> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/privacy-and-terms/terms-of-service.md).

# Terms of Service

### 1. Introduction and Acceptance <a href="#id-1-introduction-and-acceptance" id="id-1-introduction-and-acceptance"></a>

#### 1.1 Agreement <a href="#id-11-agreement" id="id-11-agreement"></a>

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer," "you," or "your") and Oten ("Oten," "Oten KMS," "we," "us," or "our") governing your access to and use of the Key Management Service ("Oten KMS" or "Service").

#### 1.2 Acceptance <a href="#id-12-acceptance" id="id-12-acceptance"></a>

By accessing or using the Service, you agree to be bound by these Terms. If you are using the Service on behalf of an organization, you represent that you have the authority to bind that organization to these Terms.

#### 1.3 Modifications <a href="#id-13-modifications" id="id-13-modifications"></a>

We reserve the right to modify these Terms at any time. Material changes will be notified at least 30 days in advance. Continued use after changes take effect constitutes acceptance.

***

### 2. Service Description <a href="#id-2-service-description" id="id-2-service-description"></a>

#### 2.1 Overview <a href="#id-21-overview" id="id-21-overview"></a>

Oten KMS is a cloud-based key management service that provides:

* Customer Managed Key (CMK) creation and management
* Cryptographic operations (wrap, unwrap, encrypt, decrypt, as authorized by Customer)
* Key lifecycle management (rotation, versioning, status updates)
* Integration with third-party services (Google Workspace CSE, Google Drive)
* Trusted Execution Environment (TEE) support
* Access control and policy management
* Audit logging and compliance reporting

#### 2.2 Service Components <a href="#id-22-service-components" id="id-22-service-components"></a>

The Service includes:

* Oten KMS API and endpoints
* Administrative console/dashboard
* Documentation and technical support
* Integration connectors
* Audit and logging capabilities

#### 2.3 Service Availability <a href="#id-23-service-availability" id="id-23-service-availability"></a>

We strive to maintain high availability. Service Level Agreements (SLAs) are defined in separate agreements where applicable.

***

### 3. Account Registration and Security <a href="#id-3-account-registration-and-security" id="id-3-account-registration-and-security"></a>

#### 3.1 Account Creation <a href="#id-31-account-creation" id="id-31-account-creation"></a>

To use the Service, you must:

* Provide accurate and complete registration information
* Maintain the accuracy of your account information
* Designate authorized administrators

#### 3.2 Account Security <a href="#id-32-account-security" id="id-32-account-security"></a>

You are responsible for:

* Maintaining the confidentiality of authentication credentials
* Implementing appropriate access controls within your organization
* Promptly notifying us of any unauthorized access or security breach
* All activities that occur under your account

#### 3.3 Authentication Requirements <a href="#id-33-authentication-requirements" id="id-33-authentication-requirements"></a>

* Use of strong authentication methods is required
* Multi-factor authentication (MFA) is strongly recommended
* API keys and tokens must be securely stored and rotated regularly

***

### 4. Permitted Use <a href="#id-4-permitted-use" id="id-4-permitted-use"></a>

#### 4.1 License Grant <a href="#id-41-license-grant" id="id-41-license-grant"></a>

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable license to access and use the Service for your internal business purposes.

#### 4.2 Acceptable Use <a href="#id-42-acceptable-use" id="id-42-acceptable-use"></a>

You agree to use the Service only for lawful purposes and in accordance with:

* These Terms
* Applicable laws and regulations
* Our Acceptable Use Policy
* Industry best practices for key management

#### 4.3 Prohibited Activities <a href="#id-43-prohibited-activities" id="id-43-prohibited-activities"></a>

You shall NOT:

* Use the Service for illegal activities or to facilitate illegal transactions
* Attempt to gain unauthorized access to the Service or its systems
* Interfere with or disrupt the Service or its infrastructure
* Reverse engineer, decompile, or disassemble any part of the Service except to the extent permitted by applicable law
* Resell, sublicense, or redistribute the Service without authorization
* Use the Service to store or process prohibited content
* Exceed rate limits or abuse API endpoints
* Circumvent security controls or access restrictions
* Use the Service to manage keys for malicious software or ransomware

***

### 5. Customer Data and Keys <a href="#id-5-customer-data-and-keys" id="id-5-customer-data-and-keys"></a>

#### 5.1 Ownership <a href="#id-51-ownership" id="id-51-ownership"></a>

You retain all rights, title, and interest in:

* Your Customer Managed Keys (CMKs)
* Data encrypted using your keys
* Configuration and policy data
* Audit logs related to your use of the Service (excluding Oten system logs and analytics)

