Terms and Conditions

1. Provider

The Service is provided by RUNTIME GUARD, SASU, SIREN 106 846 777, RCS Paris, with registered office at 1 rue Marguerin, 75014 Paris, France.

In these Terms, "Runtime Guard", "the Company", "we", "us", or "our" means RUNTIME GUARD. "Customer", "you", or "your" means the person, company, legal entity, incorporated DAO, or other organization accessing or using the Service.

You can contact us at contact@runtime-guard.io.

2. Scope of these Terms

These Terms apply to the Runtime Guard website, web application, browser extension, APIs, reports, transaction analysis, co-signing workflows, Lockdown Guard workflows, and any related software or documentation that we make available.

Some enterprise customers may sign a separate order form, statement of work, or negotiated agreement. If that document expressly conflicts with these Terms, the negotiated document controls for that customer and only for the conflicting provision.

3. Service modules

Runtime Guard is non-custodial security software for Safe multisig operations. It is organized into service modules.

3.1 Runtime DeFi Guard

Runtime DeFi Guard analyzes Safe transaction data submitted by you or captured by the browser extension. It may produce technical risk reports, signed reports, verdicts, transaction-context views, and policy checks.

Where you purchase and configure a paid co-signing plan, Runtime DeFi Guard may also add one non-decisive co-signature to a transaction that passes the applicable policy checks.

3.2 Runtime Lockdown Guard

Runtime Lockdown Guard is a separate module for Safe timelock, lockdown, panic-button, recovery, and duress-resistance workflows. It may include smart contracts, app workflows, relayer workflows, passkey or OTP lockdown signers, and verification pages.

Lockdown Guard is designed to slow, freeze, or route certain actions according to your on-chain configuration. It is not a custody, recovery, insurance, key-backup, law-enforcement, or physical-security service.

3.3 Documentation and supported networks

Supported chains, Safe versions, product tiers, report features, co-signing features, lockdown features, limits, and prerequisites are described on the website, in the app, or in the applicable documentation. We may change supported features where needed for security, reliability, legal, or operational reasons.

4. What the Service is not

The Service is software. It does not constitute:

• a wallet, exchange, broker, trading platform, payment service, money transmission service, electronic money service, or crypto-asset custody service;
• investment advice, financial advice, tax advice, legal advice, accounting advice, trading signals, portfolio management, or a recommendation to enter into a transaction;
• insurance, a guarantee, a certification, or a promise that a transaction, Safe, protocol, wallet, or smart contract is safe;
• key custody, key backup, account recovery, loss recovery, or emergency asset recovery;
• a replacement for your own signer governance, operational controls, legal review, tax review, treasury policy, or security review.

You remain responsible for deciding whether to sign, reject, modify, delay, or execute any transaction.

5. Non-custodial architecture

Runtime Guard does not hold, generate, store, or control any private key that is sufficient by itself to access customer assets.

In the DeFi Guard co-signing module, Runtime Guard may hold one cloud KMS/HSM signing key as one signer among several signers configured by you. That key:

• is never sufficient by itself to initiate, authorize, or broadcast a customer transaction;
• is never required for you to transact using your other Safe signers;
• can be removed from your Safe by you without Runtime Guard's consent.

Runtime Guard therefore does not, by itself, constitute a single point of failure for your Safe. You must maintain a Safe threshold and signer set that can operate without Runtime Guard.

In Lockdown Guard, the relayer, app, or backend cannot create a valid lockdown action unless the required on-chain or cryptographic conditions configured for your Safe are satisfied. Runtime Guard cannot override your deployed on-chain module to shorten a timelock, bypass a lockdown, recover your assets, or undo a blockchain transaction.

6. Meaning and limits of reports and verdicts

A GREEN, AMBER, RED, BLACK, or other Runtime Guard verdict means only that defined checks were executed on defined data at a defined time.

A GREEN verdict does not mean that a transaction is safe, lawful, profitable, appropriate, complete, or free from risk. A RED or BLACK verdict does not prove that a transaction is unlawful or malicious.

Runtime Guard may fail to detect unknown attacks, novel protocol behavior, misleading interfaces, incomplete transaction context, malicious third-party code, compromised signers, false data, unavailable data, modified transactions, bridge risks, oracle risks, governance risks, or other conditions outside the checks actually executed.

If a transaction changes after analysis, the earlier report may no longer be relevant.

7. Nature of obligations

Runtime Guard's defined result obligations are limited to:

• executing the documented checks for the then-current version of the Service on the data effectively submitted to the Service; and
• returning the corresponding report, verdict, or technical output at the time of execution.

