Terms and conditions

1. Description of the service

Spellwarden checks the skills and MCP servers that AI agents load. It scans them for security problems, turns findings into policy packs you can enforce at your gateways and hooks, measures quality with evals and, on the Enterprise plan, keeps a private registry that your agents load from. You can use it in your browser, with an API key from your own software, and from AI apps through its MCP server.

Features are released in stages. The pricing section of spellwarden.ai lists what each plan includes. The open-source Spellwarden scanner is licensed separately under the Apache License 2.0, and that licence, not these terms, governs its use.

2. Who these terms apply to

Spellwarden is made for organisations. If you create an organisation or subscribe for a business, you confirm that you may accept these terms for that business. Every member of an organisation is bound by them when they join.

If your organisation's content contains personal data about other people, we process it as your organisation's processor (see the privacy policy). If you use the service as a consumer, the mandatory consumer law of your country of residence applies whatever these terms say, and the consumer rights in consumer protection and right of withdrawal are yours.

3. Accounts and organisations

You sign up with an email address and password, or with Google. Organisations on the Enterprise plan can also require single sign-on through their own identity provider (SAML or OIDC). Two-factor authentication is optional for each person, and an organisation's owners can require it.

One account can belong to several organisations. An organisation's owners manage its members, roles, settings and billing. You are responsible for keeping your credentials and any API keys you create confidential, and for what is done with them.

4. Acceptable use

• Use the service only for lawful purposes and only with content you have the right to submit.
• Scan, probe or evaluate only skills and MCP servers that you operate, that are public, or that you are authorised to test. Submitting a skill or server you suspect is malicious, so that Spellwarden can check it, is an intended use.
• Do not attempt to circumvent plan limits, eval run limits, rate limits or API key restrictions.
• Do not attack, overload or test the security of the service itself without our written permission, and do not use it to attack anyone else.
• Do not resell access to the service, and do not attempt to extract or reverse-engineer the AI models behind evals.

5. Intellectual property

Your organisation keeps all rights to the content it submits. We claim no ownership over that content or the findings and results produced from it. The Spellwarden name, logo, website, app and service belong to NETBEARS TEAM SRL.

6. Rules you share with us

A manager or owner of your organisation can share one of its rules with Spellwarden from the Rules page, and acts for your organisation when doing so. Sharing is optional. It covers the rule as the dialog shows it, the note written with it and, if chosen, where the skill it came from is published. From the moment you share, we may review the rule and the note to decide whether to adopt it; an AI model from Anthropic helps us with that review. We use the note and the place of publication only for that review and as the record of where an adopted rule came from, and never publish them.

If we adopt the rule, your organisation grants us from then on a worldwide, royalty-free, perpetual and irrevocable licence to use, change and publish the rule, including as part of the open-source Spellwarden scanner under the Apache License 2.0. We write the scanner's rule ourselves from the problem your rule describes, and we never publish your organisation's name, its members or its skills.

Until we decide, you can withdraw the share, and withdrawing deletes our copy. If we do not adopt the rule, we delete what you shared and keep only our decision, with the rule's area and severity. If your organisation is deleted before we decide, we delete the share.

7. The 14-day trial

Every new organisation starts with a 14-day trial of the Team plan, with no card needed. If no billing is added by the end of the trial, the organisation becomes read-only and keeps its data until billing is added. Adding billing during the trial ends the trial and starts the paid subscription.

8. Plans and prices

You choose monthly or annual billing at checkout. There is no platform fee and no seat cap. Team bills at least 10 members and Enterprise at least 50: an organisation with fewer members pays for the minimum. Members who only manage billing are not charged for. Applicable VAT or sales tax is calculated by Creem at checkout and shown before you pay. An organisation can change its plan from its Billing page: a move to Enterprise, or from monthly to annual billing, takes effect at once, including the move to the new plan's minimum, and is charged pro rata; a move to Team, or from annual to monthly billing, takes effect at the end of the current period, without a refund.

9. Members and seats

The number of members billed follows the organisation's member list and never falls below the plan's minimum (10 on Team, 50 on Enterprise). On a monthly subscription, a change in the number of members applies from the next renewal, without proration. On an annual subscription, a change applies at once and is prorated for the rest of the year, both when members are added and when they are removed. Seats that change together with a move to a higher plan, or while a subscription is raised to its minimum, are charged at once.

