API7 Cloud User Agreement

1. Parties and acceptance

This Agreement is between APISEVEN PTE. LTD. (“API7”) and the organization accepting it (“Customer”). It applies to API7 Cloud, including trial or free access when available. For a new Customer, this Agreement takes effect when Customer accesses or uses API7 Cloud after API7 makes these terms available to Customer, or when Customer enters into an Order Form that incorporates this Agreement, whichever occurs first. For an existing Customer, this Agreement replaces the prior version of the API7 Cloud User Agreement from November 9, 2026. By accessing or using API7 Cloud on behalf of Customer, you agree to these terms on its behalf and represent that you have authority to bind it. Customer may authorize its personnel and contractors to use API7 Cloud and is responsible for their use under this Agreement.

An “Order Form” is a signed order or an online order accepted by Customer that identifies the plan, applicable fees, and subscription terms. A separately signed agreement governing the same subscription controls where it conflicts with this Agreement. A signed Order Form may vary these terms to the extent it expressly says so. Section 5 governs the priority of data processing terms.

2. Service and customer responsibilities

API7 Cloud is a hosted control plane for configuring and managing Customer's API gateways and AI gateways. API7 operates the hosted control plane. Customer deploys and operates its gateway data plane and is responsible for its infrastructure, configuration, access controls, backups, availability, and upstream services, except where a signed Order Form allocates those responsibilities differently. In this deployment, API and AI gateway runtime traffic is handled in Customer's environment. The hosted control plane handles gateway configuration and receives aggregate operational metrics, such as request counts, status code distributions, and latency. Customer may also submit information to API7 when requesting support.

API7 grants Customer and its authorized users a non-exclusive right to use the service for Customer's business during the applicable term, subject to the Order Form, plan limits, and this Agreement. Customer will provide accurate account information, keep credentials secure, manage user permissions, and notify API7 promptly of suspected unauthorized access. Customer will use the service lawfully and obtain any rights and authorizations required for the data it supplies or makes available to API7.

Customer may not interfere with the service, circumvent security or usage limits, resell access without authorization, or reverse engineer proprietary service components except where applicable law permits it. Open-source components remain governed by their applicable licenses.

3. Plans, billing, and support

The plan terms presented before Customer accepts an Order Form specify the subscription term, fees, included usage, overage rates, renewal terms, and cancellation process as applicable. Customer will pay the agreed fees and applicable taxes by the dates stated in the applicable Order Form or at checkout. Payment, renewal, and refund terms follow the applicable Order Form or the terms disclosed at checkout, subject to applicable law. Usage-based charges follow the rates, usage definitions, and billing periods disclosed with the plan. API7 will give advance notice of pricing changes before applying them to a subsequent billing or renewal period, subject to any applicable signed pricing terms. Recurring payment and renewal terms must be disclosed when Customer authorizes them. Starting a free trial does not by itself authorize a recurring charge. The standard trial period is 30 days unless a different period is shown in the applicable offer or the Console. When a trial expires, API7 may suspend workspace management. A suspended trial organization remains visible for a limited period and is hidden when that period ends. Customer may upgrade through the Console where available. Data return and deletion follow Section 6 and the applicable DPA. Preview features may be changed or withdrawn, and any associated limits or support exclusions will be disclosed.

Applicable support and service credits are described in the Order Form and the Technical Support Policy. The 99.95% monthly availability target applies to the API7-operated control plane for eligible subscriptions whose Order Form expressly identifies the Cloud Service Level. The applicable policy or Order Form describes how availability and service credits are calculated. Professional services are governed by the applicable order or statement of work. Customer-operated gateways, live API traffic, and Customer infrastructure are outside that service level unless API7 expressly agrees otherwise in a signed Order Form.

4. Customer Data, intellectual property, and confidentiality

“Customer Data” means configurations, content, and other data that Customer or its authorized users submit to the service or make available to API7 on Customer's behalf, including data sent by Customer's connected systems. As between the parties, Customer retains its rights in Customer Data. Customer authorizes API7 to handle Customer Data to provide, maintain, secure, and support API7 Cloud, subject to Section 5, and as required by law. API7 may use aggregate service metrics for analysis and improvement when those metrics do not reasonably identify Customer or any individual or reveal Customer's confidential information. API7 may create anonymized statistics from Customer Personal Data for those purposes only on Customer's documented instructions and subject to the applicable DPA.

