Published: October 2026
Terms of Service
Effective: October 2026
These Terms of Service (“Terms”) govern access to and use of the website, software, platform, products and services made available by Akto IO, Inc., a Delaware corporation (“Akto”, “Company”, “we”, “us” or “our”). Akto owns and operates a subscription-based cybersecurity and AI security platform designed to assist customers in securing applications, APIs, infrastructure and enterprise environments (“Software”). The Software, related support, maintenance, updates, documentation and platform-related services made available under an applicable Order Form are the “Services”. Unless expressly agreed in an Order Form, Services exclude professional services, managed services, implementation, custom development, consulting and customer-specific deliverables.
By affirmatively accepting these Terms, creating or using a Software account, or accessing the Services, you agree to these Terms and the applicable Order Form. Mere browsing of the public website is subject only to provisions relevant to website use, such as intellectual property, permitted use, disclaimers and applicable law; it does not by itself create a paid subscription or impose subscription fees. If you act on behalf of an organization, you represent that you are authorized to bind it; “Customer” or “you” then refers to that organization. A subscription order form, online checkout, subscription form, or other ordering document accepted by Akto is an “Order Form”.
IMPORTANT: If Akto and Customer have executed a separate Master Subscription Agreement, Master Services Agreement or other written agreement governing the same Software or Services, that signed agreement (including its own precedence provisions) controls in the event of conflict with these Terms. These Terms do not amend an existing signed agreement. The Akto Privacy Policy describes privacy practices for website and other relevant activities; where Akto processes Personal Information on Customer’s behalf, the applicable Data Processing Addendum (“DPA”) governs such processing as stated below.
1.1 During the subscription term stated in an applicable Order Form (“Subscription Term”), and subject to payment of applicable subscription fees and compliance with these Terms, Documentation and the Order Form, Akto grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Software and Services solely for Customer’s internal business purposes. No rights are granted beyond the purchased subscription scope.
1.2 Customer may permit its employees, contractors, agents and representatives authorized by Customer (“Authorized Users”) to access the Services on its behalf. Customer is responsible for their acts, omissions, account security and compliance with these Terms.
1.3 Unless the Order Form states otherwise, part of the Software may be deployed in Customer’s cloud infrastructure. Customer is responsible for maintenance, security and configuration of its cloud environment, systems, networks, integrations, credentials, controls and access. Customer shall promptly inform Akto of unauthorized use of its accounts or the Services.
1.4 Akto will use commercially reasonable efforts to make the Services available as described in the Order Form and may perform scheduled or emergency maintenance, patches, updates, upgrades or modifications; Akto will use commercially reasonable efforts to minimize resulting disruption.
1.5 Free, evaluation, trial or beta access, if offered, may be limited in duration, features and availability, may be terminated at Akto’s discretion subject to applicable law and any express written commitment, and does not constitute a commitment to furnish a paid subscription. Unless expressly agreed in writing, no service level commitment applies to such access.
2.1 Customer shall provide information, lawful access, materials and permissions reasonably necessary for use of the Services and is solely responsible for accuracy, quality, integrity, legality and completeness of Customer Data, credentials, systems and instructions supplied or made available to Akto.
2.2 Customer is responsible for obtaining all required rights, notices, consents, permissions, authorizations and lawful bases under applicable law for Akto to access and process Customer Data and Personal Information as contemplated by these Terms and the applicable DPA, including processing for provision, support, security, maintenance, improvement, testing, validation, evaluation and development of the Software, Services and AI Technology to the extent permitted herein.
2.3 Customer shall independently review, validate and determine whether to act upon Software outputs, alerts, findings, reports and recommendations. These assist Customer’s security review and decision-making; they do not replace independent judgment or Customer’s security, compliance or operational responsibilities.
