Terms of Service

By creating an Account, claiming or entering a Burrow, or otherwise using the Service, you agree to be bound by these Terms of Service. If you are using the Service on behalf of an organisation, you represent and warrant that you are authorised to bind that organisation to these Terms.

If you do not agree to these Terms, do not use the Service.

In these Terms:

• “RatelKey”, “we” and “us” mean the provider of the Service.

• “Service” means the website at ratelkey.com, the account and sign-in service, the relay, the update service, and the documentation.

• “Burrow” means an instance of the RatelKey server software installed and operated by you on infrastructure you control. A Burrow does not form part of the Service.

• “Account” means your RatelKey credentials and the record of the Burrows you are permitted to enter.

• “Member” means an Account permitted to enter a Burrow.

• “Machine” means an application, server or process enrolled into a Burrow, which authenticates to that Burrow either by signing each request with an Ed25519 key generated on that machine, or with a short-lived OpenID Connect token issued to it by a provider the Burrow has been configured to trust.

• “Secret” means a value stored in a Burrow.

• “Relay” means the forwarding service described in section 06.

• “Personal Data” has the meaning given in Regulation (EU) 2016/679 (General Data Protection Regulation).

RatelKey provides the Service. The Service comprises the account and sign-in service against which a Burrow authenticates its users, the relay, the update service from which a Burrow retrieves releases, and the website and documentation.

You operate your Burrow. You are responsible for the infrastructure it runs on, its configuration, its network exposure, its database, its backups, its encryption key, and the membership and machine enrolments within it.

Secrets are stored in your Burrow. RatelKey does not receive, store or process Secrets. Section 08 states in full what the Service holds.

You must be at least 18 years of age, or the age of legal majority in your jurisdiction, to create an Account. By registering you represent that you meet this requirement and that the information you provide is accurate and complete.

You are solely responsible for the confidentiality of your Account credentials and for all activity conducted under your Account. You must notify us without undue delay if you become aware of unauthorised use of your Account.

RatelKey is not liable for unauthorised access resulting from credentials compromised while under your control.

If you use the Service on behalf of an organisation, you represent and warrant that you are authorised to bind that organisation to these Terms, and that organisation is responsible for all Accounts and Burrows operating under it.

Secrets are encrypted at rest using AES-256-GCM envelope encryption. Each stored version is encrypted under its own data key, which is wrapped by a key-encryption key belonging to your Burrow. The key-encryption key is generated by the Burrow and kept in its data directory, or supplied to it through its environment, and is not written to its database.

RatelKey does not receive or store the key-encryption key used by your Burrow, and cannot recover it. You are responsible for maintaining a backup of that key. If it is lost, the Secrets encrypted under it cannot be recovered by you, by RatelKey, or by any other party.

Machine key pairs are generated on the machine during enrolment. The private key remains on that machine. Only the public key is transmitted to your Burrow, and no part of a machine key pair is transmitted to RatelKey. A Machine that authenticates with an OpenID Connect token holds no key pair; your Burrow verifies the token against its issuer’s published keys.

You are responsible for securing machine private keys. If a private key is compromised, you should revoke the affected machine from your Burrow. RatelKey is not liable for unauthorised access to a Burrow resulting from compromised machine credentials.

A Burrow does not maintain its own user accounts or sessions. On each request made by a user, the Burrow queries the RatelKey sign-in service to determine whether the session is valid, whether the Account is active, and whether the Account is a Member of that Burrow. The Burrow retains no result of that query.

A revoked session, a suspended Account, or a removed Member therefore takes effect on the next request.

While the sign-in service is unavailable, or while an Account is suspended, that Account cannot sign in to a Burrow or use its dashboard. This applies irrespective of the availability of the Burrow itself.

Machine authentication does not depend on the Service. A Machine authenticates directly to your Burrow, which verifies its signature or token without contacting RatelKey. Machine access to Secrets is unaffected by the unavailability of the Service or by the suspension of an Account.

RatelKey does not obtain access to your Burrow, its database or its Secrets in any circumstance described in this section.

Use of the relay is optional. A Burrow that is not directly reachable may maintain a connection to the relay and be reached through it. A Burrow reached at its own address or domain does not use the relay.

The relay forwards the encrypted bytes of a connection. TLS is terminated by your Burrow and not by the relay. RatelKey does not have access to the contents of relayed connections and does not record them.

Your Burrow generates the private key for its relay address and sends RatelKey a certificate request. RatelKey has the certificate issued by a public certificate authority, only for the name your Burrow is entitled to, and returns it to your Burrow over its tunnel. The private key is not transmitted to RatelKey.

The relay is provided for reaching a Burrow. You must not use it to carry traffic for any other purpose, and you must not resell or sublicense access to it. RatelKey may limit or refuse forwarding that does not comply with this section.

A Burrow may query the update service for available releases and install a release when instructed by its operator, or automatically where its operator has turned on automatic updates. RatelKey does not install software on your Burrow and does not initiate updates.

