Service terms

1. Your agreement

These terms cover the CyberRouter website, console and routing API. By expressly accepting them during registration or when connecting a provider key, you agree to these terms for your use of the service. If you act for an organization, you confirm that you may enter this agreement on its behalf. Do not accept if you lack that authority or legal capacity.

Use CyberRouter only for lawful activities and with permission to access the systems, accounts, keys and content involved. You remain responsible for checking model outputs and for deciding whether a model is suitable for your use. An AI response is not a guarantee of accuracy, security, legality or fitness for a particular decision.

2. Connecting your own provider keys

A provider key authorizes requests against your account with an upstream service. It is different from a CyberRouter account key, which authenticates your applications to this gateway. Only connect keys that you own or have permission to use through CyberRouter, consistently with the upstream provider's terms.

When you connect a key, you authorize CyberRouter to receive it, encrypt it for storage, and decrypt and use it on the server to authenticate requests made through your account to that provider. If that provider is another router, its own downstream processing also applies. This is server-side credential custody, not a system in which only your device can read the key.

Stored provider keys are encrypted at rest and management responses return masked metadata. Encryption reduces risk; it does not make theft impossible or protect plaintext while a compromised application is using it. We will use reasonable safeguards for credentials in our care. Nothing in these terms excuses a failure to perform our contractual or mandatory security duties.

Disconnecting or revoking a connection in CyberRouter stops new gateway use of that connection. It does not invalidate the original key at the provider, reverse completed charges, recall a request already sent, or promise immediate removal from backups or retained encrypted records. To invalidate the original key everywhere, revoke or rotate it in the provider's own console.

3. Protecting your account and controlling spend

You are responsible for protecting your provider keys, CyberRouter API keys, passwords and account access, including access through your devices, repositories, applications and people you authorize. Connecting a provider key to CyberRouter does not transfer those responsibilities to us. Use dedicated provider keys with the narrowest permissions and provider-side spend limits available. Never paste keys into chat messages, support tickets or public code.

You authorize charges generated by requests you or people and applications you authorize make through your account. You are responsible for losses and unauthorized charges caused by your disclosure, misuse or failure to secure credentials or account access under your control, subject to applicable law. You do not assume responsibility for a loss to the extent caused by CyberRouter's breach of its obligations.

The upstream provider bills its API usage separately. CyberRouter credits cover CyberRouter fees, not your provider's bill. A CyberRouter balance or request limit does not cap spending through the same key outside CyberRouter. Provider budgets, access controls and alerts may have their own limitations; verify them with that provider.

BYOK does not include theft insurance or a guarantee to reimburse unauthorized provider charges. A report that a key was lost, exposed or misused does not by itself establish a right to reimbursement from CyberRouter. Any claim is assessed under these terms and applicable law, including our own obligations and rights that cannot lawfully be waived.

4. Suspected compromise and disputed usage

If you suspect misuse, promptly revoke or rotate the affected key at its issuer, disable the CyberRouter connection and contact us through the security-report link below. Include relevant request IDs, provider name, approximate times with a time zone, and redacted usage or billing records. Never send the secret key itself. Preserve relevant records and take reasonable steps to prevent further loss.

We may temporarily restrict an affected connection or account while investigating a credible security concern. We will assess available evidence and provide notices required by law. A billing spike alone does not establish where a credential was exposed, and our logs alone are not conclusive proof against you. A good-faith report does not waive your rights or require you to prove the cause before we consider it.

Report facts accurately. These terms do not penalize a good-faith complaint, prohibit contacting regulators, or prevent either party from bringing a claim or seeking urgent relief where entitled to do so.

Report a security concern without including secret keys.

5. Providers, content and billing

Your chosen providers set their own usage rules, prices and data practices. You must comply with the agreements that apply to your provider account. Routing through CyberRouter does not expand your upstream permissions. We do not guarantee a provider's continuing availability or its handling of requests, and remain responsible for our own obligations.

You retain your rights in your inputs. Rights in model outputs depend on the provider's terms and applicable law. You permit the processing needed to route your requests and deliver responses. Optional content sharing is a separate choice described in our privacy information; agreeing to these terms does not turn it on.

The linked billing policy and the price accepted at checkout govern purchases and cancellation. Acceptance here does not authorize a subscription: automatic renewal requires separate checkout consent. Mandatory refund and consumer rights remain available.

Read the billing and cancellation policy, privacy information and copyright reporting procedure.

6. Service limits

Except for our express commitments and protections required by law, the service is supplied on an as-available basis without implied warranties of merchantability, suitability for a particular purpose or non-infringement. We do not promise uninterrupted operation, error-free outputs or immunity from security incidents. This disclaimer does not override our stated security commitments or rights that the law makes non-waivable.

7. Limits on liability

Where legally permitted, CyberRouter is not liable for indirect or consequential losses, lost profits or business opportunities arising from the service. For claims that may lawfully be capped, our total liability for the events giving rise to the claim is limited to the larger of US$100 and the fees you paid for CyberRouter during the preceding 12 months. Payments to upstream providers are not fees paid for CyberRouter.

These restrictions do not apply to fraud, deliberate misconduct, gross negligence, death or personal injury caused by negligence, or liability and remedies that applicable law does not allow us to exclude or limit. They do not prevent required refunds, security-incident notices or statutory data-protection remedies. A disputed key-compromise claim is assessed on its facts; these terms do not declare CyberRouter faultless merely because a key was supplied by you.

8. Third-party claims involving business users

If you use CyberRouter for business, you will reimburse reasonable damages and defense costs awarded or agreed in settlement of a third-party claim to the extent caused by your unlawful use, unauthorized use of another person's key or content, or material breach of these terms. This duty does not cover losses caused by our breach, negligence or misconduct, and does not apply to your own good-faith claim against us.

We must notify you reasonably promptly and allow you a reasonable opportunity to participate in the defense. Neither party may settle a claim in a way that admits liability for, or imposes obligations on, the other without that party's written agreement.

9. Changes, records and contact

We keep the terms version, a fingerprint and copy of the accepted text, the acceptance time and its account or connection reference. These records do not contain your provider secret. Acceptance of a later version does not retroactively waive a claim about an earlier incident.

Material changes will be presented for review and acceptance before we rely on them for a new registration or provider-key connection, with any additional notice required by law. A separate written agreement may vary these terms. If a provision is unenforceable, the remaining provisions apply to the extent the law permits.

Contact us using the links below for support, a dispute, or an account-closure request. You may also use any court, regulator or other remedy available under applicable law; these terms do not impose an arbitration requirement or a foreign forum.