Terms of Service

Effective November 15, 2026

These Terms of Service ("Terms") govern your use of the websites at supertrace.ai and cli.supertrace.ai, the Supertrace platform, the stcli command-line tool, our APIs, and related services (together, the "Services"). The Services are provided by SuperTrace, Inc., a Delaware corporation ("Supertrace", "we", "us").

Please read Section 17. It requires most disputes to be resolved by individual binding arbitration, waives class actions and jury trials, and explains how to opt out.

1. Agreeing to these Terms

1.1 Acceptance. You accept these Terms by clicking to accept them, signing an order form that references them, or using the Services.

1.2 Business Customers. If you use the Services for an organization, you accept these Terms for that organization and confirm you have authority to bind it. "You" then means the organization (a "Business Customer"). The Supertrace platform is available only to Business Customers under an order form or online ordering document (an "Order Form").

1.3 Individual users of stcli. stcli is self-serve. You may use it for your own purposes rather than for an organization (an "Individual"). Sections marked as applying to Individuals give them additional protections.

1.4 Eligibility. You must be at least 18 years old and legally able to enter a contract. You may not use the Services if you are barred from doing so under U.S. or other applicable law, including sanctions laws.

1.5 Related documents. These documents form part of your agreement with us:

our Privacy Policy
for Business Customers, the Data Processing Addendum
any Order Form

If they conflict, the following order applies: (a) the Order Form, (b) the Data Processing Addendum, for the processing of personal data, and (c) these Terms.

2. The Services

2.1 Platform. The Supertrace platform is a hosted AI system for network operations. It includes chat with AI agents, alert and incident analysis, automated workflows ("Flows"), ticket analysis, inventory and topology, and integrations with your network and IT tools.

2.2 stcli. stcli is software you install on your own computer. It connects to network devices, Kubernetes workloads and tools you choose. It runs commands and edits files that an AI agent proposes, subject to the approval controls described in Section 19.

2.3 AI models. The Services use AI models operated by Supertrace and by third-party model providers. We choose and may change the models and providers we use. Our current providers are listed on our Subprocessors page.

2.4 Changes. We may add, change or remove features. If a change materially reduces the core functionality of a paid Service during a committed subscription term, we will give Business Customers at least 30 days' notice. A Business Customer may then terminate the affected Service and receive a pro-rata refund of prepaid, unused fees.

2.5 Beta features. Features we label alpha, beta, preview or similar ("Beta Features") are provided "as is" for evaluation. They may change or be discontinued at any time. Beta Features are excluded from any service-level commitment and from our indemnity in Section 13.1.

2.6 Third-party services. The Services can connect to products we do not control, such as:

network devices from vendors such as Juniper, Cisco, Nokia and Ciena
monitoring systems such as Zabbix and LibreNMS
OSS/BSS tools such as NetBox and Nautobot
ITSM and ticketing tools such as ServiceNow and Zendesk
your Slack or Microsoft Teams workspace
MCP servers you configure

These are "Third-Party Services". You authorize us to exchange data with any Third-Party Service you connect. Your use of a Third-Party Service is governed by its own terms. We are not responsible for Third-Party Services or for the data they send us.

3. Accounts

3.1 You must give accurate account information and keep it current.

3.2 You are responsible for activity under your account and for keeping your credentials confidential. Credentials include passwords, tokens, API keys and STCLI_TOKEN values. Tell us promptly at security@supertrace.ai if you suspect unauthorized use.

3.3 If you sign up with an email address on a domain that a Business Customer controls, that Business Customer's administrators may manage your account and access its content.

4. Agent actions and your systems

4.1 What Actions are. The Services may propose, and with your approval or under rules you configure, carry out actions on systems you connect. "Target Systems" include network devices, servers, Kubernetes workloads, your local computer, and Third-Party Services. Actions include running commands, changing configurations, editing files, and writing to inventory systems such as NetBox ("Actions").

4.2 Authorization. You may connect only Target Systems that you own or are authorized to access and change. You are responsible for obtaining every permission needed.

4.3 Your responsibility. You are responsible for every Action that:

you or your users approve;
your allow rules, auto-approval settings or Flow configurations permit; or
is otherwise taken through your account.

The Services classify commands as read-only, write or destructive to decide when to ask for approval. That classification is automated and may be wrong. It does not shift responsibility for an Action to Supertrace.

4.4 Actions may not go as intended. AI-generated Actions may contain errors, act on the wrong system, or have effects you did not expect. These include outages, misconfigurations and service interruptions for your own customers. You should:

follow your own change-management practices;
review every proposed write or destructive Action before approving it;
maintain backups and rollback plans;
test in a lab or staging environment where practical; and
give the Services least-privilege credentials.

