Legal

Terms of Service

Effective {{EFFECTIVE}} · Last updated {{EFFECTIVE}}
Shield 360 is a product of ThinkFleet ("Company", "we", "us", "our").

These terms govern your access to and use of Shield 360, including the web application, the collector agent, the controller, the SDKs, the APIs and the MCP gateway (the "Service"), whether we host it or you run it yourself. By signing an order, enrolling a machine or signing in, you agree to them and to our Privacy Policy. Section 20 covers use of this website only.

1. Order of precedence

If you have signed an order form, master agreement or data processing agreement with us, that document governs where it conflicts with these terms, in that order. Otherwise these terms and the Privacy Policy are the whole agreement between us about the Service.

2. Eligibility and authority

You must be at least 18 and able to form a binding contract. If you use the Service for an organization, you represent that you have authority to bind it, and "you" means both you and that organization.

3. What the Service does

Shield 360 allows an organization to:

Measure AI usage and cost across enrolled machines and connected providers, and attribute it to people, machines, tools, models and projects.
Discover AI tools and applications in use, including ones not deployed deliberately.
Apply data protection policy to coding agents, which can allow, warn on, redact or block a prompt or tool call that carries sensitive data, according to the policy you set and to what each agent's integration allows. For example, some agents allow tool calls, but not prompts, to be stopped.
Give AI agents their own identity and grants through an MCP gateway, and govern the prompts, contexts, documents, secrets and memory they use.
Trace and evaluate AI applications through OpenTelemetry, and test agents against policy suites.
Detect prompt injection, raise alerts, and export security events to your SIEM.
Keep an audit log, place legal holds and export evidence.

The Service does not sit in the path of network traffic. Where it blocks or redacts, it does so inside the coding agents and gateway it is integrated with, and only as your policy directs. It is not a guarantee that all AI use will be found or every sensitive value stopped (Section 15).

4. Accounts and credentials

You are responsible for your account credentials, install keys and API keys, and for activity under your account. Install keys enroll machines into your organization: treat them as credentials. Tell us at security@thinkfleet.ai immediately if you suspect unauthorized access.

5. Monitoring your workforce is your responsibility

This section matters most

Shield 360 collects information about how people use machines and applications you provide, and, depending on your settings, the content of their prompts to AI tools. You are the controller of that information and are solely responsible for deploying the Service lawfully.

You represent that you have, and will keep, every right, notice and consent needed for the collection you configure, including under wiretap, electronic communications and computer misuse laws. That responsibility includes:

Giving your personnel the notice the law where they work requires, before collection begins.
Obtaining consent or establishing another lawful basis where one is required.
Consulting works councils, unions or employee representatives where that is mandatory. In several jurisdictions it is, and deploying first cannot be cured afterwards.
Completing any impact assessment your regulator requires.
Choosing collection levels, content capture and retention that are proportionate to your purpose, and restricting who in your organization may read them.
Answering access, correction and deletion requests from your own personnel. The Service lets you export and delete a person's data for this purpose.

We provide controls, including collection that is off until you enable it, per-person settings that can only narrow collection, configurable content capture, role-based access and an audit log. We cannot determine what is lawful in your jurisdiction, and we do not. You must not use the Service to monitor anyone who is not using equipment or accounts you provide or control, to target an individual for a reason the law prohibits, or to make employment decisions in a way the law forbids.

6. Acceptable use

You must not:

Enroll machines you do not own or control, or lack authority to enroll.
Use the Service to break the law or infringe anyone's rights.
Reverse engineer or decompile the Service, except where that restriction is unenforceable by law or the component is open source.
Resell, sublicense or provide the Service to third parties without a written agreement with us.
Interfere with the Service, test its security without following our disclosure policy, or circumvent tenancy boundaries or rate limits.
Use the Service to build a competing product, or publish benchmarks of it without our written consent.

7. Your data

7.1 Ownership

You own the data the Service collects or stores for you ("Customer Data"). We claim no ownership of it, and we do not create datasets derived from it for our own use.

7.2 Our limited license

You grant us a limited license to host, process and transmit Customer Data only to provide, secure and support the Service for you, and as the law requires. We do not use it to train AI models, and we do not use one customer's data to produce insights for another. We may use aggregated operational metrics about the Service itself, such as request volumes and error rates, that contain no Customer Data.

7.3 Export

An organization owner can export your organization's data at any time from the application. Secrets are exported by name only.

7.4 Deletion

When your organization is closed or your subscription ends, Customer Data is kept read-only for 30 days so you can export it, then deleted from the hosted service, except data under a legal hold you have placed, which is kept until you release it, and data we must keep by law. Backups containing it expire on their normal schedule.

7.5 Data processing agreement

Where we process personal data for you on the hosted service, we do so as your processor on your documented instructions, which are these terms and your configuration. A data processing agreement, including the Standard Contractual Clauses where a transfer mechanism is required, is available on request and forms part of these terms once signed.

8. Sub-processors

We use the sub-processors listed on our sub-processors page. We will update that page at least 30 days before a new sub-processor begins processing Customer Data, and will email customers who ask to be notified. If you object on reasonable data protection grounds and we cannot address the objection, you may terminate the affected Service and receive a pro-rata refund of prepaid fees for it.

9. Services you connect

The Service can connect to model providers, memory stores, source control, identity providers, AI providers' billing APIs, alert destinations, SIEM and security tools, and the agents or endpoints you test, that you choose, using your credentials. When you do, data flows to and from those services on your instruction, under your agreement with them. For example, running an evaluation sends the trace being scored to the model provider you selected. We are not responsible for those services, and their terms apply to your use of them.