3.1 Customer and Authorized Users shall not, directly or indirectly: (a) reverse engineer, decompile, disassemble or attempt to discover source code, algorithms or underlying structure except to the limited extent prohibitions are unenforceable under law; (b) modify or create derivative works from the Software or Services except as expressly authorized; (c) provide the Software or Services for timesharing, service bureau, outsourcing, resale or third-party benefit; (d) remove proprietary notices; (e) distribute, resell, sublicense, lease or make the Services available to unauthorized third parties; (f) interfere with system integrity, security or performance, introduce malware or unauthorized tools, or circumvent technical limits; or (g) use the Services in violation of applicable law, sanctions, export controls or prohibited end-use restrictions.
3.2 Customer shall not use the Software, Services, Documentation, outputs, findings, reports, alerts, recommendations, APIs or other materials generated through the Services to train, tune, test, benchmark, validate, improve or develop any competing cybersecurity product, AI model, machine-learning system, vulnerability detection tool or similar technology without Akto’s prior written consent.
4.1 “Customer Data” means information, logs, content, files, materials, prompts, queries, configurations, API, application, security, vulnerability, scan or test data, and other information submitted, transmitted, scanned, tested or otherwise made available by or for Customer or Authorized Users through the Services, including Personal Information, if any. “Personal Information” means information relating to an identified or identifiable individual as defined by applicable privacy law. Customer retains ownership of Customer Data.
4.2 “Usage Data” means technical, statistical, diagnostic, telemetry, performance or usage-related data generated by access to or use of the Services, including feature usage, session activity, performance data, error logs, license consumption, product analytics and support metadata. “Derived Data” means data, metadata, analytics, statistics, insights, signatures, patterns, indicators, learnings, threat intelligence, security rules, detection logic, performance data and other information generated, inferred, developed or derived by or on behalf of Akto from Customer Data, Usage Data or use of the Services. “AI Technology” includes artificial intelligence, machine learning, large language models, AI inputs and outputs, prompts, model parameters, training pipelines, evaluation datasets and associated technologies used, developed, trained, tuned, tested, validated or improved by or for Akto in connection with the Services.
4.3 Each party shall comply with applicable privacy, data protection and data security laws. Akto shall implement reasonable and appropriate administrative, technical and organizational measures designed to protect Personal Information and Customer Data within its possession or control against unlawful loss, unauthorized access or disclosure as required by applicable law and the DPA.
4.4 Subject to applicable law and the DPA, Akto may collect, receive, access, copy, transmit, host, store, retain, analyze, scan, test, derive from and otherwise process Customer Data and Personal Information as reasonably necessary to: (a) provide, operate, support, secure, maintain, monitor and improve the Software and Services; (b) identify, detect, validate, prioritize, report and assist with remediation of vulnerabilities, threats, API issues, misconfigurations and security findings; (c) train, tune, test, validate, evaluate, retrain, optimize and improve AI Technology and other components for the purpose of providing, securing, supporting or improving the Software and Services to Customer; (d) create, use, retain and process Usage Data, Derived Data, security intelligence, analytics, product improvement and related internal business materials; and (e) comply with law, legal process, audit, backup, archival, dispute resolution and regulatory requirements.
4.5 Akto shall not disclose Customer Data in raw identifiable form except as permitted under these Terms, the applicable DPA or applicable law. The foregoing is not a blanket authorization to use identifiable Customer Data to train public general-purpose AI models for unrelated purposes. Akto’s processing of Personal Information shall be restricted by applicable law, its role as processor/service provider where relevant, documented instructions and the DPA.
4.6 Where Akto processes Personal Information on behalf of Customer, the parties’ separately executed DPA applies; absent such separately executed DPA, Akto’s standard DPA at https://www.akto.io/terms/dpa, as of the effective date of the applicable Order Form, is incorporated by reference. If DPA and these Terms conflict with respect to processing of Personal Information, the DPA prevails solely as to that conflict. The Privacy Policy at https://www.akto.io/terms/privacy addresses applicable website and other privacy practices but does not replace the DPA.