Installing an update restarts the Burrow, which is unavailable during the restart. You are responsible for determining when to apply an update, including by turning automatic updates on or off.

RatelKey does not undertake to support previous releases indefinitely. A Burrow running a superseded release may cease to be compatible with the sign-in service or the relay. Where a release requires action by an operator, RatelKey will state that requirement in the release notes.

You retain all rights in the contents of your Burrow. RatelKey claims no rights in them and does not access, read, index, analyse or disclose them.

Where the contents of your Burrow include Personal Data, you are the controller of that data. RatelKey is not a processor of that data and does not receive it. A data processing agreement covering the Account data listed in section 08 is available on request to the address in section 17.

You are responsible for backing up your Burrow, including its database and the key-encryption key described in section 04. RatelKey holds no backup of either and cannot restore a Burrow.

RatelKey holds the following in operating the Service:

• Account data. Email address, username, password hash, profile image (a selected preset or an uploaded image), and email confirmation status.

• Passkey data. Where a passkey is registered, its public key, credential identifier and device label.

• Two-factor data. Where an authenticator app is enabled, its secret, stored encrypted, and recovery codes, stored as hashes.

• Linked sign-in identity. Where you sign in with GitHub, the GitHub user ID, username and email address that GitHub provides.

• Session data. For each session, the originating IP address and user agent, the time of creation and the time of expiry. Sign-in attempts are recorded with their outcome.

• Burrow registration data. For each Burrow claimed by an Account, its identifier, the addresses it reports (its local network address, its relay address and any custom domain), and its Members with their roles.

• Feedback. Where a Member sends feedback from a Burrow, the message, the kind of page it was sent from, and the Burrow’s version, recorded with the Account and the Burrow.

• Sign-in service records. Actions performed against the Service, including claiming a Burrow, entering a Burrow, signing out and membership changes, recorded with the Account and source IP address responsible.

• Email records. Recipient address, message type and delivery outcome.

• Website usage data. How ratelkey.com is used, collected by RatelKey’s own analytics without cookies and without identifying the visitor, as described in the Privacy Policy.

The audit trail of a Burrow is stored in that Burrow’s database and is not transmitted to RatelKey.

Account data, passkey and two-factor data, a linked sign-in identity and Burrow registration data are processed for the performance of this agreement (Article 6(1)(b) GDPR). Session, sign-in and email records are processed for security, abuse prevention and the operation of the Service, feedback for improving the Service, and website usage data for understanding how ratelkey.com is used (Article 6(1)(f)). The Privacy Policy states retention periods, transfers, processors and your rights in full.

• Account data is retained for the lifetime of the Account.

• Sessions are deleted on expiry or revocation.

• Burrow registration data is retained while the Burrow remains claimed. Deregistering a Burrow removes the registration from the Service and does not affect the Burrow.

• Feedback is retained for the lifetime of the Account.

• Sign-in service records are retained for 12 months.

• Email records are retained for 30 days.

• Website usage data is retained for 13 months.

You may delete your Account at any time from your account settings. Deletion is irreversible and removes the data listed above within 30 days, subject to any legal obligation requiring continued retention.

Deleting an Account does not affect a Burrow, its database or its Secrets. It removes that Account’s ability to sign in to any Burrow.

You must not:

• Use the Service in violation of any applicable law.

• Access or attempt to access an Account, Burrow or session that you are not authorised to access.

• Interfere with the operation, availability or integrity of the Service, including by denial-of-service attack or deliberate resource exhaustion.

• Circumvent or attempt to circumvent rate limits, quotas, authentication or any other control.

• Create Accounts in bulk, or by automated means, in order to evade a limit.

• Use the relay other than as permitted by section 06.

• Use the Service to host or distribute malware, phishing infrastructure or tooling intended to harm others.

• Provide false or misleading information on registration or in support correspondence.

Testing the security of a Burrow you operate is not restricted by this section. You must not conduct security testing against RatelKey infrastructure. Vulnerabilities affecting the Service should be reported to the address in section 17. RatelKey will not pursue a claim arising from good-faith research reported in accordance with this paragraph.

Breach of this section may result in suspension or termination under section 12.

The Service, the RatelKey server software, the documentation, and the RatelKey name and marks are owned by RatelKey. No transfer of ownership is effected by these Terms or by your use of the Service.

RatelKey grants you a limited, non-exclusive, non-transferable, revocable licence to operate the RatelKey server software as a Burrow for your own internal use, and to use the Service in connection with it, for so long as you comply with these Terms. This licence does not extend to redistribution, resale, or sublicensing.

The command-line tool and the SDKs are published under the open-source licences stated in their repositories. Those licences govern the code they cover independently of these Terms.

RatelKey may suspend or terminate an Account if you breach these Terms or use the Service in a manner that harms RatelKey, the Service or other users. Where reasonably practicable, we will notify you of the reason.