#### 5.2 Customer Responsibilities <a href="#id-52-customer-responsibilities" id="id-52-customer-responsibilities"></a>

You are responsible for:

* Backing up key metadata or recovery materials where supported by the Service
* Configuring appropriate key lifecycle policies
* Managing access permissions and conditions
* Compliance with your own regulatory requirements
* Data encrypted using keys managed through the Service

#### 5.3 Key Management <a href="#id-53-key-management" id="id-53-key-management"></a>

* Key creation, rotation, and deletion are Customer-controlled
* We do not store or persist plaintext key material, and we are not able to access your plaintext key material in a human-readable form
* Deleted keys cannot be recovered after the retention period as configured by Customer policies or as required by law

#### 5.4 Data Processing <a href="#id-54-data-processing" id="id-54-data-processing"></a>

We process your data only as necessary to provide the Service and as described in our Privacy Policy.

***

### 6. Service Levels and Support <a href="#id-6-service-levels-and-support" id="id-6-service-levels-and-support"></a>

#### 6.1 Availability Target <a href="#id-61-availability-target" id="id-61-availability-target"></a>

We strive to maintain high availability for the Service. Specific uptime commitments and service credits, if any, are defined in separate Service Level Agreements.

#### 6.2 Scheduled Maintenance <a href="#id-62-scheduled-maintenance" id="id-62-scheduled-maintenance"></a>

* Maintenance windows will be announced in advance
* We will minimize disruption during maintenance
* Emergency maintenance may occur without advance notice

#### 6.3 Support <a href="#id-63-support" id="id-63-support"></a>

Support is provided according to your service tier:

* **Standard:** Email support during business hours
* **Premium:** 24/7 support with priority response
* **Enterprise:** Dedicated support with SLA guarantees
* Response times, if any, are defined in the applicable plan documentation or SLA.

#### 6.4 Service Credits <a href="#id-64-service-credits" id="id-64-service-credits"></a>

Service credits for downtime are available according to the applicable SLA agreement.

***

### 7. Fees and Payment <a href="#id-7-fees-and-payment" id="id-7-fees-and-payment"></a>

#### 7.1 Pricing <a href="#id-71-pricing" id="id-71-pricing"></a>

* Fees are based on your selected service plan
* Usage-based charges may apply for API calls, key operations, and storage
* Current pricing is available on our website or in your service agreement

#### 7.2 Payment Terms <a href="#id-72-payment-terms" id="id-72-payment-terms"></a>

* Invoices are issued monthly/annually as agreed
* Payment is due within 30 days of invoice date
* Late payments may incur interest charges

#### 7.3 Taxes <a href="#id-73-taxes" id="id-73-taxes"></a>

Fees are exclusive of applicable taxes. You are responsible for all taxes except those based on our net income.

#### 7.4 Price Changes <a href="#id-74-price-changes" id="id-74-price-changes"></a>

* Price changes will be notified at least 60 days in advance
* Changes take effect at the next billing cycle after the notice period

***

### 8. Intellectual Property <a href="#id-8-intellectual-property" id="id-8-intellectual-property"></a>

#### 8.1 Company IP <a href="#id-81-company-ip" id="id-81-company-ip"></a>

We retain all rights to:

* The Service and its underlying technology
* Our trademarks, logos, and branding
* Documentation and training materials
* Improvements and enhancements to the Service

#### 8.2 Feedback <a href="#id-82-feedback" id="id-82-feedback"></a>

Any feedback, suggestions, or ideas you provide may be used by us without obligation or compensation to you.

#### 8.3 Restrictions <a href="#id-83-restrictions" id="id-83-restrictions"></a>

You shall not:

* Remove or alter any proprietary notices
* Use our trademarks without authorization
* Claim ownership of any part of the Service

***

### 9. Confidentiality <a href="#id-9-confidentiality" id="id-9-confidentiality"></a>

#### 9.1 Confidential Information <a href="#id-91-confidential-information" id="id-91-confidential-information"></a>

Both parties agree to protect confidential information disclosed during the relationship, including:

* Technical specifications and documentation
* Pricing and business terms
* Security configurations and audit results

#### 9.2 Exclusions <a href="#id-92-exclusions" id="id-92-exclusions"></a>

Confidentiality obligations do not apply to information that:

* Is publicly available
* Was known prior to disclosure
* Is independently developed
* Is rightfully obtained from third parties

#### 9.3 Required Disclosure <a href="#id-93-required-disclosure" id="id-93-required-disclosure"></a>

Disclosure is permitted if required by law, provided reasonable notice is given where legally permitted.