4.7 Akto may use Usage Data, Derived Data, aggregated or de-identified information, security intelligence and other Akto intellectual property as permitted under these Terms, subject to applicable privacy law and the DPA. No provision transfers Customer’s ownership of Customer Data to Akto.
5.1 The Services may interoperate with third-party hosting, cloud platforms, APIs, repositories, CI/CD tools, identity providers, integrations and AI-related technology (“Third-Party Services”). Customer’s use of independently contracted Third-Party Services may be subject to their separate terms.
5.2 To the extent caused by Customer infrastructure, credentials, configurations, integrations, Authorized Users, Third-Party Services, unauthorized modifications, misuse, failure to follow Documentation or Customer acts or omissions, Akto shall not be responsible for resulting unavailability, errors, security incidents, unauthorized access or other failures, except to the extent directly attributable to Akto’s breach of these Terms, applicable law or the DPA.
6.1 Customer shall pay subscription and other expressly agreed fees in accordance with the applicable Order Form. Except where expressly provided in these Terms or the Order Form, committed subscription fees are non-cancellable and non-refundable, and the full committed fees for the Subscription Term remain payable.
6.2 Unless the Order Form specifies otherwise, payment is due within fifteen (15) days from issuance of the invoice. Overdue undisputed amounts may bear interest of 1.5% per month, or the maximum permitted by law, whichever is lower.
6.3 Where Customer requires an invoicing portal, purchase order or onboarding process, Akto will use commercially reasonable efforts to comply when Customer timely supplies the necessary access and instructions. Customer-side portal issues, missing or delayed purchase orders, internal approvals or administrative processing do not extend payment due dates unless the delay results from Akto’s material invoicing error.
6.4 Customer must notify Akto in writing of a bona fide invoice dispute within ten (10) days from issuance, specifying the disputed amount and reasonable basis. The parties will attempt prompt resolution; undisputed portions remain payable on time.
6.5 Payments, including any legally required deduction or withholding, shall be subject to applicable tax laws. Applicable sales, use, VAT or similar transaction taxes will be addressed in the Order Form and invoiced as required by law, excluding taxes imposed on Akto’s net income.
6.6 If undisputed subscription fees remain unpaid for fifteen (15) days after their due date, Akto may suspend access after an additional seven (7) days’ prior written notice, until all outstanding undisputed amounts are paid.
7.1 Akto shall provide technical support under its then-current Akto Customer Services Support Resource Guide available at https://www.akto.io/terms/supportguide (“Support Guide”), unless different terms are expressly specified in the applicable Order Form. Akto may update the Support Guide, provided that updates shall not materially reduce support commitments expressly agreed in an active Order Form.
7.2 Any response, resolution, uptime, availability, or other service-level target or commitment is governed by the Support Guide or applicable signed Order Form. Where service credits are expressly specified as the sole and exclusive remedy for a defined service-level failure, they shall be the sole and exclusive remedy for that failure; this shall not independently expand termination rights.
8.1 Akto retains all right, title and interest in the Software, Services, Documentation, Usage Data, Derived Data, AI Technology and all related intellectual property, models, algorithms, modifications, upgrades, templates, methodologies, workflows, improvements, security intelligence, rules, signatures, detection logic, technology, trademarks and know-how, excluding Customer Data.
8.2 Customer owns Customer Data and may use customer-specific outputs, security findings and reports generated through the Services for its internal business purposes, subject to Akto’s underlying intellectual property rights. No rights in Akto intellectual property transfer merely because it was generated, trained, tuned, improved or informed using Customer Data or Customer’s use of the Services.
8.3 Customer grants Akto a limited, non-exclusive, worldwide, royalty-free license to access, use, host, copy, transmit, process, display, store, retain, analyze, scan, test, derive from and otherwise process Customer Data for purposes permitted by these Terms, the Order Form, the DPA and applicable law.
8.4 Akto may use suggestions, corrections, feature requests, recommendations and other feedback about the Services without restriction or obligation, provided this does not independently authorize disclosure of Customer Data in breach of the DPA or confidentiality obligations.
