Terms of Service

1. Agreement to Terms

By accessing mandatelabs.ai, api.mandatelabs.ai, or dashboard.mandatelabs.ai (together, the “Service”), you agree to these Terms of Service. If you do not agree, do not use the Service.

If you or your organization have executed a Master Service Agreement, Order Form, or other signed agreement with Mandate Labs, that agreement governs your production use of the Service and takes precedence over these Terms wherever they conflict. These Terms govern website use, sandbox access, and any use of the Service not covered by a signed agreement.

2. The Service

Mandate Labs provides the Decision Trust Protocol, a real-time AI agent authorization decision layer. The Service evaluates agent-initiated transactions — across card and crypto settlement contexts — and returns authorization decisions (APPROVE, DECLINE, or STEP_UP) together with trust scoring, risk signals, and reason codes.

The Service is middleware. It does not hold, transfer, or transmit funds, does not take custody of any asset or key, and does not act as a payment processor, card issuer, or money transmitter.

3. Accounts & Access

You are responsible for maintaining the security of your API keys and account credentials. Treat every credential as a secret: do not embed live keys in client-side code or public repositories. You must notify us immediately of any unauthorized access. All activity under your account is your responsibility.

Production access is granted to vetted clients following our onboarding review, and production issuer deployments additionally require completion of Mandate Certified Integration (MCI) before go-live.

4. Sandbox

Sandbox credentials (keys prefixed mdt_test_) exercise the full protocol but never touch real payment rails; no funds move and no real cardholder data may be submitted. The public sandbox playground key is shared infrastructure: we may rotate it, rate-limit it, or reset sandbox data at any time without notice. Do not use the sandbox for load testing without prior coordination, and do not submit production, personal, or confidential data to it.

5. Acceptable Use

Do not use the Service for illegal activity, including transactions that would violate applicable sanctions or anti-money-laundering laws. Do not attempt to reverse engineer the platform, probe or circumvent security controls or tenant isolation, or attempt to access data belonging to another tenant. Do not exceed your contracted rate limits without coordination, interfere with the operation of the Service, or resell access without authorization.

6. API Requirements & Versioning

All authorization requests must include the mandatory intent_context field with a valid intent_type. The API is semantically versioned: deprecated API versions are supported for a minimum of 12 months with 6 months advance deprecation notice, and breaking changes ship only with migration support. Service status and maintenance windows are published at our status page.

7. Authorization Decisions Are Advisory

Authorization Decisions returned by the Service — including scores, zones, signals, and reason codes — are advisory inputs to your own decisioning. You retain sole authority over, and sole responsibility for, your transaction approval decisions, including the configuration of your fail policy. Transactions you approve while the Service is unavailable under a fail-open configuration you have chosen are at your risk. Allocation of liability for production deployments is set out in the applicable signed agreement.

8. Intellectual Property

Mandate Labs owns the Platform, APIs, algorithms, models, documentation, and trust scoring methodologies. You own your data. Anonymized, aggregated data derived from usage is owned by Mandate Labs and used to improve the Service.

If you provide feedback or suggestions about the Service, you grant Mandate Labs a perpetual, irrevocable, royalty-free license to use it without restriction or obligation to you.

9. Confidentiality

Non-public information disclosed by either party in connection with the Service — including pricing, security documentation, and non-public product information — must be protected with at least reasonable care and used only for purposes of the relationship. This obligation does not apply to information that is public, independently developed, or lawfully received from a third party, and it survives termination. Signed agreements may impose more specific confidentiality terms, which control.

10. Fees

Fees are as set out in your Order Form or the published pricing. Late payments accrue interest at 1.5% per month. Fees are exclusive of taxes, which you are responsible for where applicable.

11. Disclaimers & Limitation of Liability

THE SERVICE IS PROVIDED AS IS. To the maximum extent permitted by law, Mandate Labs disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. Mandate Labs does not warrant that any Authorization Decision will detect or prevent any particular fraudulent, erroneous, or unauthorized transaction.

Mandate Labs’ total liability shall not exceed the fees paid during the 12 months preceding the claim. Neither party is liable for indirect, consequential, or punitive damages.

12. Termination

Either party may terminate with 30 days written notice. We may suspend access immediately for breach, non-payment, or security concerns — including credential compromise or activity that threatens the integrity of the platform or other tenants. Your data is available for export for 60 days following termination, after which it is deleted in accordance with our retention schedule.

13. General

These Terms are governed by the laws of the State of Delaware. If any provision is unenforceable, the remaining provisions continue in effect. These Terms, together with the Privacy Policy and any signed agreement, constitute the entire agreement. We may update these Terms with 30 days notice; continued use after the effective date constitutes acceptance.

14. Contact