4.5 No sandbox. stcli runs on your computer with the permissions of the user who runs it. It does not isolate the commands it runs.

4.6 High-risk uses. The Services are not designed to be the only means of keeping systems operating where failure could cause death, personal injury or serious environmental damage. This includes systems that keep emergency calling (such as 911) available. Do not rely on the Services as the sole safeguard for those systems.

5. Inputs and Outputs

5.1 Definitions. "Inputs" are what you or your Target Systems and Third-Party Services provide to the Services. Inputs include prompts, files, command output, configurations, tickets and telemetry. "Outputs" are what the Services generate in response. Inputs and Outputs together are "Customer Content".

5.2 Accuracy. Outputs are generated by AI and may be inaccurate, incomplete or out of date. You must evaluate Outputs, including root-cause analyses, recommended commands and summaries, before relying on them. Outputs are not a substitute for qualified engineering judgment.

5.3 Similar Outputs. Other users may receive Outputs similar to yours. Your rights in Outputs do not extend to other users' Outputs.

5.4 Ownership. As between you and Supertrace:

you retain all rights in your Inputs; and
you own your Outputs. Supertrace assigns to you all of its right, title and interest, if any, in Outputs.

6. How we use Customer Content

6.1 To provide the Services. You grant Supertrace a worldwide, non-exclusive, royalty-free license to host, copy, process, transmit and display Customer Content as needed to:

provide, secure, support, maintain and improve the Services;
prevent abuse; and
comply with law.

The license lasts while we hold Customer Content.

6.2 No model training. We do not use Customer Content to train or fine-tune AI models. We engage model providers only on terms that prohibit them from using Customer Content to train their models.

6.3 Usage Data. We collect information about how the Services are used ("Usage Data"). This includes token counts, costs, feature usage, approval and denial counts, command classifications, error reports and performance data. Usage Data does not include the substance of your Customer Content.

We may use Usage Data to operate, secure, bill for and improve the Services. We may publish aggregated statistics that do not identify you, your users or your networks.

6.4 Personal data. Our Privacy Policy explains how we handle personal data. For Business Customers, our Data Processing Addendum applies to personal data in Customer Content and controls if it conflicts with these Terms.

6.5 Credentials.

stcli. SSH connections are made from your computer, and device passwords you type are not sent to us.
Platform. SSH device keys and most integration credentials you store on the platform are encrypted at rest. Credentials are used only to perform Actions and integrations you configure.

6.6 Deletion.

stcli. You may delete individual sessions at any time. You may delete your account in the stcli dashboard, and we delete your Customer Content within 30 days.
Platform. When a Business Customer's subscription ends, it may export its Customer Content for 30 days. We then delete it within 30 days.
In both cases, copies in backups expire within 35 days, and we keep billing records and copies we must keep by law.
Copies of Customer Content in our internal workspace (see our Privacy Policy, Section 6) are not deleted automatically. We delete them within 30 days of your written request to privacy@supertrace.ai.

6.7 Security. We maintain administrative, technical and physical safeguards designed to protect Customer Content. Our SOC 2 Type II report and security documentation are available at trust.supertrace.ai.

7. Acceptable use

The rules in this Section 7 are our "Acceptable Use Policy". They apply to everyone who uses the Services. The core rule: use Supertrace only on systems you are authorized to operate, and only for lawful network and IT operations.

7.1 Authorized systems only. You may not use the Services to:

access, scan, probe or change any device, network, account or workload you do not own or lack written authorization to operate;
get around authentication, access controls or network segmentation that you are not authorized to bypass; or
use credentials you are not authorized to use.

Authorized security testing is allowed. That means testing within a written scope on systems you own or have permission to test.

7.2 Harmful network activity. You may not use the Services to:

launch or help with denial-of-service attacks, traffic floods or route hijacking;
intercept communications without legal authority;
deploy malware, backdoors or persistent unauthorized access;
deliberately degrade emergency calling or other critical services; or
send spam or carry out phishing.

7.3 Misuse of the Services. You may not:

probe, scan or test the vulnerability of the Supertrace service itself, except through our responsible disclosure process at security@supertrace.ai;
interfere with, overload or disrupt the Services;
reverse engineer the Services, except as the law expressly allows;
get around usage limits, credit metering, rate limits or approval controls;
share accounts, or resell or give third parties access, unless your Order Form permits it;
extract or copy models, prompts or system instructions; or
use Outputs or the Services to train or build a competing AI model or product.

