Terms of service | openshield

These terms are the contract between Sway SRL ("we", "us") and the business that creates an account ("you"). By creating an account you accept them. The acceptable use rules in section 5, the data processing agreement and its list of sub-processors are part of them. The privacy policy explains how we handle personal data and which cookies we use.

1. Who the service is for

openshield is for businesses and professionals only. By creating an account you confirm that you act for a business or in the course of a profession, and that you may accept these terms on its behalf. A consumer acting outside a trade or profession may not use the service.

2. The service

openshield is a hosted API that checks images and texts and returns a moderation decision with its reasons. Once an organization has topped up its balance, its text workflows add the advanced reading: a text the first check sends to review gets a second reading by a decision model of a sub-processor, TypeSafe AI, Inc., which may settle the review. The advanced reading is on for every organization that has topped up, and is priced per text it reads, as the pricing page shows. It comes with a dashboard to manage keys, workflows, the decision journal, usage, billing and your team, and with documentation. Fraud prevention, in beta, scores the events you send about your users (sign-ups, logins, payments) with your own instance of openfraud, priced per decision and per event as the pricing page shows. A free organization's instance is paused after 30 days without a call, its data kept.

The service is in beta. We may add, change or remove features, and we will tell you in the changelog and by email when a change affects how you use it.

3. Your account and your keys

Give accurate information and keep it up to date. Account owners must turn on two-factor authentication before they top up a balance.
API keys are secret. Use them only from your own servers: the API refuses calls from browsers. You are responsible for what is done with your keys. Revoke a key you think is exposed, and tell us if you suspect a wider problem.
One person may belong to several organizations. Each organization has its own balance.

4. Prices, balance and payment

openshield is prepaid: you top up a balance in euros and each check takes from it what its workflow costs. There is no subscription. Prices are those of the pricing page, excluding VAT. They are beta prices.
An image costs the price of the components its workflow uses. A text costs its components per started 1,000 characters, and the advanced reading costs a fixed price per text it reads. Each workflow shows what it costs in the dashboard before you save it.
Fraud prevention is paid from the same balance in euros. A decision (POST /fraud/v1/decide, dry runs included) costs EUR 0.001. An accepted event costs EUR 0.0002. An IP lookup costs EUR 0.0002 an address. The network data adds EUR 0.0002 to each decision and the activity bursts EUR 0.0005, while they are on. Only a call that answers 2xx is charged. Cases, accounts, lists, exports and erasures are free.
The fraud sandbox (calls with an om_test_ key) is free, within 5 requests a second and 10,000 calls a month for each organization. It runs on test data only, and past those limits its calls answer 429 until the next month.
Every organization receives free use each month, of the amount the pricing page shows (EUR 2). It is used before what you bought, and it applies to fraud prevention as well as to checks. What is left of it does not carry over to the next month.
Free use is for one person or business, not one per account. Our anti-abuse checks may pause the free use of the organizations an account owns, and refuse its use of Try it, when they flag the account (for example many accounts made from one place to collect free use). Paid use is not affected, the billing page says when free use is paused, and one top-up gives it back. You can ask us to review a pause at support@openshield.dev.
A top-up is at least the minimum the pricing page shows, is paid by card through Stripe, and comes with an invoice. VAT is added where it applies. A top-up of a larger amount may add a bonus, as the pricing page shows.
What you top up stays usable for 12 months from the payment. The oldest amounts are used first. An amount that has expired is lost and is not refunded.
If you turn on automatic top-ups, you authorise us to charge the card you saved, through Stripe, the amount you chose each time your balance falls under the threshold you set, up to the monthly limit you set. You can change or turn off automatic top-ups at any time from the billing page. If a charge fails, automatic top-ups are turned off and the owners are told by email.
When the balance is empty, the API answers 429 quota_exceeded until you top up or the next free use arrives. A check already accepted is finished; if it costs more than what was left, the difference is taken from your next top-up or free use.
Request limits rise with what you topped up over the last 30 days, as the pricing page shows.
We tell the owners of each organization by email at least 30 days before a price rises. A rise applies only to checks made after it takes effect; your balance keeps its value in euros.
Refunds: a top-up is not refunded, except where section 11 or the law provides otherwise.
An organization that subscribed to a monthly or yearly plan before prepaid use keeps that plan, under the terms that applied when it subscribed, until it ends. It then moves to prepaid use.

5. Acceptable use

These rules keep the service safe and fair for everyone who uses it.