10. Security

We maintain administrative, technical and physical safeguards designed to protect Customer Data, as described in our Privacy Policy and Security page. We will notify you of a breach affecting Customer Data without undue delay and within 72 hours of confirming it.

11. Confidentiality

Each party will protect the other's non-public information that is marked confidential or should reasonably be understood to be confidential, using at least reasonable care, and use it only to perform under these terms. This does not cover information that is public through no fault of the recipient, already known to it, independently developed, or rightfully received from a third party. A party may disclose confidential information where the law compels it, after giving notice where the law allows.

12. Intellectual property and open source

The Service, including the collector agent, its interfaces and documentation, is our property or our licensors' and is protected by intellectual property law. These terms grant you a limited, non-exclusive, non-transferable right to use it during your subscription for your internal business purposes. Parts of the Service are built on open source software, including components licensed under the Apache License 2.0; those components are governed by their own licenses, which are listed with the software and which these terms do not restrict. You may give us feedback, and we may use it without obligation to you.

13. Fees and payment

Fees, the subscription term, renewal and payment terms are those in your order or the plan you accepted when you subscribed. Unless your order says otherwise, subscriptions renew for the same term unless either party gives notice before renewal, and fees are due within 30 days of invoice. Fees exclude taxes, which you pay except taxes on our income. We may change prices for a renewal term by giving at least 30 days' notice before it begins. Except as these terms state, fees paid are not refundable.

14. Availability, changes and beta features

We aim for high availability but do not guarantee uninterrupted service. We may modify features and will give reasonable notice before removing one you materially rely on. You should not rely on features we have not yet released. Features we label beta or preview are provided as is, may change or be withdrawn, and are excluded from any service commitment.

If the collector cannot reach the Service or read its policy, it stops observing rather than widening what it collects. For data protection, you choose, per environment, what happens when a machine cannot read its policy: by default, prompts are allowed so that work is not interrupted; if you turn on fail closed with blocking, a machine that last received that policy blocks prompts and tool calls until it can read its policy again. A machine that has never received a policy is not blocked.

15. Disclaimers

Except as expressly stated in these terms or your order, the Service is provided "as is" and "as available", without warranties of any kind, whether express, implied or statutory, including merchantability, fitness for a particular purpose and non-infringement.

Shield 360 reports what it observes and enforces the policy you set where it is integrated. It does not guarantee that all AI use in your organization has been found, that every sensitive value will be detected or stopped, or that every cost figure matches a provider's invoice. It produces evidence that may assist an audit; it is not a certification and must not be described as one. Decisions you take on the basis of its output are yours.

16. Limitation of liability

To the maximum extent the law permits, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or goodwill, arising out of these terms or the Service, even if advised of the possibility. Each party's total liability arising out of or relating to these terms will not exceed the fees paid and payable by you for the Service in the twelve months before the event giving rise to the claim. These limits do not apply to your payment obligations, to either party's breach of Section 11, to your obligations under Sections 5 and 17, or to liability that cannot lawfully be limited.

17. Indemnification

You will defend and indemnify us against third-party claims, and the resulting damages and reasonable costs, arising from your breach of these terms, your violation of law or of anyone's rights, and specifically from claims by your personnel or a regulator about your monitoring of your workforce or the content you choose to capture.

18. Term, suspension and termination

These terms apply while you use the Service. You may close your organization at any time from its settings. Either party may terminate for the other's material breach that is not cured within 30 days of notice. We may suspend access immediately where needed to prevent harm to the Service or others, for non-payment after notice, or where the law requires, and will restore it once the cause is resolved. On termination your right to use the Service ends and Section 7 governs your data. Sections 5, 7, 11, 12, 15, 16, 17, 19 and 21 survive.

19. Compliance with law

Export control and sanctions. You will not use, export or re-export the Service in violation of US or other applicable export control and sanctions laws, or make it available to a sanctioned person or in an embargoed country or region. You represent that you are not on a restricted-party list.
Anti-corruption. Neither party has offered or received any bribe or improper payment in connection with these terms.
US government users. The Service is commercial computer software and documentation, provided to US government users only with the rights in these terms, under FAR 12.212 and DFARS 227.7202.

20. Using this website

shield360.ai is provided for information. You may read and share its pages, but not copy them in bulk, scrape them to build a competing product, or use our name and logos except to refer to Shield 360 accurately. Figures in illustrative panels on the site are representative and labeled as such. Links to other sites are provided for convenience; we are not responsible for them. The site is provided as is, and Sections 15, 16 and 21 apply to it.

21. General

Governing law and disputes. These terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. Disputes will be resolved by binding arbitration on an individual basis, except that either party may seek injunctive relief in court to protect intellectual property or confidential information, and either party may bring a claim in small claims court. You and we waive any right to participate in a class action.
Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations.
Publicity. We will not use your name or logo to identify you as a customer without your written permission.
Assignment. Neither party may assign these terms without the other's consent, except to a successor in a merger or sale of substantially all of the relevant business, with notice.
Notices. Notices to us go to legal@thinkfleet.ai; notices to you go to the email address of your organization's owner.
Changes. We will give at least 30 days' notice of material changes to these terms. If you object, you may terminate before the change takes effect and receive a pro-rata refund of prepaid fees.
Other. If a provision is unenforceable, the rest remains in force. A failure to enforce a provision is not a waiver. There are no third-party beneficiaries.