These Terms of Service (the “Terms”) govern access to and use of the OryxGate platform, website, dashboard and API gateway (together, the “Services”) provided by Surfbase Tech L.L.C-FZ, a company licensed in the Meydan Free Zone, Dubai, United Arab Emirates, with its registered address at Meydan Free Zone, Dubai, United Arab Emirates (“OryxGate”, “we”, “us”). By creating an account or using the Services on behalf of an organization (the “Customer”, “you”), you confirm that you are authorized to bind that organization and that it accepts these Terms. The Services are offered to businesses only and not to consumers.
1. The Services
OryxGate is an enterprise AI governance application. It sits between your users and the AI models they use and provides data loss prevention (secret and personal-data redaction), spend governance (budgets, limits and alerts), audit logging, analytics and a prompt-caching layer (together, the “Platform”). The Platform is offered in two plans:
- FinOps & Security Platform (Bring Your Own Key, “BYOK”). You connect your own accounts with model providers such as Amazon Web Services (Amazon Bedrock), Anthropic or OpenAI (“Model Providers”). The Platform applies its controls and then submits your requests to those accounts on your behalf. Inference is provided to you by the Model Provider under your own agreement with it, and the Model Provider bills you directly.
- Managed Enterprise Cloud. For customers who do not wish to operate their own provider accounts, the Platform includes a managed inference pipeline operated by OryxGate on cloud infrastructure, consumed through prepaid compute credits. Managed Cloud is a component of the Platform and may be used only through the Platform for your internal business purposes.
Model outputs are generated by the underlying models, not by OryxGate. Model availability, regions and capabilities may change as Model Providers change their offerings, including deprecations announced by them.
2. Your provider credentials (BYOK)
- You authorize OryxGate to store the credentials you connect and to use them solely to submit your organization's requests to the corresponding Model Provider.
- Credentials are encrypted at rest (AES-256-GCM), are never displayed again after entry, are not logged and are not used for any other customer.
- You remain responsible for your provider accounts, including their terms, usage policies, quotas, charges and the scope of permissions you grant. We recommend least-privilege credentials limited to model inference.
- You may remove credentials at any time; removal takes effect for new requests immediately.
3. Accounts and API keys
- You are responsible for all activity under your organization and API keys, and for keeping keys confidential.
- Revoke compromised keys immediately from the dashboard. Usage incurred before revocation is chargeable.
- Spend limits you configure are enforced on a best-efforts basis per request; a request in progress when a limit is reached may complete and be charged.
4. Acceptable use
You must comply with applicable law and with the usage policies of the Model Providers whose models you use, which are incorporated by reference. You must not:
- use the Services for unlawful, harmful, fraudulent or abusive purposes, or to generate content prohibited by a Model Provider’s policies;
- resell, sublicense or make the Platform or the Managed Enterprise Cloud available to third parties, or use it to offer general access to AI models;
- attempt to circumvent spend limits, rate limits, security controls or billing;
- use the Services from, or for the benefit of persons in, jurisdictions where Model Providers do not offer their services, or in breach of sanctions or export-control laws;
- submit special categories of personal data or health data unless you have a lawful basis and appropriate safeguards.
We may suspend access immediately where reasonably necessary to prevent harm, comply with law or a Model Provider requirement, or address non-payment.
5. Fees and payment
- FinOps & Security Platform: a recurring subscription fee (currently USD 99 per organization per month) billed in advance through our payment processor (Stripe). Usage of your own provider accounts is billed by your Model Provider, not by OryxGate. If a usage-based platform fee applies to BYOK traffic, it is shown in your dashboard and debited from your prepaid balance.
- Managed Enterprise Cloud: prepaid compute credits consumed at the published per-token rates for the model and route used, which include the platform fee shown in the dashboard (default 20%) unless otherwise agreed in writing.
- Balances are accounted in US dollars. Amounts in UAE dirhams are converted at the UAE Central Bank peg of USD 1 = AED 3.6725.
- Compute credits may be purchased by card or by bank transfer against an invoice. Bank-transfer credits are applied once funds are received and reconciled. Bank charges are borne by the payer.
- Prices exclude VAT and other taxes, which are added where applicable under UAE law.
- Subscriptions renew automatically until cancelled in the billing portal; cancellation takes effect at the end of the paid period. Compute credits are non-refundable and non-transferable except where required by law or on termination by us without cause, in which case the unused balance is refunded. Credits expire 24 months after purchase.
- If your compute-credit balance becomes negative (for example because a streaming response completes after a limit is reached), you agree to pay the shortfall.
6. Customer data
You retain all rights in the prompts, files and other inputs you submit and in the outputs you receive (“Customer Content”), subject to Model Provider terms. OryxGate processes Customer Content solely to provide the Services, acts as your processor for personal data contained in it, and does not store prompt or completion content, except transiently in memory while relaying a request. We store usage metadata (such as token counts, model, route, latency and cost) to operate billing and analytics. Our Privacy Policy and, on request, our Data Processing Addendum apply.
7. Regional routing and data residency
You can select an AWS entry region (me-central-1, UAE, or eu-central-1, Frankfurt) and a strict or preferred residency mode for each API key. Model processing locations are determined by the Model Provider and AWS for the selected route; for example, AWS may serve a model from a UAE entry region using its global inference endpoint, in which case processing may occur in other AWS regions. In preferred mode, requests may fail over to other regions or accounts you have configured, and, if you enable it, to the Managed Enterprise Cloud. You are responsible for selecting settings appropriate to your regulatory obligations.
8. Secret and PII redaction
Optional redaction uses pattern matching to mask common secrets and identifiers. It reduces, but does not eliminate, the risk of disclosure and is not a substitute for your own data-handling controls.
9. Availability and support
We aim for high availability and use automatic failover across routes, but the Services depend on Model Providers and infrastructure outside our control and are provided without a service-level commitment unless agreed in a separate order.
10. Intellectual property
OryxGate and its licensors own the Services, software and documentation. We grant you a non-exclusive, non-transferable right to use the Services during the term for your internal business purposes. Feedback you provide may be used without restriction.
11. Warranties and disclaimers
The Services and all model outputs are provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all implied warranties, including fitness for a particular purpose and accuracy of outputs. You are responsible for reviewing outputs before relying on them.
12. Limitation of liability
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data. Our aggregate liability arising out of or relating to the Services is limited to the fees you paid to us in the twelve months before the event giving rise to the claim. These limits do not apply to fraud, wilful misconduct, or your payment obligations.
13. Indemnity
You will defend and indemnify OryxGate against third-party claims arising from your Customer Content, your use of outputs, or your breach of these Terms or of Model Provider policies.
14. Term and termination
These Terms apply while you use the Services. You may close your account at any time. We may terminate for convenience on 30 days’ notice or immediately for material breach. Sections 5 (payment obligations), 6, 10–13 and 15 survive termination. On termination we delete stored provider credentials.
15. Governing law and disputes
These Terms are governed by the laws of the Emirate of Dubai and the applicable federal laws of the United Arab Emirates. Any dispute shall be finally resolved by arbitration under the Arbitration Rules of the Dubai International Arbitration Centre (DIAC), seated in Dubai, in English, by a sole arbitrator. Either party may seek urgent injunctive relief from a competent court.
16. General
We may update these Terms by posting a new version with at least 30 days’ notice for material changes; continued use after the effective date constitutes acceptance. These Terms, together with any order form and the DPA, are the entire agreement between the parties on their subject matter. Contact: support@oryxgate.ai.