What you agree not to do

Break the limits or the service. Do not try to get around rate limits, concurrency limits or quotas, for example by sharing one workload across several accounts. Do not probe or attack the service, scan it for weaknesses without our written agreement, or disrupt it.
Share or resell keys. An API key is for your organization's own servers. Do not publish a key, put it in a browser or in an app that users install, share it with another organization or sell access to it.
Send what you have no right to send. Do not send content you may not lawfully process, or use the service to harm people.
Misuse fraud prevention. Tell the people whose events you send that you do so, as articles 13 and 14 of the GDPR require, and have a lawful basis for it. Do not put special categories of personal data in event attributes. Do not use fraud decisions for unlawful profiling or discrimination, or to track people outside your own service.
Work around a refusal. Do not use another account, another key or another route to bypass a suspension.
Abuse the forms. Do not use automated means to create accounts or to send sign-in and password reset requests in bulk.

Content that may be illegal

A moderation service receives content that may be offensive, harmful or illegal: that is what it exists to moderate. We process it only to moderate it, in memory, and we do not keep it. These rules do not forbid sending such content to be checked.

Sending content in order to produce, distribute or gain from it is not moderating it, and is forbidden. Where we become aware of apparent child sexual abuse material, we handle it as the law requires.

What happens if the rules are broken

We tell you what we saw and ask you to stop. If the problem is serious, or goes on, or puts the service or others at risk, we may suspend your organization, which makes its API keys refuse calls until the matter is settled, or end the contract, as section 11 says. Your dashboard, your data and your invoices stay available during a suspension.

Reporting

If you think someone is breaking these rules, or you have found a security problem, write to contact@sway.events.

6. Your content and your data

You keep all rights in the images and texts you send, and in the events you send to fraud prevention. You give us the right to process them only to return the moderation result or the fraud decision and to run the service.
Content is checked in memory and forgotten. We do not keep it. The journal keeps the decision and its reasons, never the content.
The events you send to fraud prevention are different. Your instance keeps events, decisions and cases for 30 days until your first top-up and for 90 days after, then purges them. Email addresses and IP addresses are replaced by keyed pseudonyms before storage, and the raw values are not stored. The User-Agent is read then dropped. You send the context of your end users (IP address, User-Agent, language, country, device identifier, attributes). Once you have topped up, the texts of the advanced reading are also sent to TypeSafe AI, as the privacy policy and the list of sub-processors describe.
You confirm that you may send the content and the events, including under data protection law. For personal data in that content and in those events, you are the controller and we are your processor, and the data processing agreement applies. You need a lawful basis and you inform your end users.
Content sent to a moderation service may be illegal by nature. We process it only to moderate it. Where we become aware of apparent child sexual abuse material, we handle it as the law requires.

7. Availability and support

There is no service level agreement during the beta. We run the service with care and aim to keep it available, but we do not promise a level of uptime, and we may interrupt it to maintain it. The status page shows how the service is doing.

A free organization's fraud instance with no call for 30 days is paused. A call then answers 503 fraud_waking and wakes the instance within seconds. Try again after a moment.

Each tier has limits on request rate and concurrent requests, set out on the pricing page, and checks stop when the balance is empty. You agree to stay within them.

Support is by email at contact@sway.events, on a best-effort basis.

8. Moderation results and fraud decisions

A moderation result is a score from a model, not a certainty. It can be wrong. You decide what to do with it. For decisions with serious consequences for a person, have a human review the result.

A fraud decision applies rules to the events you sent. It can be wrong too. The decision to refuse, hold or restrict a person is yours. Under article 22 of the GDPR, before a decision with legal or similarly significant effects relies only on automated processing, you must offer human review and a way to contest it. openfraud provides statements of reasons (/fraud/v1/statements/{id}) and an appeal route (/fraud/v1/cases/{id}/appeal) to help you.

The core blocklists act from the first day. Other rules start in shadow: they record what they would do and act on nothing. By default, openshield promotes a shadow rule to act automatically once at least 30 days of history exist and the rule is reliable. It is reliable if either:

your own labels show a precision of at least 95 % over at least 10 labelled accounts; or
our decision model, provided by TypeSafe AI, Inc., reviews pseudonymized timelines of up to 10 accounts the rule hit and finds at least 90 % of them fraudulent.