***

### 10. Warranties and Disclaimers <a href="#id-10-warranties-and-disclaimers" id="id-10-warranties-and-disclaimers"></a>

#### 10.1 Company Warranties <a href="#id-101-company-warranties" id="id-101-company-warranties"></a>

We warrant that:

* The Service will perform substantially as described in documentation
* We will use commercially reasonable security measures
* We have the right to provide the Service

#### 10.2 Customer Warranties <a href="#id-102-customer-warranties" id="id-102-customer-warranties"></a>

You warrant that:

* You have authority to enter into these Terms
* Your use will comply with applicable laws
* You will not use the Service for prohibited purposes

#### 10.3 Disclaimers <a href="#id-103-disclaimers" id="id-103-disclaimers"></a>

EXCEPT AS EXPRESSLY PROVIDED, THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE, OR THAT VULNERABILITIES WILL NEVER OCCUR.

***

### 11. Limitation of Liability <a href="#id-11-limitation-of-liability" id="id-11-limitation-of-liability"></a>

#### 11.1 Exclusion of Damages <a href="#id-111-exclusion-of-damages" id="id-111-exclusion-of-damages"></a>

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR BUSINESS OPPORTUNITIES.

#### 11.2 Liability Cap <a href="#id-112-liability-cap" id="id-112-liability-cap"></a>

OUR TOTAL LIABILITY SHALL NOT EXCEED THE FEES PAID BY YOU IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

#### 11.3 Exceptions <a href="#id-113-exceptions" id="id-113-exceptions"></a>

These limitations do not apply to:

* Breach of confidentiality obligations
* Violation of intellectual property rights
* Gross negligence or willful misconduct
* Indemnification obligations

***

### 12. Indemnification <a href="#id-12-indemnification" id="id-12-indemnification"></a>

#### 12.1 By Company <a href="#id-121-by-company" id="id-121-by-company"></a>

We will indemnify you against third-party claims alleging that the Service infringes intellectual property rights, provided you:

* Notify us promptly of the claim
* Allow us to control the defense
* Cooperate in the defense

This indemnity does not apply to claims arising from Customer modifications, misuse, or combination with non-approved systems.

#### 12.2 By Customer <a href="#id-122-by-customer" id="id-122-by-customer"></a>

You will indemnify us against third-party claims arising from:

* Your use of the Service in violation of these Terms
* Your violation of applicable laws
* Customer Data provided or generated through Customer’s use of the Service
* Your end users' actions

***

### 13. Term and Termination <a href="#id-13-term-and-termination" id="id-13-term-and-termination"></a>

#### 13.1 Term <a href="#id-131-term" id="id-131-term"></a>

These Terms are effective until terminated by either party.

#### 13.2 Termination for Convenience <a href="#id-132-termination-for-convenience" id="id-132-termination-for-convenience"></a>

Either party may terminate with 30 days written notice.

#### 13.3 Termination for Cause <a href="#id-133-termination-for-cause" id="id-133-termination-for-cause"></a>

Either party may terminate immediately if the other party:

* Materially breaches these Terms and fails to cure within 30 days
* Becomes insolvent or files for bankruptcy
* Ceases business operations

#### 13.4 Effect of Termination <a href="#id-134-effect-of-termination" id="id-134-effect-of-termination"></a>

Upon termination:

* Your access to the Service will be suspended
* You must pay all outstanding fees
* We will provide a data export period of 30 days, subject to technical feasibility and security constraints provided Customer is current on all payment obligations
* After the export period, your data will be securely deleted
* Provisions that should survive (confidentiality, liability, etc.) will remain in effect

#### 13.5 Key Material <a href="#id-135-key-material" id="id-135-key-material"></a>

* You are responsible for exporting or backing up key material before termination
* Keys will be scheduled for destruction after the export period
* Destroyed keys cannot be recovered

***

### 14. Compliance and Audit <a href="#id-14-compliance-and-audit" id="id-14-compliance-and-audit"></a>

#### 14.1 Regulatory Compliance <a href="#id-141-regulatory-compliance" id="id-141-regulatory-compliance"></a>

The Service is designed with controls and security principles aligned to widely recognized compliance frameworks and may support customer compliance efforts, subject to applicable agreements and certifications.