The predictive accuracy, completeness, protective value, and operational usefulness of a report or verdict are best-efforts obligations. Runtime Guard does not undertake to detect every malicious, fraudulent, defective, harmful, or unsuitable transaction.

Where co-signing is enabled, Runtime Guard acts on a reinforced best-efforts basis to apply one non-decisive and non-necessary signature when configured policy conditions are met and the relevant chains, providers, and systems are available.

Where Lockdown Guard is enabled, Runtime Guard acts on a best-efforts basis to provide the app, backend, relayer, and verification workflows described for the applicable plan. The on-chain contracts operate according to their deployed code and your configuration.

8. Lockdown Guard specific risks

Lockdown Guard intentionally changes the operational profile of a Safe. You acknowledge the following risks:

• timelocks may impose mandatory waiting periods before certain actions can be executed;
• a lockdown may delay, freeze, or prevent legitimate actions during an emergency, market move, governance deadline, liquidation event, operational incident, or business need;
• a misconfigured timelock, lockdown signer, recovery owner, threshold, module, guard, fallback handler, or bypass path may delay or block access to assets;
• Runtime Guard cannot shorten an on-chain timelock, override an active lockdown, reverse an executed transaction, or recover assets from a misconfigured Safe;
• authorized lockdown signers, OTP devices, passkeys, phones, browser sessions, or API credentials must be protected by you;
• a lockdown relayer may be unavailable, out of gas, delayed by network conditions, suspended for non-payment, or unavailable because of an incident;
• you should maintain independent procedures to transact, unlock, recover, or migrate without relying on a single Runtime Guard-controlled system.

You are solely responsible for choosing a timelock duration, signer set, threshold, lockdown signer policy, recovery policy, and liquidity posture that fit your own security and operational needs.

9. Customer responsibilities

You are responsible for:

• your Safe configuration, signer threshold, owners, modules, guards, fallback handlers, policies, and recovery routes;
• securing your wallets, private keys, recovery phrases, hardware wallets, passkeys, OTP devices, browsers, computers, phones, sessions, and notification channels;
• verifying transaction details on your own signing device before signing;
• maintaining enough independent signers to operate without Runtime Guard;
• rotating compromised signers and removing Runtime Guard where appropriate;
• reviewing reports, warnings, and product documentation before relying on them;
• complying with laws, sanctions, tax rules, accounting rules, governance rules, and internal approvals that apply to you;
• ensuring that any person using the Service for an entity has authority to bind that entity;
• providing accurate billing, tax, jurisdiction, entity, and contact information to Runtime Guard and to Paddle.

Runtime Guard analyzes the data it receives. We are not responsible for an inaccurate analysis caused by incomplete, modified, outdated, false, unavailable, or non-submitted data.

10. Third-party systems

The Service may rely on or interact with third-party systems, including Safe, wallets, browser extensions, RPC providers, block explorers, simulation providers, DeFi protocols, bridges, oracles, cloud providers, email providers, payment providers, app stores, and open-source software.

Third-party systems are not controlled by Runtime Guard unless expressly stated. Their use may be subject to separate terms, fees, outages, security incidents, bugs, governance changes, sanctions controls, or regulatory changes.

Runtime Guard is not responsible for third-party protocols, third-party interfaces, third-party smart contracts, wallet behavior, blockchain consensus, gas fees, forks, congestion, MEV, oracle failures, bridge failures, or third-party security incidents.

11. Eligibility, sanctions, and prohibited use

You may not use the Service if you are legally prohibited from doing so, if you are subject to applicable sanctions, or if you are located, organized, resident, controlled by, or acting on behalf of a person or jurisdiction that Runtime Guard, Paddle, or an applicable provider cannot lawfully serve.

Paid subscriptions may be declined in certain jurisdictions or customer categories, including US retail consumers, unless Runtime Guard expressly makes the relevant paid plan available to that category.

At launch, paid subscriptions are intended for professional, business, institutional, DAO, protocol, treasury, or organizational use. Runtime Guard does not offer paid subscriptions to consumers acting solely for personal, family, or household purposes unless a plan, checkout flow, or written agreement expressly states that consumer purchase is available.

You must not use the Service:

• for fraud, theft, scams, phishing, malware, sanctions evasion, money laundering, terrorist financing, market manipulation, identity misuse, or unlawful activity;
• to attack, disrupt, overload, scrape, reverse engineer, bypass, or interfere with Runtime Guard systems;
• to submit malicious, misleading, unlawful, or intentionally distorted data;
• to resell, sublicense, rent, white-label, or provide the Service to third parties without written agreement;
• to present a report or verdict as a guarantee, insurance coverage, regulatory approval, certification, or personalized advice.

