Secured Platform Terms

Last Update: October 13, 2026

These Secured Platform Terms (“Terms”) govern Customer’s use of any Products, Services, or Technical Previews that reference or are otherwise identified as subject to these Terms (collectively, “Secured Platform Offerings”), including any optional features, add-ons, or supplemental capabilities made available as part of or alongside the Secured Platform Offering (“Optional Features”). Optional Features will be identified and made available to Customers in the Secured Platform Offering product documentation, located here: https://edu.chainguard.dev/. Chainguard, Inc. (“Chainguard”) may make the Secured Platform Offering available pursuant to an Order or through another applicable enrollment or activation process. Customer’s use of the Secured Platform Offering is also governed by the separate and binding agreement in effect between the parties for the provision of Chainguard’s products and services to Customer, or if no such agreement is in effect, Chainguard’s online Master Services and License Agreement (as applicable, the “Agreement”). These Terms are incorporated into and form part of the Agreement. Capitalized terms used, but not defined in these Terms have the meanings ascribed in the Agreement. 

If these Terms conflict with the Agreement, these Terms will control solely with respect to the applicable Secured Platform Offering and only to the extent of the conflict. By accessing or using a Secured Platform Offering, including as part of an Evaluation, the individual accepting these Terms represents that they have authority to bind the entity or organization on whose behalf they are acting, and Customer agrees to be bound by these Terms. These Terms have the same force and effect as a written agreement signed by Customer and Chainguard. If Customer does not agree to these Terms, Customer may not access or use any Secured Platform Offering. 

1. General. 

1.1 Chainguard grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Order term to access and use the Secured Platform Offering solely for Customer's and its Affiliates' internal use in connection with the use of the Secured Platform Offering. 

1.2 Customer hereby grants Chainguard and its Affiliates a limited, non-exclusive, worldwide, royalty-free license to host, store, cache, copy, scan, analyze, execute, transmit, and otherwise process any inputs (e.g. artifacts, code, scripts, prompts, files) uploaded to, proxied, or made available to the Service through Customer’s usage of the Secured Platform Offering (“Secured Platform Inputs”) to provide, secure, and support the Secured Platform Offering. 

1.3 As between the Parties, Customer, its Affiliates, and their respective suppliers and licensors own or otherwise has all rights, title, and interest (including any and all intellectual property rights) in the Secured Platform Inputs. Customer represents and warrants it owns or otherwise retains all right, licenses, title, permissions, and interest (including any and all intellectual property rights) in the Secured Platform Inputs for Chainguard’s use under  the Terms. This includes compliance with any applicable open source or third-party license terms. Customer further acknowledges:

2. Restrictions. 

2.1 Customer will not reverse engineer, decompile, disable, modify, create derivative works of, derive, or attempt to discover the source code or underlying implementation of the Secured Platform Offering;

2.2 Customer will not, and will not permit any authorized user or AI Agent to: (i) breach, circumvent, or attempt to breach or circumvent the security, isolation, authentication, rate-limiting, or metering measures of any Secured Platform Offering; (ii) conduct penetration testing, vulnerability scanning, or load testing of any Secured Platform Offering without Chainguard’s prior written authorization; (iii) use any Secured Platform Offering to scan, probe, test, attack, or gain unauthorized access to any system, network, or account that Customer does not own or is not authorized to test, including through denial-of-service attacks; and/or (iv) use any Secured Platform Offering to mine cryptocurrency in violation of Chainguard’s Acceptable Use Policy, located at https://www.chainguard.dev/legal/acceptable-use-policy;

2.3 Customer will not use the Secured Platform Offerings to build or improve a competing product or service, or provide a substantially similar service for the benefit of a third party, including as part of a paid or unpaid platform (e.g. distributing artifacts to third parties that are not Customer or its Affiliates), hosting registry or compute service; and

2.4 Customer will not use the Secured Platform Offerings as its sole archival or backup service and is responsible for keeping its own independent copies of all Secured Platform Inputs. Chainguard does not back-up Secured Platform Inputs and may permanently delete Secured Platform Inputs after the Order expires or terminates, or after Chainguard discontinues the Secured Platform Offering.

3. Customer Responsibilities.

3.1 Customer is responsible for the Secured Platform Inputs and all activity within the Secured Platform Offering provisioning, including activity by its authorized users and AI Agents; 

3.2 Chainguard has no obligation to monitor, review, or intervene in any Customer-deployed AI Agent action. Customer understands AI agents may disregard Customer’s instructions, act beyond the scope of an assigned task, or misreport their own actions. Customer will take appropriate precautions against these risks, including: (i) limiting each AI agent’s credentials, permissions, and network access to those needed for the assigned task; (ii) requiring human approval for consequential actions; and (iii) maintaining backups that AI agents cannot access. Customer will report any AI agent action that attempts to breach or circumvent the security of a Secured Platform Offering immediately to security@chainguard.dev; and 

3.3 Customer will protect all Customer credentials, tokens, and API keys used to access the Secured Platform Offerings, including authenticating to the Secured Platform Services via a unique user ID and role-based access controls (consistent with the principle of least privilege as well as multi-factor authentication and passwords meeting industry-standard complexity requirements (e.g., length, complexity, reuse, expiration, change default passwords)).

