Terms of Service

Draft — pending legal review. Not yet in force.

Last updated: 29 October 2026

1. Parties and scope

These terms are a contract between [not configured: legal name] ("Gauntlet", "we") and the business that accepts them ("Customer", "you"). They cover:

• Gauntlet Cloud: the hosted service at the Gauntlet Cloud console, its API and CLI, and app previews on usegauntlet-preview.dev. Access is by invitation;
• this website, its license store and the license account.

Self-hosted Gauntlet is also governed by the self-hosted license terms, which prevail for it where they conflict with these terms. Personal data is covered by the privacy policy. For Gauntlet Cloud, the Data Processing Agreement (DPA) is part of these terms. A signed order form takes precedence over these terms where they conflict.

Gauntlet is offered to businesses only, not to consumers. By accepting these terms you confirm that you act for a business and may bind it. You confirm this on the license purchase form and when you accept an invitation to Gauntlet Cloud.

2. Accounts

• Gauntlet Cloud is open only to email addresses or domains we have invited; we decide whom to invite. You sign in through an identity provider (Google). Keep your sign-in and API tokens secure; you are responsible for activity under them.
• Organizations and projects belong to the Customer. Their owners and admins control membership, roles, stored model keys and billing.
• The license account on this website is reached by single-use links emailed to the purchasing address.
• Keep account details accurate. Tell us at [not configured: legal contact email] if you suspect unauthorized access.

3. Acceptable use

Use Gauntlet only to test software you own or are authorized to test. You must not:

• scan, load-test, attack or access systems you are not authorized to test, including from inside a test environment (environments can reach the public internet);
• use environments for malware, phishing, spam, cryptocurrency mining, proxying or anonymizing traffic, or anything unlawful;
• try to break out of an environment's isolation, reach other customers' data, or bypass plan limits, license checks or rate limits, except good-faith security research under the rules on /security;
• put real personal data, production secrets or special categories of data into test environments unless you have a legal basis and it is necessary: use test or synthetic data (see the DPA);
• infringe others' rights, or use Gauntlet in breach of sanctions or export rules;
• resell Gauntlet Cloud or provide it to third parties as a service without our written agreement.

Report security issues to hello@usegauntlet.dev (how).

4. The test agent

• The AI agent acts in your environments at your direction, on the apps, blueprints and test instructions you supply. You are responsible for what you direct it at and for its actions there.
• AI output can be wrong or incomplete. Findings, repro scripts and verdicts support your own testing; they do not guarantee that software is free of defects or secure.
• Kits in real mode (for example a real Google sign-in or your Stripe test account) act on third-party accounts you configure; those providers' terms apply to you.

5. Your content

"Customer Content" is what you and your users put into Gauntlet Cloud: blueprints, images and configuration, test templates, the apps running in environments and their data, and run results (logs, findings, screenshots, video, Playwright traces, network captures, repro scripts).

• You keep all rights to Customer Content. You grant us the right to host, process and transmit it only to provide, secure and support the service for you.
• We process personal data in Customer Content as your processor under the DPA.
• We do not use Customer Content to train AI models.
• You are responsible for having the rights and legal bases for Customer Content.

6. Your model provider

Gauntlet does not supply an AI model. You bring your own model key (on Gauntlet Cloud, an Anthropic API key). The service forwards the agent's model requests, with your key, to that provider.

• Your contract with the provider governs how it processes the requests, its usage policies and its charges. The provider bills you directly; we do not resell or mark up model usage.
• Requests contain content from your environments (page text, screenshots, logs). Use a provider account and settings that fit that content.
• We are not responsible for the provider's availability, outputs or charges. Usage shown in the console is a convenience; the provider's records prevail.

7. Plans, fees, renewal and refunds

Gauntlet Cloud

• Free: no charge, with the limits on the pricing page. We may change Free limits with notice.
• Team and Business: billed in advance, monthly or yearly, through Stripe, and renewed automatically each period until cancelled. Extra environment slots are billed with the plan.
• Trial: Team or Business for 14 days without a card, once per person and per organization. Without a payment method at its end, the organization returns to Free.
• Changes: increases are charged pro rata at once. Reductions become account credit, which pays future invoices. Credit can be refunded to the card within 24 hours of the payment it came from; after that, ask hello@usegauntlet.dev. Deleting an organization forfeits its credit unless you asked for a refund first.
• Cancellation: any time in the console. The plan stays active until the end of the paid period, then the organization returns to Free. Fees paid are not refunded, except as stated in these terms or required by law.
• Failed payments: Stripe retries the payment and the plan stays active meanwhile. If it still fails, the subscription is cancelled and the organization returns to Free.
• Over the limit after a downgrade: nothing running is stopped and nothing is deleted; new environments and runs wait until usage is within the new limits.
• Enterprise: as agreed in an order form, invoiced, payable within 30 days.