We may suspend, terminate, refuse, or limit access where needed to address security risk, abuse, fraud, sanctions risk, payment risk, legal risk, provider requirement, or harm to the Service.

12. Account access and authority

Runtime Guard may use wallet signatures, SIWE, browser-extension flows, passkeys, session tokens, Safe ownership checks, or similar mechanisms to authenticate access.

Current Safe ownership may be revalidated on sensitive actions. If you are removed from a Safe, you may lose access to the related product settings, reports, and entitlements. If you add a signer to a Safe, that signer may gain access to the Safe-related product surface according to the then-current product rules.

When you act for a company, DAO, fund, protocol, family office, or other organization, you represent that you have authority to use the Service and bind that organization.

13. Fees, billing, renewals, and taxes

Paid plans are billed through Paddle as merchant of record unless we state otherwise. Paddle may collect and process billing identity, payment, tax, receipt, refund, chargeback, and buyer-support information under its own buyer terms and privacy notices.

Runtime Guard does not store full card numbers or payment method credentials.

Prices, plan contents, billing periods, renewal terms, tax treatment, and checkout information are shown before purchase. Taxes may apply and are calculated at checkout.

Unless cancelled before renewal, subscriptions renew automatically for the selected billing period. If payment fails, a payment method expires, a chargeback occurs, fraud risk is identified, or Paddle requests action, Runtime Guard may suspend, degrade, or terminate paid features after notice where reasonably possible.

Suspension of co-signing does not prevent you from transacting without Runtime Guard because Runtime Guard's co-signing key is never necessary. Suspension of a Lockdown Guard relayer or app workflow does not remove your responsibility to maintain alternative recovery, unlock, or self-relay procedures.

14. Refunds and withdrawal rights

Refunds, cancellations, payment disputes, chargebacks, and tax corrections are handled through Paddle where Paddle is merchant of record. Runtime Guard's Refund Policy applies alongside these Terms.

Mandatory consumer rights remain unaffected.

Where EU or French consumer withdrawal rights apply, the consumer generally has 14 days from conclusion of the distance contract to withdraw. If the consumer requests that service performance begin during the withdrawal period, the consumer may be required to pay the legally permitted amount corresponding to the service already supplied up to the withdrawal request.

Where Paddle is merchant of record, Paddle's buyer terms, refund policy, receipt links, subscription-management links, buyer-support process, and checkout flow may provide the operational route for refund, cancellation, and withdrawal requests. You may also contact Runtime Guard at contact@runtime-guard.io.

15. Availability, changes, and beta features

The Service may be unavailable, delayed, degraded, or interrupted because of maintenance, incidents, security events, third-party outages, blockchain congestion, cloud failures, provider actions, payment-provider actions, regulatory issues, or force majeure.

We may change, add, remove, suspend, or discontinue features where reasonably needed for security, reliability, legal compliance, provider requirements, product development, or operational reasons. Material changes to paid features will be communicated where reasonably possible.

Some features may be labelled alpha, beta, experimental, testnet, preview, or similar. These features may be incomplete, unstable, changed, withdrawn, or subject to additional limitations.

16. Intellectual property and license

Runtime Guard and its licensors own the proprietary components of the Service, including software, interfaces, reports, templates, documentation, designs, trademarks, and other protected materials.

Subject to these Terms, Runtime Guard grants you a limited, non-exclusive, non-transferable, revocable right to access and use the Service for its intended purpose during your subscription or permitted free access.

The Service may include third-party or open-source components governed by their own licenses. Nothing in these Terms limits rights granted directly under an applicable open-source license.

Feedback, suggestions, ideas, bug reports, and feature requests may be used by Runtime Guard without restriction or compensation, unless we separately agree otherwise in writing.

17. Confidentiality

If a separate written agreement states that information is confidential, the confidentiality terms in that agreement apply.

Absent a separate written agreement, you should not submit secrets, private keys, seed phrases, confidential trading strategies, personal documents, or sensitive business information to Runtime Guard unless the Service specifically requests that information and you accept the related risk.

18. Privacy

Runtime Guard's processing of personal data is described in the Privacy Policy.

You must not submit personal data about third parties unless you have a lawful basis to do so and the submission is necessary for your use of the Service.

19. Liability for business customers

This section applies to customers acting for professional, business, institutional, DAO, protocol, treasury, or other non-consumer purposes.

