Terms of Service

1. What the Services do

ExVista examines machine-learning models for evidence of backdoors and tampering, fingerprints models so later copies can be checked against a baseline, and gates which certified model a registered device may run. Some capabilities are generally available and others are offered as early access or preview; we may add, change, or withdraw features, and preview features may change without notice. The Privacy Policy describes what the Services collect and is part of these terms.

2. Accounts

• You must be at least 18 and provide accurate account information.
• You are responsible for everything done through your account, your CLI sign-ins, and your device keys. Keep credentials and keys confidential, and tell us promptly at babs@exvistatechnologies.com if you believe any have been compromised.
• Access to some features, such as launching scans, depends on the access level we assign to your account. We may change it.

3. Your content

The models, files, buckets, names, labels, and other material you submit or connect (“Customer Content”) remain yours. You grant ExVista a non-exclusive, worldwide license to store, copy, download, run, analyze, and otherwise process Customer Content solely to provide, secure, and support the Services for you, and, in aggregated or de-identified form that does not identify you or your models, to improve them.

You are responsible for Customer Content. In particular, you confirm:

• You have the rights needed to submit it and to have us process it as described, including under the license of any model you point us at.
• It does not contain personal information you are not permitted to share with us, and it does not violate law or third-party rights.
• Any AWS bucket you connect is one you are entitled to connect, and you control the role that grants us read access.

Submitting a model you suspect is backdoored is exactly what the Services are for. That is not a breach of these terms.

4. Acceptable use

You agree not to:

• Use the Services to attack, probe, or overload ExVista, other customers, or anyone else, or to bypass account isolation, rate limits, or other security controls.
• Access another account’s content, or share your credentials so others can use your account.
• Use the Services to develop or test techniques for evading ExVista detection, except as part of security research you disclose to us.
• Resell or offer the Services to third parties without a written agreement with us.
• Use the Services in violation of applicable law, including export law.

We may suspend access to protect the Services or other customers, and will tell you why unless the law prevents it.

5. Reports, verdicts, and what they mean

A report is evidence, not a guarantee. A CLEAN verdict means our tests found no evidence of a backdoor in the ways we test for it. It does not prove that none exists. Detection is strongest today on fixed-trigger backdoors; positional, semantic, distributional, and non-memorizing triggers are active research and may be missed. Where a report names a candidate trigger or target behavior, the verdict is more reliable than the exact wording, which can vary between runs of the same model. Fingerprint comparisons on some hardware can report small drift that reflects numeric non-determinism rather than tampering; we identify exact byte matches separately for that reason.

You decide what to deploy. Reports are one input into that decision, and you remain responsible for the models you run and for any harm they cause. ExVista does not review models for content, bias, safety, or fitness for any purpose beyond the specific checks described in the report.

6. Devices and the deployment gate

The device agent and gate are designed to fail closed: a device will not start a model without a current certification from ExVista, and it will keep waiting rather than fall back to an unchecked model when it cannot reach us. Choose this design only where that availability behavior is acceptable to you. You are responsible for the devices you enroll, for the software you install on them, and for keeping device keys confidential. Open-source components you install on a device are licensed under the terms that accompany them.

7. Fees

Unless an order form or other written agreement with us says otherwise, the Services are currently provided without charge during early access. We may introduce or change fees on at least 30 days’ notice, and any fees will apply only going forward.

8. Confidentiality

We will treat Customer Content and your reports as your confidential information, use them only as these terms allow, and protect them with reasonable care. You will treat non-public information about the Services, including preview features and pricing, as ours. Neither obligation covers information that is public, independently developed, rightfully received from a third party, or that must be disclosed by law.

9. Ownership and feedback

ExVista and its licensors own the Services, including the detectors, fingerprinting methods, software, and documentation. These terms grant no rights in them other than the right to use the Services as described. If you send us feedback or suggestions, you grant us a perpetual, irrevocable license to use them without obligation to you.

10. Third-party services

The Services run on Amazon Web Services, can sign you in through Google, and can fetch models from Hugging Face at your request. Those providers have their own terms, which govern your relationship with them. We are not responsible for third-party services.

11. Disclaimer of warranties

THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”. TO THE FULLEST EXTENT PERMITTED BY LAW, EXVISTA DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL DETECT EVERY BACKDOOR, MODIFICATION, OR DEFECT IN A MODEL, OR WILL BE UNINTERRUPTED OR ERROR-FREE.

12. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW, EXVISTA WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL, ARISING FROM OR RELATED TO THE SERVICES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY. EXVISTA’S TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICES WILL NOT EXCEED THE AMOUNT YOU PAID US FOR THE SERVICES IN THE 12 MONTHS BEFORE THE CLAIM, OR US$100 IF YOU HAVE PAID NOTHING. These limits do not apply where the law does not allow them.

13. Indemnity

You will defend and indemnify ExVista against third-party claims, and the resulting damages and reasonable costs, arising from Customer Content, from models you deploy, or from your use of the Services in breach of these terms or the law.

14. Term and termination

These terms apply for as long as you use the Services. You may stop at any time and may ask us to delete your account. We may suspend or terminate your access if you materially breach these terms, if required by law, or if we discontinue the Services, in which case we will give reasonable notice where we can. On termination your right to use the Services ends, and we will delete Customer Content in the ordinary course, subject to the retention described in the Privacy Policy. Sections 3 (license as needed to complete deletion), 5, 8, 9, 11, 12, 13, 15, and 16 survive.

15. Governing law and disputes

These terms are governed by the laws of the United States and of the state in which ExVista Technologies is organized, without regard to conflict-of-laws rules, and any dispute will be brought in the state or federal courts located there. Before filing a claim, each of us agrees to try in good faith to resolve the dispute by contacting the other and discussing it for at least 30 days.

16. General

• Changes. We may update these terms. We will change the effective date above and, for material changes, notify account holders by email at least 14 days before they take effect. Continued use after that date is acceptance.
• Entire agreement. These terms, the Privacy Policy, and any order form with us are the whole agreement about the Services. If an order form conflicts with these terms, the order form controls.
• Assignment. You may not assign these terms without our consent. We may assign them to a successor to our business.
• Severability and waiver. If a provision is unenforceable the rest remains in effect. Not enforcing a provision is not a waiver of it.
• Notices to us go to babs@exvistatechnologies.com; notices to you go to your account email.

17. Contact

Questions about these terms: babs@exvistatechnologies.com.