7.4 Unlawful content. You may not use the Services to:

violate any law, including privacy, export-control and sanctions laws;
infringe others' intellectual property or privacy rights; or
process sensitive personal data you are not permitted to process. Examples are health data or payment card numbers without appropriate safeguards and agreements.

7.5 Human oversight. You must keep human oversight of AI-proposed changes on production systems that match your risk. In particular, do not set broad allow rules for commands that change configuration on production devices unless you have controls that make this safe.

7.6 Enforcement. We may investigate suspected violations. We may remove content, limit features, or suspend or terminate accounts as described in Section 11. Where the law requires, we may report illegal activity to the authorities. Report suspected abuse to security@supertrace.ai.

8. Fees, credits and payment

8.1 Platform fees. Fees, subscription term and payment terms are set in your Order Form. Unless it says otherwise:

invoices are due within 30 days in U.S. dollars;
overdue amounts accrue interest at 1.5% per month or the highest lawful rate, whichever is lower; and
subscriptions renew for successive 12-month terms unless either party gives notice of non-renewal at least 30 days before the term ends.

8.2 stcli credits. stcli usage is paid with prepaid U.S.-dollar credits. We charge credits per agent turn and per web search at the rates on our pricing page at the time of use.

"Purchased Credits" do not expire while your account is in good standing.
"Promotional Credits" are credits granted for sign-up or referrals. They expire 12 months after they are granted, have no cash value, and may not be transferred.
Purchased Credits are non-refundable, except where the law requires a refund or where we terminate the Services for reasons other than your breach. In that case, we refund your unused Purchased Credits.
Payments are processed by Stripe. We do not store full card numbers.

8.3 Consumers' right of withdrawal. If you are an Individual in the EU or UK, you have a right to withdraw from a credit purchase within 14 days. You agree that we may make credits available immediately. You acknowledge that you lose the right of withdrawal for credits you have used.

8.4 Price changes. We will give at least 30 days' notice of price increases. For Business Customers with a committed term, increases take effect at renewal.

8.5 Taxes. Fees exclude taxes. You pay all applicable taxes, other than taxes on our net income.

9. Intellectual property

9.1 Our property. Supertrace and its licensors own the Services, the software, documentation, models we operate, and all improvements to them. We grant no rights except those stated in these Terms.

9.2 Feedback. If you send us suggestions or feedback, we may use them without restriction or payment to you.

9.3 Open-source components. Open-source components in the Services are licensed under their own terms, which are listed in our third-party notices.

10. Confidentiality

10.1 What is confidential. "Confidential Information" is non-public information that one party discloses to the other and that is marked confidential or would reasonably be understood to be confidential. Your Customer Content is your Confidential Information. Pricing in an Order Form is confidential to both parties.

10.2 What is not. Confidential Information does not include information that:

is or becomes public through no fault of the recipient;
the recipient already knew;
the recipient received lawfully from someone else; or
the recipient developed independently.

10.3 Duties. The recipient will use Confidential Information only to perform under these Terms. It will protect Confidential Information with at least reasonable care. It may share it only with employees, contractors and service providers who need to know it and are bound by similar obligations. It may disclose Confidential Information when the law requires, after giving prompt notice where lawful.

10.4 Duration. These duties last three years after termination. For trade secrets and Customer Content, they last for as long as the information remains confidential.

11. Term, suspension and termination

11.1 Term. These Terms apply while you use the Services. Subscriptions run for the term in the Order Form.

11.2 Ending your use.

Individuals may stop using the Services and delete their account at any time.
Business Customers may terminate at the end of a subscription term by giving notice of non-renewal under Section 8.1.

11.3 Suspension. We may suspend access, with notice where practical, if:

fees are more than 15 days overdue after we have notified you;
your use poses a security risk or threatens harm to the Services, other users or third parties;
you violate the Acceptable Use Policy; or
the law requires it.

We will limit any suspension to what is reasonably necessary and restore access once the cause is resolved.

11.4 Termination for breach. Either party may terminate if the other materially breaches these Terms and does not cure the breach within 30 days after written notice. We may terminate immediately for serious or repeated violations of the Acceptable Use Policy.

11.5 Effect of termination.

Your access ends.
Undisputed fees owed become due.
Section 6.6 governs deletion of your Customer Content.
These sections continue to apply: 5.4, 6.3, 8 (for amounts owed), 9, 10, 11.5, 12, 13, 14, 17, 18 and 19.3.

12. Warranties and disclaimers

12.1 Authority. Each party confirms that it has authority to enter into these Terms.

12.2 Disclaimer. Except as expressly stated in an Order Form, and to the fullest extent the law permits, the Services, Outputs and Actions are provided "as is" and "as available". Supertrace disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. Supertrace does not warrant that:

the Services will be uninterrupted or error-free;
Outputs will be accurate;
command classifications will be correct; or
Actions will produce the intended result.

