Captivo Access Terms of Use

1. Parties and scope

These terms govern the relationship between Captivo Yazılım A.Ş. ("Captivo") and the organisation using Captivo Access ("Customer"). By creating an account or using the service you accept them.

2. The service

Captivo Access gives external vendors time-boxed, recordable access to internal systems without a VPN. It is offered two ways:

• Hosted: Captivo operates the console and the data plane.
• Self-hosted: the Customer operates every component.

In both models the connector that carries the traffic runs inside the Customer's network and dials outbound only.

3. Account, entitlements and the free tier

One Captivo account covers both products. At registration every organisation is granted the free tier of each; the scope of the Captivo Access free tier is stated on the product page.

Account security is the Customer's responsibility. Authentication is by passkey; no password is created. The Customer decides its users' roles and the duration of each grant.

4. Acceptable use

The service may not be used to:

• reach systems you are not authorised to access
• infringe the rights of others or breach applicable law
• generate load that harms the infrastructure, other tenants or third parties
• access networks you do not own or have no written permission to reach

5. Customer obligations

The following are the Customer's responsibility, and Captivo does not police whether they are met:

• Informing vendors: where session recording is on, telling the people you grant access to that they are recorded, and establishing the lawful basis for it, is the Customer's obligation. The product shows a monitoring notice during a session, but that notice does not replace legal notification.
• Deciding the scope of recording: which resources record, for how long they are kept, and whether keystroke logging is used, are the Customer's decisions.
• Keeping grants current: revoking access when it is no longer needed is the Customer's responsibility.
• Operating the connector: the connector runs on the Customer's machine; updating it, keeping it reachable and giving it enough disk are the Customer's responsibility.

6. Session recordings and backups

Session recordings are stored on the Customer's connector, and the encryption key never leaves that machine. Two consequences follow, and both are the Customer's responsibility:

• Backups: Captivo holds no second copy. If the connector's volume or its /data/recording.key file is lost, the recordings become permanently unreadable.
• Availability: a recording is searchable and playable while its connector is online. When it is offline the console reports that an answer is incomplete.

Erasure requests are recorded immediately; the content is deleted when the connector confirms on its next connection.

7. Open source and self-hosted use

The Captivo Access software is offered under the Apache License 2.0. When you run it on your own server the licence terms apply; Captivo does not operate that installation, processes no data and makes no service-level commitment for it. Support is subject to a separate agreement.

8. Continuity of service

In the hosted model we make reasonable efforts to keep the service available and announce planned maintenance in advance. No specific uptime percentage is committed unless a separate written service-level agreement is in place.

Because the connector runs inside the Customer's network, interruptions caused by the Customer's own network or hardware fall outside that scope.

9. Intellectual property

Copyright in the software belongs to Captivo and is licensed under Apache-2.0. The Customer's data, including session recordings, belongs to the Customer.

10. Limitation of liability

To the extent permitted by law, Captivo is not liable for indirect damages, lost profits, lost data (including the loss of recordings held on the Customer's own infrastructure) or third-party service outages. Total liability is limited to the amounts paid by the Customer in the twelve months before the event giving rise to the claim; on the free tier that amount is zero.

11. Suspension and termination

We may suspend or terminate the service in the event of a breach of acceptable use, a security threat or a legal requirement, with prior notice where possible. The Customer may close its account at any time. On closure, data held centrally is deleted except where a legal retention duty applies; recordings on the connector remain in the Customer's hands.

12. Changes

When these terms change we update the date at the top of the page. Account holders are notified by email of material changes.

13. Governing law and contact

These terms are governed by the laws of the Republic of Türkiye. Questions: support@captivo.io