8.5 Except as expressly set out, no license or right is granted by either party by implication, waiver, estoppel or otherwise.
9.1 “Confidential Information” includes non-public business, technical, commercial, financial, product, security, operational, software and other information disclosed by one party to the other that is marked confidential or reasonably should be regarded as confidential given its nature or context.
9.2 During the Subscription Term and for three (3) years thereafter, the receiving party shall protect Confidential Information with at least reasonable care, use it only as reasonably necessary to perform, receive or exercise rights under these Terms, and disclose it only to Affiliates, employees, contractors, advisors, auditors, investors, counsel and service providers who need to know and are bound by appropriate confidentiality obligations.
9.3 Confidential Information excludes information the receiving party can demonstrate: (a) became public without its breach; (b) was lawfully known before disclosure; (c) was lawfully received without confidentiality restriction from a third party; (d) was independently developed without use of the disclosing party’s information; or (e) must be disclosed under law, subject where permitted to reasonable prior notice. Trade secrets remain protected to the extent and for the duration required by applicable trade secret law; Personal Information remains subject to the applicable DPA and law irrespective of the general three-year period.
10.1 Each party represents it has authority to enter these Terms and applicable Order Forms, will not thereby violate binding third-party obligations, and will comply with laws applicable to its performance.
10.2 Akto warrants that it will provide the Services in material accordance with these Terms, the applicable Order Form and laws applicable to Akto’s provision of the Services. Service-level obligations remain governed exclusively by Section 7.
10.3 Customer represents it has the rights, permissions, notices and lawful bases needed to provide Customer Data and instructions for processing as permitted herein and under the DPA. Each party shall comply with applicable anti-bribery, anti-corruption, anti-money-laundering, sanctions and export-control laws. Customer shall not use, export, re-export, transfer or provide access to the Software or Services in violation of applicable sanctions, export control laws or trade restrictions, or for any prohibited end use.
11.1 Software and Services can experience errors, limitations and interruptions. Akto does not warrant uninterrupted or error-free operation or any particular result. Except for express warranties in these Terms or the Order Form, the Services are provided “AS IS” and “AS AVAILABLE”, and Akto disclaims implied warranties of merchantability, fitness for a particular purpose and non-infringement to the maximum extent permitted by law.
11.2 AI-assisted, automated and security-related results may be probabilistic, inaccurate, incomplete or fail to identify vulnerabilities, risks, threats or other issues. Akto does not warrant that all issues will be found or that Customer systems will be secure, compliant or immune from attacks. Customer shall not treat outputs as the sole basis for material security, legal, compliance, operational or business decisions and remains responsible for verification and remediation.
12.1 Customer Indemnity. Customer shall defend, indemnify and hold harmless Akto and its Affiliates, directors, officers, employees, agents, successors and permitted assigns against direct third-party claims, liabilities, losses, damages and reasonable attorneys’ fees arising out of or relating to: (a) Customer Data, systems, instructions or Akto’s processing thereof in accordance with these Terms, DPA or Customer instructions; (b) allegations that such data, systems or instructions infringe third-party rights, violate privacy or data protection rights, contractual restrictions or law; (c) unauthorized access attributable to Customer acts, omissions, systems, configurations, credentials or Authorized Users; (d) Customer’s violation of law; or (e) Customer’s breach of confidentiality obligations, except to the extent caused by Akto’s breach of these Terms, the DPA or applicable law.
12.2 Akto Indemnity. Akto shall defend, indemnify and hold harmless Customer and its Affiliates, directors, officers, employees, agents, successors and permitted assigns against direct third-party claims and reasonable associated losses and expenses alleging that the Software or Services, as provided by Akto and used in accordance with these Terms, infringe or misappropriate third-party intellectual property rights. Akto has no obligation to the extent the claim arises from: (a) Customer Data, systems, instructions or materials; (b) modifications not authorized by Akto; (c) use contrary to these Terms, Order Form or Documentation; (d) combination with products, services, data, systems or technology not furnished by Akto where infringement would not otherwise have occurred; or (e) Third-Party Services.