13. Indemnification

13.1 By Supertrace. Supertrace will defend a Business Customer with a paid subscription against any third-party claim that the Services, as provided by Supertrace, infringe that third party's intellectual property rights. Supertrace will pay the damages and costs finally awarded or agreed in settlement.

This does not apply to claims arising from:

Customer Content or Outputs;
Third-Party Services or third-party models;
Beta Features or free use;
modifications not made by Supertrace; or
combinations with items Supertrace did not provide.

If the Services are, or are likely to be, held to infringe, Supertrace may:

obtain the right for you to continue using them;
modify them so they no longer infringe; or
end the affected Service and refund prepaid, unused fees.

An Order Form may extend this indemnity, including to Outputs.

13.2 By you. To the extent the law permits, you will defend Supertrace against third-party claims arising from:

your Customer Content;
Actions on Target Systems you were not authorized to access or change; or
your violation of the Acceptable Use Policy or the law.

You will pay the damages and costs finally awarded or agreed in settlement.

13.3 Process. The party seeking defense must:

give prompt notice of the claim;
let the other party control the defense and settlement; and
give reasonable cooperation.

The defending party may not settle a claim in a way that imposes obligations on the other party without that party's consent.

14. Limitation of liability

14.1 Excluded damages. To the fullest extent the law permits, neither party is liable for any of the following, even if advised that they were possible:

indirect, incidental, special, consequential, exemplary or punitive damages;
lost profits, revenue or goodwill;
loss of data; or
network downtime, or service interruptions experienced by your own customers or subscribers.

14.2 Cap. To the fullest extent the law permits, each party's total liability arising out of or relating to these Terms is limited to the greater of:

the amounts you paid Supertrace for the Services in the 12 months before the event giving rise to the claim; or
US$100.

An Order Form may set a different cap.

14.3 Exceptions. Sections 14.1 and 14.2 do not limit:

your obligation to pay fees;
either party's obligations under Section 13;
liability for a party's gross negligence, willful misconduct or fraud; or
liability that cannot be limited by law.

14.4 Consumer rights. If you are an Individual, nothing in these Terms limits rights you have under mandatory consumer-protection laws where you live. Some jurisdictions do not allow certain exclusions or limits, so parts of Sections 12 and 14 may not apply to you.

15. Export, sanctions and U.S. government use

15.1 Export and sanctions. You will comply with U.S. and other applicable export-control and sanctions laws. You will not use, export or provide access to the Services in, or for the benefit of, a sanctioned country, region or person.

15.2 U.S. government use. The Services are "commercial computer software" and "commercial computer software documentation". U.S. government users receive only the rights granted in these Terms.

16. Changes to these Terms

16.1 Notice. We may update these Terms. We will notify you of material changes at least 30 days in advance by email or in the Services. Changes do not apply retroactively.

16.2 Business Customers. For Business Customers with a committed term, material changes that are adverse to them take effect at the next renewal. The exception is changes required by law, which may take effect sooner.

16.3 Acceptance. If you continue to use the Services after a change takes effect, you accept it.

17. Dispute resolution and arbitration

17.1 Informal resolution. Before starting any proceeding, the party with a dispute will send a written notice describing it. Notices to Supertrace go to legal@supertrace.ai, with a copy to the address in Section 20. Both parties will try in good faith to resolve the dispute within 60 days of the notice.

17.2 Binding arbitration. Any dispute arising out of or relating to these Terms or the Services that is not resolved informally will be resolved by binding arbitration administered by the American Arbitration Association ("AAA").

The AAA Consumer Arbitration Rules apply to Individuals.
The AAA Commercial Arbitration Rules apply to everyone else.
The arbitration will take place in New York, New York, or by video conference if the parties agree.
One arbitrator will decide the dispute and may award any individual relief that a court could award.
The Federal Arbitration Act governs this Section 17.

17.3 Exceptions. Either party may:

bring an individual claim in small-claims court; or
seek an injunction or other equitable relief in court to protect its intellectual property or Confidential Information.

17.4 No class actions or jury trials. Disputes will be resolved only on an individual basis. Neither party may bring or take part in a class, collective, consolidated or representative proceeding. Each party waives the right to a jury trial.

17.5 Mass filings. If 25 or more similar demands are filed against Supertrace by or with the help of the same law firm or organization, the AAA will administer them in batches of up to 25 demands. One arbitrator will decide each batch. The parties will cooperate in good faith to resolve the demands efficiently.