Including:

* GDPR
* CCPA
* HIPAA (only when a Business Associate Agreement is executed)
* SOC 2 (controls designed to align with Trust Services Criteria)
* ISO 27001 (controls aligned; certification planned)

#### 14.2 Audit Rights <a href="#id-142-audit-rights" id="id-142-audit-rights"></a>

On-site audits are subject to mutual agreement, scope definition, confidentiality obligations, and may be limited or declined where they pose security or operational risks. The customer may audit its own use through logs and reports available in the Service.

#### 14.3 Customer Compliance <a href="#id-143-customer-compliance" id="id-143-customer-compliance"></a>

You are responsible for ensuring your use of the Service complies with applicable laws and regulations in your jurisdiction.

***

### 15. Third-Party Integrations <a href="#id-15-third-party-integrations" id="id-15-third-party-integrations"></a>

#### 15.1 Google Workspace CSE Integration <a href="#id-151-google-workspace-cse-integration" id="id-151-google-workspace-cse-integration"></a>

* Integration is subject to Google's terms and conditions
* We are not responsible for Google service availability or changes
* You must comply with Google's acceptable use policies

#### 15.2 Google Drive Integration <a href="#id-152-google-drive-integration" id="id-152-google-drive-integration"></a>

* File encryption/decryption operations are performed according to your policies
* We are not responsible for data loss due to misconfiguration
* Google Drive's terms apply to stored content

#### 15.3 Other Integrations <a href="#id-153-other-integrations" id="id-153-other-integrations"></a>

* Third-party integrations are provided "as is"
* Changes to third-party services may affect functionality
* Additional terms may apply for specific integrations

***

### 16. Dispute Resolution <a href="#id-16-dispute-resolution" id="id-16-dispute-resolution"></a>

#### 16.1 Governing Law <a href="#id-161-governing-law" id="id-161-governing-law"></a>

These Terms are governed by the laws of Singapore, without regard to conflict of law principles.

#### 16.2 Informal Resolution <a href="#id-162-informal-resolution" id="id-162-informal-resolution"></a>

Before initiating formal proceedings, parties agree to attempt informal resolution for 30 days.

#### 16.3 Arbitration <a href="#id-163-arbitration" id="id-163-arbitration"></a>

Disputes not resolved informally shall be resolved by binding arbitration under the rules of SIAC, except for:

* Intellectual property disputes
* Injunctive relief requests
* Small claims within jurisdiction limits

#### 16.4 Class Action Waiver <a href="#id-164-class-action-waiver" id="id-164-class-action-waiver"></a>

You agree to resolve disputes individually and waive any right to participate in class actions.

***

### 17. General Provisions <a href="#id-17-general-provisions" id="id-17-general-provisions"></a>

#### 17.1 Entire Agreement <a href="#id-171-entire-agreement" id="id-171-entire-agreement"></a>

These Terms, together with the Privacy Policy and any applicable SLA, constitute the entire agreement between the parties.

#### 17.2 Severability <a href="#id-172-severability" id="id-172-severability"></a>

If any provision is found unenforceable, the remaining provisions shall continue in effect.

#### 17.3 Waiver <a href="#id-173-waiver" id="id-173-waiver"></a>

Failure to enforce any provision does not constitute a waiver of that provision.

#### 17.4 Assignment <a href="#id-174-assignment" id="id-174-assignment"></a>

You may not assign these Terms without our written consent. We may assign these Terms in connection with a merger or acquisition.

#### 17.5 Force Majeure <a href="#id-175-force-majeure" id="id-175-force-majeure"></a>

Neither party is liable for delays caused by circumstances beyond reasonable control, including natural disasters, war, terrorism, or government actions.

#### 17.6 Notices <a href="#id-176-notices" id="id-176-notices"></a>

Notices shall be sent to:

* Customer: The email address on file for your account
* Company: <support@oten.live>

#### 17.7 Independent Contractors <a href="#id-177-independent-contractors" id="id-177-independent-contractors"></a>

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, or agency relationship.

***

### 18. Contact Information <a href="#id-18-contact-information" id="id-18-contact-information"></a>

For questions about these Terms, contact: <support@oten.com>

***

### 19. Definitions <a href="#id-19-definitions" id="id-19-definitions"></a>

**"API"** means Application Programming Interface.

**"CMK"** or **"Customer Managed Key"** means encryption keys created and managed by Customer through the Service.

**"Confidential Information"** means non-public information disclosed by either party.

**"Customer Data"** means data provided by Customer or generated through Customer's use of the Service.

**"HSM"** means Hardware Security Module.

**"Service"** means the Oten KMS platform and related services provided by Oten.

**"SLA"** means Service Level Agreement.

**"TEE"** means Trusted Execution Environment.

***

*By using the Oten KMS Service, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service.*