Legal documents — Terms, Privacy Policy, Cookies, DPA | aamp
aamp
Get started →
Get started →
Legal documents

Terms, privacy and data processing.

Four documents governing use of the aamp platform. All last updated 27 August 2026.

Document 01

Terms of Service

Last Updated: August 27, 2026

§ 1. General Provisions

  1. These Terms of Service govern the access to and use of the aamp AI agent orchestration and automation platform (the "Service" or "Software"), provided by the Operator.
  2. The Service is strictly intended for business and commercial entity use (B2B).
  3. Creating an Account, deploying a Software instance, or using the Service constitutes full acceptance of these Terms.

§ 2. Service Model & Technical Architecture

  1. The aamp Software is delivered as SaaS, Self-Hosted, or Air-Gapped On-Premise (a single Go binary with a local aamp.sqlite3 database).
  2. Billing Model:
    • Usage is measured and billed based on Completed Agent Execution Runs. A single completed run counts as 1 execution unit, regardless of internal reasoning loops or tool execution steps.
    • The Software operates on a strict Bring Your Own Key (BYOK) model with 0% Token Markup. Customers connect their own LLM API keys (OpenAI, Anthropic) or local inference backends (vLLM, Ollama). The Operator charges no markup on LLM compute.
  3. Seat Allocation:
    • Agent workflow creation and editing require paid Builder Seats.
    • Viewer / Auditor Seats (for inspecting execution logs, compliance metrics, and human-in-the-loop approvals) are provided free of charge.

§ 3. Security, Isolation, and Sandboxing

  1. Execution of untrusted code, scripts, and browser automation is isolated using hardware-boundary Firecracker MicroVMs (KVM) to minimize the attack blast radius and protect host systems.
  2. Air-Gapped deployments disable all external telemetry and phone-home mechanisms, ensuring 100% data sovereignty.

§ 4. Intellectual Property & Data Ownership

  1. The Operator grants the Customer a non-exclusive, non-transferable, limited license to use the Software under the selected subscription tier.
  2. All data, prompts, vector indexes, document chunks, and execution logs generated by the Customer remain the sole property of the Customer. The Operator never uses Customer data for AI model training.

§ 5. Limitation of Liability

  1. The Software is provided on an "AS IS" and "AS AVAILABLE" basis.
  2. To the maximum extent permitted by applicable law, the Operator's aggregate B2B liability shall be limited to the total fees paid by the Customer in the three (3) months preceding the claim.
Document 02

Privacy Policy

Last Updated: August 27, 2026

1. Data Controller

The Data Controller for user accounts and B2B client management is the Operator of aamp. Contact: privacy@getaamp.com.

2. Scope & Purpose of Data Processing

  • B2B Account Data (Name, Email, Billing details): Processed for contract execution, account management, and legal compliance (Art. 6(1)(b) & (c) GDPR).
  • Execution & Audit Logs: The aamp engine records operational events across 14 audit log domains into a local SQLite database (aamp.sqlite3). In Self-Hosted / Air-Gapped setups, this data never leaves the Customer's infrastructure.
  • API Keys & Credentials: External API keys and secrets are encrypted at rest using AES-256-GCM encryption.

3. Data Sovereignty & EU Regulatory Compliance

  • GDPR Compliance: Zero unauthorized third-party transfers outside the EEA.
  • EU AI Act, NIS2 & DORA: Hardware-level sandbox isolation (Firecracker MicroVM) and comprehensive local structured logging fulfill auditing and cyber-resilience requirements for critical digital supply chains.
Document 03

Cookie Policy

Last Updated: August 27, 2026

1. What are Cookies?

Cookies are small text files stored on your device when accessing our web interfaces or administrative dashboards.

2. Cookies Used by aamp

  1. Essential / Strictly Necessary Cookies: Required for user authentication, session persistence, and CSRF protection (e.g., Bearer tokens, Argon2id auth sessions).
  2. Zero Telemetry Policy: In On-Premise and Air-Gapped environments, aamp uses zero analytics, tracking, or third-party marketing cookies.
Document 04

Data Processing Addendum (DPA)

Last Updated: August 27, 2026

§ 1. Scope of Processing

  1. This Data Processing Addendum (DPA) forms part of the Agreement between the Customer (Data Controller) and the Operator (Data Processor).
  2. For Self-Hosted / Air-Gapped On-Premise deployments, the Operator has no remote access to any personal data processed within the Customer's deployment.

§ 2. Technical and Organizational Security Measures

  1. The Operator implements robust security measures under Art. 32 GDPR:
    • Execution sandboxing via Firecracker MicroVMs.
    • AES-256-GCM encryption at rest for stored credentials and Argon2id password hashing.
    • Granular 35-permission Role-Based Access Control (RBAC).
    • Isolated vsock communication channels between host authority processes and microVM guests.