Last updated: September 11, 2026
By accessing or using Ghost Layer Security ("Ghost Layer," "we," "us"), operated by JEFCA Labs LLC, a Wyoming limited liability company, operating as Ghost Layer Security ("Company") with operations in Guadalajara, Jalisco, Mexico, you ("Customer," "you") agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not use the Service.
These Terms apply to all use of the Service, including the Starter, Pro, and Enterprise tiers. Engagements negotiated individually may be governed by an additional written agreement; where such an agreement exists and conflicts with these Terms, that agreement controls.
Ghost Layer Security provides AI agent security middleware that analyzes incoming and outgoing agent requests for threats including prompt injection, jailbreak attempts, data exfiltration patterns, identity spoofing, context displacement, and behavioral drift. The Service is delivered via API and accessed using an API key issued when your subscription begins.
Ghost Gate cryptographic agent attestation is included in all paid tiers. The number of agents you may have registered at one time is 3 on Starter, 10 on Pro, and unlimited on Enterprise. All registered agents are verified identically regardless of tier: your tier determines how many agents you may register, not how strictly they are checked.
Service features vary by tier as described on ghostlayersecurity.com. Company reserves the right to modify Service features, provided that material reductions to paid-tier functionality will be communicated with at least 30 days' notice.
Your API key is your identity. You are responsible for keeping your API key confidential. Any request made using your API key is treated as authorized by you. If your API key is compromised, notify us immediately at security@ghostlayersecurity.com and rotate the key through your dashboard.
You agree not to share, resell, or sublicense your API key without written permission from Company.
Your API key remains valid across plan changes. Upgrading or downgrading your tier changes your entitlements, rate limits, and Ghost Gate agent allowance; it does not invalidate or rotate your key.
You agree not to:
Company may authorize security testing and analysis in writing. Where authorized, the restrictions in this section do not apply within the scope of that authorization.
Paid tiers are billed monthly in advance through Stripe. All prices are quoted and charged in US dollars. If your payment method is denominated in another currency, your bank or card issuer performs the conversion and may apply its own fees.
Early adopter pricing is available to the first 10 customers per tier. Once granted, it remains in effect for as long as your subscription stays active and uninterrupted. If you cancel and later re-subscribe, standard pricing applies unless we agree otherwise in writing.
Plan changes: You may change tiers at any time through the billing portal. Upgrades take effect immediately and are prorated. Downgrades take effect immediately with a prorated credit applied to your next invoice.
Agent allowances on downgrade. If you move to a tier with a lower Ghost Gate agent allowance while more agents are registered than the new tier permits, your existing registered agents continue to operate normally. You will not be able to register additional agents until your registered total falls below your current tier's allowance. We do not revoke attestation for agents already in service as a result of a plan change.
Refunds: Paid tiers are non-refundable except where required by law. You may cancel at any time; cancellation takes effect at the end of your current billing period, and your access and API key remain active until that date.
Taxes: Prices do not include applicable taxes, which will be added where required.
No uptime commitment is made for the Starter or Pro tiers. The Service is provided on a commercially reasonable efforts basis. Enterprise-tier availability commitments, where offered, are stated separately in writing.
The Service uses layered analysis, including a static analysis layer and an AI-powered review layer. If the AI review layer is unavailable, the Service continues operating on its static layers, and requests that would have been routed for AI review are handled according to the Service's configured failure behaviour. Detection coverage is reduced during such periods.
Company will make commercially reasonable efforts to notify Enterprise customers of extended degradation of the AI review layer.
Support is provided by email at security@ghostlayersecurity.com.
Response targets are goals, not guarantees, and do not constitute a service level agreement.
Company publishes detection and false-positive metrics from internal testing against public and generated attack corpora. These figures describe results obtained under specific test conditions, using stated definitions and denominators, and are made available with supporting documentation on request.
Published metrics are test results, not performance guarantees. They do not warrant that the Service will achieve comparable results against your traffic, your threat model, or attacks not represented in the tested corpora.
Your use of the Service is governed by our Privacy Policy at ghostlayersecurity.com/privacy, incorporated by reference into these Terms.
You retain all rights to data you submit ("Customer Data"). You grant Company a limited license to process Customer Data solely to provide the Service. Threat logs are retained per the schedule in our Privacy Policy.
On termination: threat logs associated with your account are deleted according to the retention schedule in the Privacy Policy, measured from the date each log was created, and are not extended by termination. You may request earlier deletion of your data at any time.
Agent records. When you deregister an agent, its secret seed material is deleted. While your account is open, the attestation event log for your agents is retained on the threat-log schedule in the Privacy Policy, measured from each event's timestamp; events that record a failed verification are kept beyond that point reduced to the verdict, timestamp, agent name and ratchet counter, with the source IP address, user agent and request URL removed. A record of the registration and deregistration is retained for audit integrity. For twelve months after your account closes that record includes the agent's public key, fingerprint hash, ratchet counter, key history, and the reason given; after that it is reduced to the agent name, timestamps, revocation reason and ratchet counter, and the account's attestation and handshake event logs are deleted, as set out in the Privacy Policy.
The Service — including all software, algorithms, threat detection logic, the Ghost Gate identity layer, documentation, and branding — is the exclusive property of Company. These Terms do not grant you any ownership rights.
Non-public information about the Service's internal operation — including the implementation of the Ghost Gate identity layer, AI analysis logic, internal threat detection workflows, and any testing documentation, receipts, or methodology materials provided to you — is Company confidential information. You agree not to disclose it to third parties or use it for any purpose other than evaluating or using the Service.
Where the parties have executed a separate Non-Disclosure Agreement, that agreement governs and its obligations survive termination of these Terms. Breach of confidentiality is a material breach of these Terms and may result in immediate termination without refund.
(b) Authorized publication and testing. Company may, by written agreement, authorize a customer or researcher to test the Service and to publish findings, including security research results. Where Company has granted such authorization, the terms of that written agreement — including any coordinated-disclosure period — govern and supersede this section and the testing and reverse-engineering restrictions in Section 4, to the extent of the authorization granted.
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." COMPANY MAKES NO WARRANTIES, EXPRESS OR IMPLIED.
No security product is perfect. Ghost Layer is designed to reduce risk, not eliminate it. Company does not warrant that the Service will detect all threats, prevent all attacks, or remain uninterrupted. You remain responsible for your own security controls, and the Service is intended to complement rather than replace them.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, COMPANY'S TOTAL LIABILITY TO YOU FOR ANY CLAIM ARISING OUT OF THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE AMOUNT YOU PAID TO COMPANY IN THE 12 MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
IN NO EVENT SHALL COMPANY BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST DATA, OR BUSINESS INTERRUPTION.
You agree to indemnify, defend, and hold harmless Company from any claims arising from your use of the Service, your violation of these Terms, or Customer Data you submit.
Company may suspend or terminate your access for violation of these Terms, non-payment, or at Company's discretion with reasonable notice. You may terminate at any time through your dashboard.
On termination for non-payment or breach, API keys associated with your account are deactivated. On voluntary cancellation, keys remain active until the end of your paid period.
Company may update these Terms. Material changes will be communicated via email at least 30 days before taking effect. Continued use after changes take effect constitutes acceptance.
These Terms are governed by the laws of the State of Wyoming, USA, without regard to conflict-of-law principles. Any dispute shall be resolved in the state or federal courts located in that state, and you consent to the exclusive jurisdiction of those courts.
security@ghostlayersecurity.com
JEFCA Labs LLC, a Wyoming limited liability company, operating as Ghost Layer Security, Guadalajara, Jalisco, Mexico.