17.6 Opt-out. You may opt out of this Section 17. To do so, email legal@supertrace.ai with your name, your account email and a statement that you opt out of arbitration. You must send it within 30 days after you first accept these Terms, or within 30 days after we notify you of a material change to this Section.

17.7 Severability. If the class-action waiver in Section 17.4 is found unenforceable for a claim, that claim will be decided in court under Section 17.8 and not in arbitration.

17.8 Governing law and courts. These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. Any dispute that is not arbitrated will be heard exclusively in the state or federal courts located in New York County, New York. Each party consents to the jurisdiction of those courts. This Section 17.8 does not deprive an Individual of the protection of mandatory laws of the country where they live.

17.9 Order Forms. An Order Form may set different dispute-resolution terms, and those terms control for that Business Customer.

18. General

Entire agreement. These Terms and the documents in Section 1.5 are the entire agreement between you and Supertrace about the Services. They replace any prior agreements on that subject.
Assignment. Neither party may assign these Terms without the other's consent. Either party may assign them without consent to a successor in a merger, acquisition or sale of substantially all of its relevant assets, provided the successor is not a competitor of the other party.
Notices. We may send notices by email to your account address or in the Services. Legal notices to Supertrace go to the addresses in Section 20.
Force majeure. Neither party is liable for delays caused by events beyond its reasonable control. This does not apply to payment obligations.
Severability and waiver. If a provision is unenforceable, the rest remains in effect. Not enforcing a provision is not a waiver of it.
Relationship. The parties are independent contractors. These Terms create no third-party beneficiaries.
Publicity. We may name a Business Customer as a customer only with its prior written consent.

19. stcli software

19.1 License. Supertrace grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to install and run stcli on computers you own or control, while your account is in good standing. Business Customers may use it for their internal business purposes. Individuals may use it for their own purposes. stcli is licensed, not sold.

19.2 Organizations. A Business Customer may let its employees and contractors use stcli on its behalf. It may install stcli on shared hosts, jump servers and automation systems, authenticated with organization API keys. The Business Customer is responsible for their use.

19.3 Restrictions. Except as these Terms or applicable law expressly permit, you may not:

copy stcli, except as needed to install and back it up;
distribute, sell, rent, lease, sublicense or host stcli for third parties;
modify, translate, reverse engineer, decompile or disassemble stcli, or try to derive its source code;
remove or alter proprietary notices;
bypass or interfere with authentication, usage metering, approval controls or update checks, except through the settings we document; or
use stcli to build a competing product, or to access the Services other than as documented.

19.4 What stcli does on your systems. At the direction of an AI agent, stcli can:

connect to network devices over SSH, including through jump hosts;
connect to Kubernetes workloads using your kubeconfig;
run commands on those systems;
read, list and edit files on your computer;
run commands in your local shell;
read from and write to NetBox; and
call MCP servers you configure.

Commands stcli classifies as read-only may run without asking. Other commands require your approval, and commands it classifies as destructive require typed confirmation. Commands it cannot classify are treated as writes. Local file and shell actions, and MCP calls, always ask first. You can add your own allow, ask and deny rules, and you are responsible for the rules you add. Section 4 applies to everything stcli does.

19.5 Data stcli sends. To work, stcli sends us your prompts, your approval decisions, output from the commands it runs (up to 64 KiB per command), contents of files the agent reads, and results from NetBox and MCP tools. When you sign in, it also sends your computer's hostname, operating system, architecture and stcli version. SSH passwords and keys stay on your computer, and NetBox tokens are removed before data is sent. stcli does not include separate analytics or crash-reporting tools. Our Privacy Policy explains how we handle this data.

19.6 Updates. stcli checks for new releases about once an hour, verifies each download's checksum and installs updates automatically. You can turn this off by setting the environment variable STCLI_NO_AUTO_UPDATE or setting "auto_update": false in your stcli config. Installs managed by Homebrew update only through Homebrew. If the Services change in a way that is incompatible with your version, stcli installs the required update before it starts, unless you have turned updates off; in that case it stops working until you update.

19.7 Third-party components. stcli includes open-source components. Their licenses are listed in THIRD_PARTY_NOTICES.md, which ships with every release, and govern those components where they conflict with these Terms.

19.8 When the license ends. Your license to stcli ends when your account ends or if you breach this Section 19. You may end it at any time by uninstalling stcli and deleting ~/.stcli and ~/.config/stcli. When it ends, you must stop using and delete stcli.

20. Contact

SuperTrace, Inc.
115 W 30th St, Rm 500B, New York, NY 10001
legal@supertrace.ai