A promoted rule may then take any action its pack sets, blocking included. You can choose in the dashboard to promote rules manually, or to limit automatic promotion to rules that only hold or send to review. Each automatic promotion is emailed to the owners and written to the audit log. A brake stops all acting rules if they suddenly act on many accounts. A rule whose labelled precision falls under 80 % goes back to shadow on its own. For our own sign-up checks, no sign-up is refused on the check alone.

9. Intellectual property

We and our licensors own the service. The engines, openmod and openfraud, are open source under the Apache-2.0 licence. We grant you a non-exclusive right to use the service for your business for as long as these terms apply. Your workflows are yours: you can export them as JSON at any time.

10. Liability

Nothing in these terms limits liability for fraud, intentional misconduct, gross negligence, death or personal injury, or any liability that the law does not allow to be limited. These terms are meant to leave no manifest imbalance between us, as articles VI.91/1 to VI.91/5 of the Code of Economic Law require between businesses.

Otherwise, and as far as the law allows, our liability for damage in connection with the service is limited to the fees you paid us in the 12 months before the event that caused it, and we are not liable for indirect loss such as lost profit.

You are liable for damage caused by the use of your keys.

11. Suspension and ending

You may stop using the service at any time, and turn off automatic top-ups from the billing page. You may also delete your organization from the settings page: what is left of its balance is then lost and is not refunded.
We may suspend an organization, or end the contract, if it breaks the acceptable use rules of section 5, puts the service or others at risk, or if the law requires it. We tell you why and, when we can, ahead of time. While an organization is suspended, its API keys are refused, but the dashboard, your data and your invoices stay available.
We may end the service by giving you at least 60 days' notice. We then refund what is left of the balance you bought and that has not expired.

12. Switching and leaving

In line with article 25 of the EU Data Act (Regulation (EU) 2023/2854), you may switch to another provider or to your own systems, or delete your data, by giving us notice of at most two months. After the notice, a transitional period of 30 days follows, during which we keep providing the service. You then have at least 30 days to retrieve your data. After that we erase it.

You can export your workflows (JSON), your journal (JSONL or CSV) and your usage (CSV) from the dashboard, and the fraud data kept about one person through /fraud/v1/subjects/{id}/export. Exports are free of charge, and so is switching. Turning fraud prevention off, or deleting your organization, erases your fraud instance and its data.

13. Changes to these terms

We tell the owners of each organization by email at least 30 days before a change to these terms takes effect. If you do not accept it, you may end your subscription before that date, without any charge. If you carry on using the service after it, you accept the change.

14. Law and courts

Belgian law governs these terms. Before going to court, write to us at contact@sway.events so that we can try to find an arrangement. The competent courts of Belgium have jurisdiction, unless the law requires another.

15. Legal notice

This section gives the details that Belgian law asks an online service to publish: article XII.6 of the Code of Economic Law and article 2:20 of the Companies and Associations Code.

Publisher

openshield is a service of Sway SRL, a Belgian private limited company (société à responsabilité limitée).

Registered office: Clos des Colombes 23, 1342 Limelette, Belgium.
Enterprise number: BE1037531992.
VAT number: BE1037531992
Register of legal entities (RPM): RPM Brabant wallon
Email: contact@sway.events

Hosting

Cloudflare, Inc., San Francisco, California, United States: the website, the dashboard and the front door of the API. The databases and the file storage are in the European Union.
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: the server that checks images and texts, and the fraud instances, one per organization, with their data. Your fraud instance reaches nothing outside that server.

The list of sub-processors lists every provider that handles data for us, and what each does.

Webhooks

Webhooks of your fraud instance are checked by our gateway, signed again with your own whsec_ secret and delivered from our Cloudflare Worker to the https address you set. We relay them and keep nothing of them beyond delivery.

The engine

openshield is the hosted platform of openmod, an open-source moderation engine published under the Apache-2.0 licence, and of openfraud, an open-source fraud engine published under the same licence. openmod is the moderation API of openshield and openfraud its fraud API. There is no self-hosted offer.

openfraud uses data from third parties under their own licences: country centres from Google's DSPL canonical countries table (BSD 3-Clause, Copyright Google Inc.) and calling codes from Google's libphonenumber metadata (Apache-2.0, Copyright Google LLC). With the network data, it also uses IPtoASN (public domain, Open Data Commons PDDL), the Tor Project's bulk exit list, disposable-email-domains (MIT) and X4BNet lists_vpn (MIT, Copyright (c) 2024 X4B, Mathew Heard).

Contact

Write to contact@sway.events for any question about the service, a legal request or a complaint. For personal data, see the privacy policy.