4. Privacy. 

4.1 Customer will not upload, store, or place in any Secured Platform Offering: (i) export-controlled data unless agreed to in writing by Chainguard; (ii) special categories of personal data, protected health information, or payment cardholder data, unless Chainguard agrees in writing; or (iii) long-lived secrets, API keys, tokens, or credentials, except in accordance with our product documentation protocols.

4.2 To the extent Chainguard may process Secured Platform Inputs containing personal data, the Supplemental Feature DPA, located at https://www.chainguard.dev/legal/supplemental-dpa, shall apply. As between Chainguard and Customer, Chainguard shall process (as defined in the Supplemental Feature DPA) such personal data as a Processor acting on behalf of Customer.

4.3 The Secured Platform Offering may be accessed for debugging, support, and security purposes from time to time by Chainguard personnel located in countries around the world (excluding countries, or parts thereof, that are subject to US/Canadian comprehensive sanctions).

5. Security. 

5.1 Chainguard may block, quarantine, delay, or decline to serve Secured Platform Inputs, in its discretion, that may contain malware or malicious code, or otherwise may pose a security risk or violate the Agreement or Chainguard’s Acceptable Use Policy. Chainguard has no obligation to detect any particular threat. Chainguard will have no liability for any serving decision, including any decision to block, or any failure to block, any Secured Platform Inputs.

5.2 Chainguard shall maintain an information security program reasonably designed to: (i) protect Customer Information against a Security Incident; (ii) identify reasonably foreseeable risks to the security and availability of the Chainguard Network; and (iii) minimize security risks to the Chainguard Network through regular testing of controls. Chainguard shall review and assess the Chainguard Security Measures no less than once yearly to ensure adequacy and alignment with industry recognized standards. 

5.3 In the event of a security incident impacting Customer’s Secured Platform Inputs, Chainguard will notify Customer without undue delay after confirming a Security Incident and, in any event, within seventy-two (72) hours of confirmation. Security incident means a confirmed breach of Chainguard’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Secured Platform Inputs (“Security Incident”). Such notification shall include, to the extent required under applicable data protection laws (i) a description of the nature of the Security Incident; (ii) the categories and approximate number of records concerned; (iii) the likely consequences of the Security Incident; and (iv) the measures taken or proposed to be taken to address the Security Incident. Chainguard shall further take all reasonable measures to investigate, contain, and remediate the effects of the  Security Incident without unreasonable delay.

5.4 Chainguard will make available copies of its then-current SOC 2 Type II report, ISO 27001 certificate, and any other relevant third-party audit reports or certifications on Chainguard’s Trust Center: https://security.chainguard.dev/. Customer acknowledges and agrees that such Audit Reports, information arising therefrom, and related certifications shall be considered Chainguard’s Confidential Information.

6. Intellectual Property.

6.1 Certain enabled Optional Features may scan, analyze, or evaluate Secured Platform Inputs to detect malware, malicious code, vulnerabilities, or policy violations and generate findings, reports, scores, recommendations, or other results (collectively, “Secured Platform Outputs”). In such cases, and as between the parties, Customer or its licensors retain all right, title, and interest, including all intellectual property rights, in and to Secured Platform Outputs to the extent they are specifically derived from and pertain to Customer’s business logic, architecture, or functionality.

6.2 Chainguard retains all right, title, and interest, including all intellectual property rights, in and to the Secured Platform Offerings, including its Optional Features (e.g. malware and greyware scanners), and all Chainguard modifications, improvements, and enhancements to them, including any derivative works of the foregoing, patches or remediation code developed, built, or authored by Chainguard; and vulnerability discoveries and CVE filings pursuant to Chainguard’s Coordinated Vulnerability Handling Policy, located here: https://www.chainguard.dev/legal/coordinated-vulnerability-handling-policy.

6.3 Usage Data, as defined in Section 2(c) of the Agreement, may be collected and used beyond the session or transaction in which it is processed in connection with Customer's access to or use of the Secured Platform Offering, including query logs, interface analytics, and associated metadata to provide, operate, maintain, continuously improve, and support its systems delivering its Products and Services (e.g. derived security signals, including file hashes and malware signatures to identify, track, and protect against threats across Chainguard’s Products and Services).

7. Usage 

7.1. Usage Tiers. The term for Customer’s authorized use of the Secured Platform Offering begins on the earlier of (i) the date Customer first accesses or uses Secured Platform Offering, or (ii) the effective date of the applicable Order, and continues through the end of the subscription period identified at the time of purchase, unless earlier terminated or subsequently renewed under a subsequent Order or similar mechanism. During the term, Customer may access and use the Secured Platform Offering, subject to the usage limits (e.g., a maximum number of consumption units per annum) and other usage parameters set forth in the applicable Order or if no such Order is in effect, as otherwise indicated by Chainguard. If Customer’s usage exceeds the applicable usage parameters, Chainguard may, at its option, (a) invoice Customer in arrears for the excess usage at the the cost-per-unit (“CPU”) set forth in the Order, or if no Order is then-in-effect, at the then-current per-unit rate published on Chainguard’s website or platform, or (b) require the parties to negotiate amended terms that reflect Customer’s actual usage. Any unused portions thereof are non-assignable, non-transferable, non-sublicensable, and do not carry-over to subsequent Orders. Optional Features will be identified and made available to Customers in the Secured Platform Offering product documentation, which Chainguard may update from time to time. Optional Features may also be subject to separate pricing as indicated on the Order, which Chainguard may update at any time by providing reasonable notice to Customer.