Terms of Service

Agreement and operator

These Terms are an agreement between you and Konvoa, the operator of the Konvoa service (the Operator). “Konvoa” refers to the hosted authentication, licensing, application-management, reseller-automation, documentation, and SDK services made available through konvoa.com.

By creating an account, accepting a workspace invitation, purchasing a plan, or using Konvoa, you agree to these Terms and the Acceptable Use Policy. If you use Konvoa for an organization, you represent that you can bind that organization.

Accounts and authority

You must provide accurate account information, keep credentials and recovery channels secure, and promptly revoke sessions, team access, or reseller credentials that should no longer be active. You are responsible for activity performed through your workspace unless it results from a failure of Konvoa’s own systems.

You must be legally able to enter this agreement. Konvoa is built for software operators and their authorized personnel, not for children or personal family use.

The service

Konvoa evaluates current server-side records for application status, customer identity, licenses, subscriptions, device binding, sessions, versions, and file access. Some controls are optional or depend on operator configuration, including billing, Cloudflare Turnstile, and provider-backed VPN intelligence. A release-hash comparison is tamper telemetry from a customer-controlled device; it is not hardware attestation and does not make a modified client trustworthy.

You are responsible for integrating and testing the SDK or reference client correctly. Application-layer signatures complement HTTPS and secure client storage; they do not replace them.

Applications and customer data

You retain your rights in application names, configuration, customer records, release metadata, and other information you submit. You give the Operator a limited right to host, process, transmit, back up, and display that information only as needed to operate, secure, support, and improve Konvoa or comply with law.

You are responsible for having a lawful basis and appropriate notices for customer usernames, device identifiers, executable hashes, network information, license records, and other data your application sends to Konvoa. Do not place secrets in application variables or metadata returned to customer-controlled software.

External files and releases

Konvoa does not accept or host your application binaries. A file record contains an owner-controlled direct HTTPS URL, descriptive metadata, access scope, and an optional integrity digest. Published application-update versions require a SHA-256 digest even when an ordinary download record does not. The actual bytes remain on infrastructure you choose. You are responsible for the content, safety, legality, availability, takedown process, and access controls of that host.

Konvoa’s authorization decision does not make a public or reusable download URL private. Your client must make a fresh credential-free request to the external host. When a digest is supplied, the client must verify the complete artifact before using it; update clients must reject a published version that is missing or does not match its signed SHA-256.

Teams and resellers

Workspace owners control invitations, application scope, roles, reseller permissions, balances, and automation credentials. Grant only the authority a person or reseller needs. You are responsible for your selected recipients and for delivery actions performed with credentials you issue until those credentials expire or are revoked.

Reseller API secrets are shown once. They must be stored in a server-side secret manager and must not be embedded in a desktop application, browser bundle, log, webhook payload, or customer message.

Plans, billing, and cancellation

The Free, Starter, and Pro limits and base prices are published on the pricing page. Paid plans are monthly recurring subscriptions processed through Stripe when live billing is configured. Stripe Checkout presents the transaction details before purchase, and the Stripe customer portal is the billing-management and cancellation surface.

You authorize recurring charges until cancellation. Stopping use or losing access to an account does not itself cancel a subscription. Unless required by law or agreed by the Operator in writing, processed charges are not automatically refundable. Taxes, currency conversion, payment-method rules, and promotions may be handled by Stripe or apply according to your location.

A failed, reversed, disputed, expired, canceled, or unpaid subscription may reduce the workspace to the plan state reflected by verified billing events. The Operator will not represent estimated revenue or an unverified checkout redirect as a completed payment.

Security and acceptable use

You must follow the Acceptable Use Policy, protect every credential, use reasonable security controls, and notify the Operator promptly if you believe an account or integration has been compromised. You may not bypass plan limits, authorization decisions, rate limits, device policy, or technical safeguards.

Ownership, documentation, and SDKs

The Operator and its licensors retain rights in Konvoa, its hosted software, site, documentation, branding, and original SDK code. Subject to these Terms, you receive a limited, non-exclusive, non-transferable right to use the hosted service for your own authorized applications during your account term.

Downloadable SDKs, examples, bundled dependencies, and fonts may include separate license notices. Those notices control the corresponding code or dependency. You may not remove proprietary notices or imply that the Operator endorses your application.

Suspension and termination

The Operator may restrict or suspend access when reasonably necessary to stop abuse, contain a security incident, comply with law, address nonpayment, or protect Konvoa and other users. Where practical and safe, the Operator may provide a chance to correct the issue.

You may stop using the service at any time, but must cancel a paid subscription separately. Self-service account deletion is not currently implemented. Account-closure and deletion requests must use the contact channel below. Some security, billing, immutable delivery, and balance-ledger records may remain where needed for fraud prevention, dispute handling, legal obligations, or the integrity of other records.

Disclaimers

To the fullest extent permitted by law, Konvoa is provided “as is” and “as available.” The Operator does not warrant uninterrupted operation, that every attempted abuse will be detected, that device binding cannot be bypassed on a customer-controlled machine, or that an owner-controlled external file will remain available or safe.

Nothing in these Terms excludes warranties or rights that cannot lawfully be excluded.

Liability

To the fullest extent permitted by law, neither party is liable under these Terms for indirect, incidental, special, exemplary, punitive, or consequential damages, or for lost profits, revenues, goodwill, or data, even if advised that they were possible.

To the fullest extent permitted by law, the Operator’s aggregate liability arising from Konvoa will not exceed the amount you paid for Konvoa during the twelve months before the event giving rise to the claim. This limitation does not apply where applicable law forbids it. The Operator must have counsel confirm this allocation, and any mandatory consumer exceptions, before commercial launch.

Service and Terms changes

The service and these Terms may change as Konvoa develops. Material changes will be identified by a new effective date and, when required by law, reasonable notice through the service or another available account channel. Continued use after a change takes effect constitutes acceptance only where the law permits that method of acceptance.

Contact and legal notices

The configured legal operator is Konvoa. Contact [email protected] for legal and privacy requests.

A governing law, courts or venue, formal notice address, and complete operator identity have not been inferred. The Operator and legal counsel must configure those terms based on the actual operating entity and jurisdictions before paid launch.