The terms, in plain words.
Tileward refuses locked topics before a model runs and writes down every decision. A guard is a control, not a compliance guarantee.
Who this is between.
These terms are between Tileward, Inc., a company incorporated in the United States, and the organisation whose account it is. If you are opening an account for your employer, you are saying you can bind them.
Personal data is handled under the privacy policy. Where we process personal data on your behalf, the data processing addendum applies and takes precedence over these terms on that subject.
Where an Enterprise order form or master agreement has been executed, it sits above these terms and wins on conflict, the same way the data processing addendum does on personal data. For everyone else, these terms are the whole agreement.
Your key is your policy.
Governance policy is bound to the API key, not to the prompt, so whoever holds a key holds the permissions attached to it. Keep keys secret, rotate them when someone leaves, and tell us promptly if one leaks.
Each plan comes with a fixed number of keys and seats, listed on the pricing section. Seats are per person; sharing a login between people is not a seat.
You are responsible for activity under your keys, including your own end users' activity if you have built something on top of us.
What you are buying.
Tiers differ on volume, seats, deployment and request rate — never on model quality. The allowances and the per-plan rate limits are the ones published on the pricing section.
On every plan, running out of an included allowance is a pause, not a bill: the service declines further use of that allowance until you buy more credits, and resumes as soon as you do. There is no automatic overage billing and no silent throttling. Included monthly allowances reset with the billing cycle; credits you have purchased stay on the account until spent.
Billing, renewal and cancellation.
Paid plans are monthly at the prices published on the pricing section. Enterprise is either a committed-use token pool or a flat licence for an air-gapped deployment, agreed separately.
Paid plans renew automatically each billing cycle until cancelled. You can cancel at any time: the account stays active through the cycle you have already paid for, and closes when it ends, following the account-deletion terms in the privacy policy. Cancellation is not a refund event. Refunds are made in one case only: when a paid request fails to be processed. A price change is a material change to these terms and is notified by email within 72 hours.
Payments are processed by Stripe, listed on the sub-processor page.
What you agree not to do with it.
Don't use Tileward to break the law, to attack anyone's systems, or to generate material that sexually exploits children. Don't try to defeat another tenant's isolation or to extract our model weights from the hosted service. Don't resell raw API access as if it were your own model unless we have agreed that in writing.
Unlocking a topic is your decision and your responsibility. If your regulator disagrees, that is a conversation between you and them.
We may suspend an account that is attacking the service, that is being used unlawfully, or that is in breach of the paragraphs above. Running out of credit is not grounds for suspension: when your balance reaches zero the API returns 402 until you top up, and your account, keys and stored context are untouched.
We do not reserve a right to read your stored content to enforce this. Enforcement relies on what the system already produces in the course of serving you: the guard's allow-or-refuse decisions and the audit record's metadata, which stores no message text. The privacy policy says the same on retention.
What Tileward does not warrant.
The model can be wrong
It is a language model. It produces plausible text, not verified fact, and you should not put it in front of a customer or a patient without a human in the loop that you control.
The guard is not perfect
Across the governance roster — the 64 regulated topics plus a catch-all, so a 65-way choice — topic recognition is right 94.8% of the time, as published on /governance/. That is not 100%.
The knowledge is not deleted
Locking a topic puts a gate at the door. It does not erase the concept from the weights (see /governance/). A determined attacker is a different threat model from a policy violation.
Tileward is a control you can point at, with a record you can hand an auditor. It is not a certification, it does not make you compliant with anything, and we do not warrant that a locked topic can never be elicited. Your regulatory obligations remain yours.
The formal warranty disclaimer, the limitation of liability and the indemnities in both directions are set out in the written agreement you sign with us: the order form for a self-serve plan, or the negotiated agreement for Enterprise. They are not restated here, and the one you signed is the one that governs.
You may use the service for as long as you hold credit. Each plan also carries a request-rate limit, published with the plan on the pricing section. Enterprise is not rate-limited.
The self-serve plans are provided as they are, without an uptime commitment.
Your content and our software.
You keep everything you send us and everything the model produces for you. We keep the software, the compression work, the tile taxonomy and the platform.
Term, termination, and what happens to your data.
You can close a self-serve account at any time. On termination, private tiles and everything Tileward Context holds for the account are deleted immediately, and audit records run out their per-plan retention window, exactly as the privacy policy states.
Export your audit records before you close the account. They come out as CSV or JSON, or through the webhook and SIEM export on the plans that include it.
An air-gapped licence has no metering, so nothing expires on its own: when the licence ends, the installation must be taken down within 30 days of closure, and we verify the takedown with you. Until that verification, the licence terms continue to apply to the installation.
If we make a material change to these terms, every account holder gets an email about it within 72 hours of the change, the same commitment the privacy policy makes.
Questions: hello@tileward.com.