12.3 The indemnified party shall promptly give written notice of a claim, reasonably cooperate at the indemnifying party’s expense, and permit the indemnifying party to control defense and settlement. Late notice relieves obligations only to the extent materially prejudicial. No settlement may admit fault or impose non-monetary obligations on the indemnified party without its prior written consent, not unreasonably withheld.
12.4 If an IP infringement claim concerns the Services or appears likely, Akto may, at its option and expense, use commercially reasonable efforts to procure continued use rights or modify or replace the affected functionality with substantially similar non-infringing functionality. This Section 12 states Akto’s sole liability and Customer’s exclusive remedy for IP infringement claims relating to the Services, subject to applicable non-waivable law and Section 13.
13.1 Except with respect to Customer’s payment obligations, either Party’s gross negligence, willful misconduct or fraud, in no event shall either Party’s total aggregate liability arising out of or relating to these Terms, any Order Form, the Software or Services, whether in contract, tort, negligence, indemnity, statute or otherwise (including claims arising from data breaches, security incidents, confidentiality or data protection obligations), exceed the total Subscription Fees paid or payable by Customer during the twelve (12) months immediately preceding the event giving rise to the claim. This constitutes a single aggregate cap for all claims and not a separate cap for each claim.
13.2 Neither party shall be liable for special, indirect, incidental, punitive, exemplary or consequential damages, including loss of data, use, profit, revenue, goodwill, business interruption or failure of security mechanisms, even if informed of the possibility. Nothing excludes liability to the extent exclusion is prohibited by law.
13.3 For free or trial Services with no subscription fees paid or payable, the fee-based cap in Section 13.1 may be zero, to the maximum extent permitted by applicable law; this does not limit liabilities that cannot lawfully be excluded.
14.1 These Terms apply while Customer accesses the Services and, for a paid subscription, for the applicable Subscription Term. Renewal requires mutual written agreement unless the applicable Order Form expressly provides otherwise; no automatic renewal is implied by these Terms.
14.2 Either party may terminate an applicable Order Form if the other materially breaches its obligations and fails to cure within thirty (30) days following reasonably detailed written notice; if the other becomes subject to bankruptcy, insolvency, receivership or similar proceedings, or makes an assignment for benefit of creditors; or for material violation of applicable law that is not cured within that period, except where the breach is incapable of cure or law requires immediate termination. A material breach substantially deprives the other party of the core agreement benefits. Minor or isolated breaches, temporary interruptions or failure to meet support, response, resolution, uptime or availability targets shall not alone constitute material breach; Section 7 governs service levels. These Terms and the applicable Order Form may not otherwise be terminated by Customer prior to the end of the applicable Subscription Term.
14.3 Akto may suspend access if (a) Customer fails to pay undisputed fees subject to Section 6.6; (b) Customer materially violates permitted-use restrictions; (c) continued access presents a credible security, legal or operational risk to Akto, Customer, other customers or third parties; or (d) law requires suspension. Akto will provide notice when reasonably practicable, except where immediate action is necessary.
14.4 On expiry or termination, Customer access rights cease, undisputed accrued or payable fees become due, accrued rights survive and provisions intended to survive remain effective.
14.5 Customer may request export of Customer Data held by Akto within thirty (30) days after expiry or termination. Thereafter, Akto may delete Customer Data under its retention/deletion practices and the DPA, subject to applicable legal, regulatory, security, backup, archival and audit requirements. Akto is not required to delete Usage Data, Derived Data, AI Technology or other Akto intellectual property, subject to applicable law and the DPA.
15.1 Akto may use Customer’s name, logo and testimonials in customer lists, on its website and in marketing materials or case studies unless Customer objects in writing, subject to applicable law and any separately negotiated written publicity restriction. Akto shall not disclose confidential Customer information merely by exercising this right.