Suspension of an Account prevents that Account from signing in to a Burrow. Suspension does not disable the Burrow, alter or delete its data, or prevent enrolled Machines from authenticating directly to it. RatelKey does not obtain access to a Burrow on suspension or termination.

On termination, your right to use the Service ceases and the data listed in section 08 is deleted in accordance with section 09.

You may cease using the Service and delete your Account at any time.

The Service is offered on plans, to which add-ons may be added. The features, limits and price of each plan and add-on are stated on the pricing page and presented before purchase. Plans and add-ons govern who may enter a Burrow and the roles a Burrow may define. No plan limits the Secrets or other contents of a Burrow. Where an Account is on a plan provided at no charge and holds no paid add-ons, the remainder of this section does not apply to it.

Payments are processed by Stripe. Card details and billing addresses are provided to and held by Stripe, and are not received by RatelKey.

Paid plans are billed in advance for the selected period and renew automatically until cancelled. Prices are exclusive of VAT and other applicable taxes, which are added where RatelKey is required to charge them.

You may cancel at any time from your account settings. Cancellation takes effect at the end of the period already paid for. Fees already paid are non-refundable except where applicable law requires otherwise. If you are a consumer in the European Union, your statutory right of withdrawal is unaffected.

RatelKey will give at least 30 days’ notice by email before a change in price takes effect for your subscription. A price change does not apply to a period already paid for.

If a payment fails, you have seven days from the failure to complete it. During those seven days the Account keeps its plan and add-ons unchanged, and the billing section of your account settings states the date by which payment is due. Completing the payment within that period restores the subscription in full.

If the payment has not been completed by that date, the Account moves to the free plan, and the features and limits of the paid plan and its add-ons cease. In each Burrow the Account owns:

• Outstanding invitations beyond the free plan’s member limit are withdrawn.

• If the Burrow is still over that limit, Members are disabled, most recently added first, and their sessions in that Burrow are ended. The owner of a Burrow is never disabled.

• Custom roles cease to grant access.

Disabled Members and custom roles are retained and are not deleted. When a paid plan is taken out again, custom roles apply again and the owner of the Burrow may re-enable disabled Members.

Non-payment results in a change of plan and does not result in suspension under section 12. The Account’s own sign-in, the contents of its Burrows, and Machine authentication are unaffected.

If you initiate a chargeback in respect of a payment, RatelKey may terminate the subscription and move the Account to the free plan. Where you consider a charge to be incorrect, contact us at the address in section 17.

RatelKey does not warrant that the Service will be uninterrupted or error-free. Scheduled maintenance will be notified in advance where practicable. No service level agreement applies unless separately agreed in writing.

The availability of your Burrow is determined by the infrastructure on which you operate it and is your responsibility. Section 05 states which functions depend on the availability of the Service.

RatelKey is not liable for interruption or degradation caused by matters outside its reasonable control, including infrastructure provider outages, network and DNS failures, and events of force majeure.

THE SERVICE AND THE RATELKEY SERVER SOFTWARE ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

Cryptographic standards evolve. RatelKey uses established algorithms and does not warrant that any cryptographic mechanism will remain free of vulnerabilities indefinitely.

RatelKey is not liable for loss arising from decisions or actions taken on the basis of the availability or unavailability of a Burrow or of the Secrets it holds, including deployment failures and configuration errors.

To the maximum extent permitted by applicable law, RatelKey’s total aggregate liability for all claims arising out of or in connection with these Terms or the Service shall not exceed the greater of the amount paid by you to RatelKey in the 12 months preceding the claim and EUR 100.

RatelKey shall not be liable for indirect, incidental, special, consequential or punitive damages, including loss of profit, loss of data, business interruption, the cost of substitute services, or loss arising from the loss of an encryption key held by you, regardless of the theory of liability.

Nothing in these Terms excludes or limits liability that may not be excluded or limited under applicable law.

You agree to indemnify, defend and hold harmless RatelKey, its officers, employees and agents from and against any claim, damage, loss, cost or expense, including reasonable legal fees, arising from your use of the Service, your operation of a Burrow, your breach of these Terms, or your infringement of the rights of a third party.

These Terms are governed by and construed in accordance with the laws of the Kingdom of Denmark, without regard to conflict of law principles. Disputes arising out of or in connection with these Terms are subject to the exclusive jurisdiction of the courts of Denmark.

For consumers resident in the European Union, this does not affect rights under the mandatory consumer protection law of your country of residence. Where these Terms conflict with a mandatory provision of applicable law, that provision prevails.

RatelKey may modify these Terms. Material changes will be notified by email to the address associated with your Account, or by notice in the dashboard, at least 30 days before they take effect.

Continued use of the Service after the effective date of a modification constitutes acceptance of it. If you do not accept a modification, you must cease using the Service and delete your Account.

For questions regarding these Terms, data protection requests, or to report a vulnerability:

RatelKey
[email protected]
ratelkey.com