Runtime Guard's essential obligations are limited to the obligations described in Section 7. Transaction safety, absence of third-party fraud, preservation of assets, recovery of assets, market performance, investment outcome, legal compliance of your transaction, and continuous availability are not essential obligations of Runtime Guard.

To the extent permitted by law, Runtime Guard is not liable for indirect, consequential, special, speculative, punitive, market-related, or opportunity-related losses, including lost profits, lost revenue, lost gains, lost opportunity, trading losses, liquidation losses, price movement, loss of goodwill, or loss caused by third-party protocols, wallets, signers, providers, or blockchains.

To the extent permitted by law, Runtime Guard's total aggregate liability to a business customer is capped at the greater of:

• the amount paid by that customer to Runtime Guard or through Paddle for the affected Service during the 12 months before the event giving rise to liability; or
• EUR 1,000.

This cap does not apply to liability that cannot lawfully be limited, including liability for intentional misconduct, gross negligence, bodily injury, or any other liability that applicable law does not allow to be capped.

20. Consumer protections

If you are a consumer, mandatory consumer protections under applicable law remain unaffected.

Nothing in these Terms excludes or limits liability where such exclusion or limitation is prohibited by consumer law. Runtime Guard may still rely on the actual scope of the Service, the limits of the obligations described in Section 7, causation rules, your own acts or omissions, third-party fault, and force majeure where permitted by law.

Runtime Guard does not currently make paid subscriptions available to French or EU consumers acting solely for personal, family, or household purposes. Before making such paid consumer subscriptions available, Runtime Guard will publish any mandatory consumer information that is not already provided through the merchant-of-record checkout, including consumer mediation details where legally required.

21. Indemnity for business use

If you use the Service for business or professional purposes, you agree to defend and indemnify Runtime Guard, its founders, officers, employees, contractors, affiliates, and service providers against third-party claims, losses, liabilities, damages, penalties, and reasonable costs arising from:

• your unlawful use of the Service;
• your breach of these Terms;
• your violation of sanctions, export control, tax, financial, consumer, data protection, or other laws;
• your transactions, Safe configuration, signer governance, third-party protocols, or customer assets;
• data, prompts, files, or transaction context you submit to the Service.

This indemnity does not apply to the extent a claim results from Runtime Guard's own intentional misconduct or gross negligence.

22. Termination

You may stop using the Service at any time. You may remove Runtime Guard's co-signing key, modules, or related configuration from your Safe subject to your own Safe governance and the relevant on-chain constraints.

Runtime Guard may suspend or terminate access for breach of these Terms, non-payment, sanctions risk, fraud risk, security risk, provider requirement, legal requirement, regulatory exposure, or material harm to the Service.

Sections that by their nature should survive termination survive, including sections on risk disclosure, customer responsibilities, intellectual property, confidentiality, privacy, liability, indemnity, governing law, and disputes.

23. Changes to these Terms

We may update these Terms from time to time. The current version is available at https://www.runtime-guard.io/terms/.

Where a change materially affects paid use, we will provide notice where reasonably possible. If you do not accept the updated Terms, you must stop using the Service and cancel any paid subscription before the change takes effect. Continued use after the effective date means you accept the updated Terms.

24. Assignment

You may not assign or transfer your rights or obligations under these Terms without our prior written consent.

Runtime Guard may assign these Terms in connection with a merger, acquisition, reorganization, sale of assets, financing, change of control, or transfer of the Service, provided that mandatory consumer rights remain unaffected.

25. Severability and no waiver

If any provision of these Terms is held invalid, illegal, or unenforceable, the remaining provisions remain in effect. The invalid provision will be interpreted or replaced to achieve its intended economic and legal effect as closely as permitted by law.

Failure to enforce a provision is not a waiver of the right to enforce it later.

26. Governing law and disputes

These Terms are governed by French law.

Mandatory consumer protections under applicable law remain unaffected. If you are an EU or EEA consumer and mandatory law gives you the right to bring proceedings in your country of residence, that right remains unaffected.

For business customers, the competent courts of Paris, France have exclusive jurisdiction, unless a separate written agreement states otherwise or mandatory law requires another forum.

27. Entire agreement

These Terms, the Privacy Policy, the Refund Policy, the pricing page, and any applicable order form or product-specific written agreement constitute the agreement between you and Runtime Guard for the Service.

Your own purchase terms, procurement terms, wallet-interface terms, DAO proposal text, or other unilateral terms do not apply unless Runtime Guard expressly accepts them in writing.

28. Contact

Questions about these Terms can be sent to contact@runtime-guard.io.