Terms of Service

Guiding Principle

NoData computes access, not permissions. We orchestrate governance but never access, store, or process customer data, and never hold customer keys. All diagnosis, enforcement, encryption, and proof are performed in the customer's environment only.

NoData provides an Information Transaction Processor — a system that computes who may see what, for people, applications, and AI, across the customer's data, files, and systems. It comprises: the Capsule (an agent installed in the customer's environment), the Courier console (orchestration and policy), reversible field- and file-level encryption, per-identity access grants with time / view-count / restriction controls, and signed, hash-chained decision receipts. All enforcement and key custody run in the customer's environment. NoData orchestrates — but never accesses, stores, processes, or executes on the customer's source code, business data, or personal information (PII), and never holds the customer's encryption keys.

The customer is responsible for: - Installing and running the Capsule and the executor in their own environment - Holding and safeguarding their own encryption keys - Backing up data before applying encryption or policy changes - Verifying that policy is enforced as intended - Retaining reports, receipts, and evidence NoData orchestrates governance and provides the tooling — it does not make direct changes to the customer's systems and does not hold the customer's keys.

NoData stores a minimal audit log for legal proof purposes: - User ID (if registered), session ID - Action timestamps - Action types (scan, grant, policy, encrypt, proof, export) - Proof hashes (SHA-256) — cannot be reversed to data - Terms of service consents Retention period: 7 years (Israeli Income Tax Ordinance + SOC 2 CC7.4 requirement).

NoData does NOT store under any circumstances: - Customer source code - Table names, field names, or schemas - Scanned PII values or business data - Scan report contents (stored in customer's browser only) - Credentials, encryption keys, or passwords - Content of messages, files, or media sent through communication tools

Communication tools (chat, secure channel, rooms, report box) operate with end-to-end encryption (E2E). NoData cannot read, decrypt, or access sent content. Content is encrypted in the sender's browser and decrypted only in the receiver's browser. Messages are auto-deleted per TTL settings. Only delivery proof (HMAC) remains — not the content.

Every governed access decision is recorded as a signed, hash-chained receipt containing proof hashes only — never customer data. NoData verifies the integrity of the receipt chain (from genesis) — not the underlying data. The processor's decision count and the receipts are independently verifiable. Receipts do not constitute SOC 2 certification. SOC 2 Type II compliance requires external audit by a qualified auditor.

The customer may connect artificial-intelligence agents to the service (such as Claude Code, Cursor, or an agent the customer developed) through the MCP server, the command-line interface (CLI), or the API. Every connected agent is assigned an operational identity — a name, a device, and an organization — and every action it performs through NoData's tools is recorded in a signed proof. NoData is an innovative system designed not to know the content of the data: it does not view the data, does not hold the encryption keys, and records every action in a verifiable proof. Software development with AI agents, however, creates many paths of access, and not all of them pass through NoData. NoData is responsible for actions performed through its tools — scanning, locking and encryption, producing clean copies, granting and revoking permissions, governed sharing, and producing proofs — and for those tools operating as documented. NoData is not responsible for: - Code, scripts, or programs that an AI agent writes or runs on its own; - An agent's access to files or systems other than through NoData's tools (including reading a file directly); - Actions approved by the customer or anyone on its behalf, including approving a read presented by NoData's read gate. The read gate is an aid: on the customer's machine it checks files an agent is about to open and asks for the user's approval before the read, but it does not guarantee that every path of access is detected. Full protection of a file is achieved by locking it (nodata_protect or nodata_wrap). The user bears the proactive responsibility for every action, folder, and item of information: to check, to ask NoData to perform the action, and to verify — through the proof — that the action was in fact performed. We recommend adopting a code-review procedure before code written by an agent is run on real data. As with any system based on language models, AI agents and the tools connected to them may err. Results should be examined and must not be relied on without review. Proposing a policy is not accepting it: NoData or an agent may propose a policy (such as a grant, a classification, or a lock), but the decision to accept, change, or reject the proposal rests solely with the customer, and so does the responsibility for its results. The customer is responsible for choosing the agents it connects, the permissions it grants them, and the approvals it gives. Operational record: acceptance of these terms, connecting an agent, and installing the read gate are recorded by NoData as operational information only — organization, agent or device identity, terms version, time, and a hash — never file content and never values. A copy of the record is also kept in the organization's proof vault, which the customer may review.

NoData provides the service "AS IS". NoData is not liable for: - Damage caused by running the Capsule / executor in the customer's environment - Data loss due to improper use of tools - Failure to meet SOC or other regulatory requirements - Temporary or permanent service interruption NoData's total liability is limited to the amount paid in the last 12 months.

These terms are governed by the laws of the State of Israel. Exclusive jurisdiction is granted to the courts of Tel Aviv-Jaffa.