Self-hosted licenses

• Team and Business licenses are yearly subscriptions, paid in advance through Stripe and renewed automatically until cancelled in the license account.
• A cancelled subscription can be resumed before its period ends. After the paid period, the license keeps working for 14 days of grace; then the installation falls back to Community limits. Nothing is deleted.
• Upgrading Team to Business charges the pro-rata amount shown for the rest of the term.
• A failed renewal leaves an open invoice; cancelling voids it.
• License fees are not refundable, except under section 8 of these terms, section 11 of the license terms (30-day fix or refund), or where required by law.

Both

• Prices are those shown at purchase, in USD or EUR. Taxes such as VAT are calculated by Stripe Tax and added where applicable; EU business purchases with a valid VAT ID are reverse-charged.
• We may change prices for future periods with at least 30 days' notice; you may cancel before the change applies.
• Card details are handled by Stripe; we never receive them.

8. Availability and support

• We aim to keep Gauntlet Cloud available but make no availability commitment (SLA) unless agreed in writing. Maintenance and outages can happen.
• Environments are temporary by design and are deleted when their time limit runs out. Do not rely on them to keep anything.
• We may change features. We will not remove a material paid feature during a paid period without notice; if you cancel because of it, we refund the unused part.
• Support is by email at hello@usegauntlet.dev, on a reasonable-efforts basis unless agreed otherwise.

9. Intellectual property

We own Gauntlet, its software, documentation and brand. No rights are granted beyond those in these terms and the license terms. We may use feedback you send without obligation. You own your Customer Content and run results.

10. Confidentiality

Each party keeps the other's non-public information confidential, uses it only for this contract and shares it only with people who need it and are bound to equivalent confidentiality. This does not cover information that is public, already known, independently developed or lawfully received from others. Disclosure required by law is allowed, with notice where lawful. These duties last three years after the contract ends, and for trade secrets and Customer Content as long as they remain confidential.

11. Warranties

We provide the service with reasonable skill and care. Beyond that, to the extent the law allows, Gauntlet is provided "as is", without warranties of merchantability, fitness for a particular purpose or non-infringement, and without warranty that it is error-free, that findings are complete or correct, or that tested software is secure. The Free plan and trials are provided as is.

12. Liability

• Each party's total liability under this contract is limited to the fees paid by you for the affected service in the 12 months before the event giving rise to the claim, or USD 100 if you paid nothing.
• Neither party is liable for indirect or consequential loss, lost profit or revenue, or lost data beyond the cost of restoring it from your backups.
• These limits do not apply to liability for intent or gross negligence, for death or personal injury, to your payment obligations or indemnity, or where the law does not allow a limit.

13. Indemnity

You will defend and indemnify us against third-party claims arising from your Customer Content, from systems you directed Gauntlet at without authorization, or from your breach of section 3. We will defend and indemnify you against third-party claims that Gauntlet Cloud, as we provide it, infringes their intellectual property rights. The indemnified party notifies the other promptly, lets it control the defence and cooperates.

14. Suspension and termination

• You may stop using Gauntlet and cancel at any time (section 7).
• We may suspend environments, runs or accounts immediately where needed to stop a security threat, an attack on third parties, unlawful use or a serious breach of these terms, limited to what is necessary, and we tell you why.
• Either party may terminate for a material breach not cured within 30 days of notice. We may end the Free plan for an account with 60 days' notice.
• Sections 5, 7 (for amounts due), 9 to 13 and 15 to 17 survive termination.

15. Your data at the end

• Until termination you can download run artifacts and delete runs, projects and organizations in the console. Deleting a project deletes its runs and their artifacts; deleting an organization deletes its stored model keys.
• Within 30 days after termination you may ask for an export of your runs and their artifacts. We delete Customer Content within 30 days of termination, or of delivering the export, unless the law requires us to keep it. Backups are weekly snapshots, each deleted after 4 weeks.
• To delete your user account, ask hello@usegauntlet.dev or [not configured: legal contact email].

16. Governing law

This contract is governed by the law of [not configured: governing law and venue], excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The courts named there have exclusive jurisdiction, unless mandatory law provides otherwise.

17. Changes and general terms

• We may update these terms. Material changes are announced at least 30 days ahead by email or in the console. If you object, you may cancel before they apply; continuing to use Gauntlet after that means you accept them.
• Notices to us: [not configured: legal contact email]. Notices to you: the email of your organization's owners or of the license account.
• Neither party may assign this contract without consent, except to a successor of its business. We use sub-processors as set out in the DPA and the sub-processor list.
• Neither party is liable for delays caused by events beyond its reasonable control.
• If a provision is invalid, the rest remains in force and the invalid provision is replaced by the valid one closest to its purpose.
• These terms, the DPA, the license terms (for self-hosted) and any order form are the entire agreement on their subject.

Operator details: imprint.