Service or maintain a Workspace. Either party may terminate this agreement: you may terminate by cancelling your subscription and closing your account (cancellation is handled as described in Section 7 and the Refund & Cancellation Policy); we may terminate or suspend your access if you materially breach these Terms, fail to pay fees when due, or use the Service in a way that creates risk or legal exposure for us or others.

Upon termination, your right to access and use the Service ends. Your Findings and your weekly reports remain in your own AWS account, so there is nothing of either kind for us to return or delete, and they remain readable by you without the Service. The limited control-plane account-administration data we hold is deleted or anonymized in accordance with the retention terms of our Privacy Policy (generally within 30 days of account closure), except where we must retain certain records (for example, billing and tax records) to meet legal obligations. The provisions that by their nature should survive termination — including Sections 2, 8, 9, 11, 12, 13, 16, and 17 — survive.

15. Changes to the Terms

We may update these Terms from time to time. If we make a material change, we will provide notice by email to the address associated with your account or through an in-app notice before the change takes effect. The "lastUpdated" date at the top of this document reflects the most recent revision. Your continued use of the Service after the effective date of an updated version constitutes your acceptance of the updated Terms. If you do not agree to a change, you must stop using the Service and may cancel as described in Section 7.

16. Governing law & disputes

These Terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. Subject to any binding arbitration or small-claims provision, the exclusive venue for disputes is the state and federal courts located in [COUNTY] County, Texas, and the parties consent to personal jurisdiction there.

Informal resolution first. Before filing any claim, the parties agree to first try in good faith to resolve the dispute informally. You agree to contact us at legal@opsybots.com with a brief written description of the dispute and the relief you seek, and to allow at least thirty (30) days for the parties to attempt to resolve the matter before initiating a formal proceeding. We will use the contact information associated with your account to reach you for the same purpose.

Small-claims carve-out. Notwithstanding the venue provision above, either party may bring an individual action in a small-claims court of competent jurisdiction for disputes that qualify, instead of proceeding in the courts identified above.

17. Miscellaneous

Assignment. You may not assign or transfer these Terms, in whole or in part, without our prior written consent, and any attempted assignment in violation of this Section is void. We may assign these Terms to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets. These Terms bind and benefit the parties' permitted successors and assigns.

Severability. If any provision of these Terms is held to be invalid or unenforceable, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.

No waiver. Our failure to enforce any provision of these Terms is not a waiver of our right to do so later, and any waiver must be in writing to be effective.

Entire agreement. These Terms, together with the documents they incorporate by reference (the Privacy Policy, DPA, Sub-processor list, and Refund & Cancellation Policy), constitute the entire agreement between you and us regarding the Service and supersede all prior or contemporaneous understandings on that subject.

Notices. We may provide notices to you by email to the address associated with your account or through an in-app notice; such notices are effective when sent. You may provide notices to us at legal@opsybots.com.

Force majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labor disputes, governmental action, internet or utility failures, or failures or interruptions of third-party services or infrastructure on which the Service depends.

18. Contact

Castawaze LLC — Opsybots
Privacy & data requests: privacy@opsybots.com
Legal notices: legal@opsybots.com
Security disclosures: security@opsybots.com
Support & billing: support@opsybots.com