16.1 These Terms and disputes relating to them or the Services shall be governed by Delaware law, excluding conflict-of-law principles. The state and federal courts located in Delaware shall have exclusive jurisdiction, subject to applicable mandatory law.
17.1 A separately signed master agreement governing the same Services controls over these Terms in case of conflict, with the signed agreement’s own order-of-precedence rules applying. For subscriptions without such an agreement, the order is: (a) mutually signed amendment/addendum to the extent of a specific conflict; (b) DPA solely as to Personal Information processing; (c) these Terms; (d) applicable Order Form, except that expressly specified subscription-specific commercial terms, quantities, scope, fees, dates, and payment schedule in the Order Form take precedence over default values in these Terms; and (e) referenced policies and Documentation. Customer purchase order, procurement portal and onboarding terms have no effect unless expressly agreed by Akto in writing.
17.2 No publicly posted revision of these Terms modifies a signed MSA or an active subscription’s negotiated rights in a manner inconsistent with that signed agreement.
18.1 Akto may update these Terms by posting a revised version and date on its website. Material changes will apply prospectively; changes will not materially reduce rights expressly agreed for an active paid Subscription Term absent Customer consent or legal necessity. For a new subscription or renewal, the version applicable on the relevant acceptance or effective date governs unless expressly agreed otherwise.
18.2 Continued use after the effective date of updated Terms may constitute acceptance where legally valid and where clear notice and an appropriate acceptance opportunity have been provided. Mere website posting does not override an existing signed agreement.
19.1 Neither party may assign these Terms without the other’s prior written consent, not unreasonably withheld, delayed or conditioned. Either may assign without consent to an Affiliate or in a merger, reorganization, change of control or sale of all or substantially all assets, provided the assignee assumes its obligations. Any prohibited assignment is void to the extent permitted by law.
20.1 Neither party is responsible for delayed or failed performance caused by events beyond reasonable control, including natural disasters, changes in law, embargoes, war, terrorism, riots, fires, floods, outages, strikes, ISP failure or third-party technology provider failures.
20.2 Force majeure does not excuse Customer payment obligations, confidentiality, applicable data protection law or DPA duties, or commercially reasonable safeguards required under these Terms. A cyberattack, data breach, security incident or third-party failure qualifies only if beyond the affected party’s reasonable control and not caused by its gross negligence, willful misconduct, material breach or failure to maintain commercially reasonable safeguards.
21.1 Notices. Formal contractual notices shall be in writing, including by email, sent to the notices contact identified in the applicable Order Form or another address designated by notice; Customer notices to Akto may be sent through Akto’s published legal contact channel or other address expressly designated by Akto for legal notices. A notice is effective upon actual receipt. Ordinary support tickets do not constitute formal termination notices unless expressly acknowledged as such.
21.2 No waiver arises from conduct or inaction; an enforceable waiver must be in writing signed by the party granting it. Invalid or unenforceable terms shall be modified to the minimum extent necessary, with the remainder remaining effective.
21.3 The parties are independent contractors and do not create an agency, partnership, joint venture, fiduciary or employment relationship. Headings are for convenience only.
21.4 These Terms together with applicable Order Forms, incorporated DPA and referenced policies form the agreement regarding the Services only where there is no separate signed governing agreement. A separate signed agreement takes precedence under Section 17. The Privacy Policy is an applicable notice, not a substitute for contractual data-processing obligations.
21.5 Terms relating to accrued payment obligations, ownership and licensing of intellectual property, Customer Data and Derived Data as legally applicable, confidentiality, data protection, disclaimers, indemnity, liability, exclusion of damages, governing law, dispute resolution, and other terms intended by their nature to survive shall survive expiration or termination.
21.6 Website users and customers may contact Akto through the contact details published at https://www.akto.io/terms-and-policies or through other Akto-designated legal or support channels. Any mandatory grievance redressal information required by applicable law shall be separately maintained and prominently disclosed.
Akto IO, Inc. · Terms of Service ·