10. Payment and Creem

Creem (creem.io) is the merchant of record for Spellwarden subscriptions. Creem is the legal seller: it takes the payment, charges the tax that applies and issues your invoice. Creem's own terms govern the payment itself (card handling, tax calculation, invoicing); these terms govern the service. See data sharing in our privacy policy for what Creem does with billing data.

11. Renewal, cancellation and failed payments

A subscription renews automatically at the end of each monthly or annual period until it is cancelled. If you cancel from the organisation's Billing page, the subscription stays active until the end of the period already paid for, and the organisation then becomes read-only. Cancelling in Creem's customer portal ends the subscription at once.

If a payment fails, the organisation keeps full access for 14 days while the payment is retried or the card is updated, and then becomes read-only. A read-only organisation keeps its data, and adding billing again restores full access.

12. Refunds

A subscription period that has started is not refunded, except where the law requires it or under right of withdrawal. Deleting an organisation cancels its subscription at once, with no refund for the rest of the period. If you believe you were charged in error, email hello [at] spellwarden [dot] ai with your Creem order ID, and we resolve it with you through Creem.

13. No warranty

The service is provided "as is" and "as available". Scans, policy packs and evals reduce risk; they cannot find every problem, and a skill or server that passes can still be unsafe. You remain responsible for what your agents load and do. To the extent permitted by law, NETBEARS TEAM SRL gives no express or implied warranties, including merchantability, fitness for a particular purpose, accuracy or completeness of results, or uninterrupted or error-free availability. Nothing in this section limits rights you have under mandatory consumer law.

14. Limitation of liability

Spellwarden is software that checks the skills and servers you submit and prepares findings and results you must review before relying on them. It is a tool, not professional advice. To the maximum extent permitted by law, NETBEARS TEAM SRL is not liable for indirect, incidental or consequential damages arising from use of the service. Nothing in these terms excludes liability that cannot be excluded under mandatory law, including consumer protection law that applies to you.

15. Suspension and termination

We may suspend an organisation or an account that breaches acceptable use, or terminate it, with notice where practical. You may stop using the service, or delete your account or organisation (see below), at any time.

16. Deleting an account or an organisation

You can delete your account in the app at any time, unless you are the only owner of an organisation that has other members (make someone else an owner first) or you belong to a suspended organisation. Organisations you own alone are deleted with your account.

An owner can delete an organisation. For one day after the deletion, an owner can restore it; after that it stays closed, and its URL name is never given to another organisation. What we keep after a deletion is set out under retention in our privacy policy.

17. Links to third-party sites

The service links to third-party sites (for example Creem's checkout pages, our booking page, or ANSPDCP and ANPC). We are not responsible for the content or practices of sites we do not operate.

18. Changes to the service

We may add, change or remove features as the product evolves. We will not remove a feature that your organisation's plan lists during a period it has already paid for.

19. Changes to the terms

We may update these terms from time to time. The date at the top of this page is when they were last updated; continued use after a change means you accept the update.

20. Governing law and jurisdiction

These terms are governed by the laws of Romania and, where applicable, European Union law. Any dispute not resolved informally, and not subject to the consumer options in consumer protection below, is subject to the exclusive jurisdiction of the courts of Romania.

21. Consumer protection

If you are a consumer under applicable law, mandatory consumer-protection rights in your country of residence apply regardless of this section. You may raise a complaint with ANPC (the Romanian National Authority for Consumer Protection) (https://anpc.ro/) or use ANPC's SAL (alternative dispute resolution) service (https://anpc.ro/ce-este-sal/).

22. Right of withdrawal

If you subscribe as a consumer in the EU, you have 14 days from the start of a paid subscription to withdraw from it without giving a reason, by emailing hello [at] spellwarden [dot] ai. The service starts as soon as you subscribe, at your request, so if you withdraw we refund what you paid less a proportionate amount for the days the paid subscription was active. Business customers have no statutory right of withdrawal.

23. Contact details

Company

NETBEARS TEAM SRL

Trade Register

J2017000687229

EUID

ROONRC.J2017000687229

VAT ID

RO37261366

Address

Corneliu Baba 8, Iași, Romania

Phone

+40 742 121 246

Email

hello [at] spellwarden [dot] ai