API7 and its licensors retain their rights in the service and documentation. Customer retains its rights in its name and marks. API7 may use and display Customer's name and logo on API7's website and in API7's marketing materials to identify Customer as a customer. Upon Customer's written request, API7 will promptly remove them from its website and, to the extent commercially feasible, from its marketing materials. API7 may use non-confidential feedback that Customer voluntarily provides to improve its products and services.

Each party will use the other party's confidential information to perform or exercise rights under this Agreement and protect it with reasonable care. A party may share it with personnel, advisers, and contractors who need access and are bound by confidentiality duties. These duties cover information reasonably understood to be confidential, including non-public Customer Data and non-public service information. They do not cover information that becomes public without breach, is lawfully obtained without a confidentiality duty, or is independently developed. Legally compelled disclosure is permitted to the extent required, with notice where lawful. Confidentiality lasts for three years after termination, with trade secrets protected for as long as they qualify as trade secrets and personal data protected as required by law and the applicable DPA.

5. Privacy, data processing, and security

The API7 Cloud Privacy Notice explains how API7 handles personal data for its own purposes, such as account administration, billing, and business communications. The applicable DPA governs personal data processed by API7 on Customer's behalf (“Customer Personal Data”). A separately signed DPA for the service governs where it applies. Otherwise version 1 of the API7 Cloud Data Processing Addendum forms part of this Agreement and applies from the start of any processing it covers, including on applicable free or trial plans. If the DPA and this Agreement conflict on that processing, the DPA controls, subject to the priority of mandatory transfer clauses and applicable law. A Business Associate Agreement applies where separately executed and to the extent set out in that agreement.

API7 will maintain appropriate technical and organizational measures for the control plane and Customer Data it handles. Customer is responsible for measures within its own environment, user permissions, credential management, and the information it elects to share. Each party will perform its applicable security and privacy obligations.

6. Term, suspension, and exit

The Agreement remains in effect until ended in accordance with this section or the applicable signed terms. Paid subscription cancellation and nonrenewal follow the applicable Order Form. Customer may end free or trial use by closing its organization or contacting API7 through the applicable plan's cancellation process. Either party may terminate for a material breach that remains uncured 30 days after written notice. API7 may suspend affected access when reasonably necessary to address an urgent security risk, unlawful activity, a legal requirement, or an undisputed overdue payment after notice. API7 will give notice as soon as reasonably practicable, limit the suspension to the affected access where practicable, and restore access after the cause is resolved. API7 may end free or trial access under the applicable offer terms. If API7 plans to discontinue a service, API7 will give reasonable advance notice and apply the applicable export terms.

While Customer has workspace access, Customer may use the API Declarative CLI to export supported gateway group configurations. Unless Customer requests earlier deletion, the applicable Order Form specifies a different period, or applicable law requires otherwise, API7 will retain Customer's workspace and gateway configuration for 30 days after the paid service ends solely for export. Customer can request an export during that period or request earlier deletion by contacting API7 Support at support@api7.ai. API7 will then delete the retained workspace and gateway configuration from production systems at the end of the applicable period, unless they have already been deleted. For trial or free services, Customer can contact API7 Support for data return or deletion under the applicable offer terms and DPA. API7 returns or deletes Customer Personal Data, including remaining copies, in accordance with the applicable DPA. Accrued payment obligations and provisions intended to survive termination remain in force.

7. Warranties, liability, and third-party claims

During a paid subscription, API7 warrants that the service will materially conform to its applicable documentation. Customer may request remediation through the applicable support process. The applicable service-level remedies are described in the Technical Support Policy or the Order Form. Except for express commitments in this Agreement and to the extent permitted by law, the service is provided as available and API7 disclaims implied warranties, including merchantability, fitness for a particular purpose, and non-infringement.

To the extent permitted by law, API7 is not liable for indirect, special, incidental, consequential, or exemplary damages. For paid services, API7's total liability arising under this Agreement is limited to fees Customer actually paid for the affected API7 Cloud service during the 12 months before the claim. Any separate fixed liability limit for free or trial services applies only if expressly stated in the terms applicable to those services. These limits are subject to mandatory law, any different signed terms, and the rights and obligations that prevail under applicable transfer clauses.

Customer will defend API7 against third-party claims to the extent they arise from Customer's unlawful use of the service or from Customer Data that infringes a third party's rights. Customer will cover damages and reasonable costs finally awarded for such claims or agreed in a settlement Customer approves. API7 will promptly notify Customer of a claim and reasonably cooperate with the defense. Customer may control the defense and may settle it with API7's written consent if the settlement would impose obligations on API7 or require an admission from API7. Any API7 intellectual property indemnity is governed by the applicable signed agreement.

8. General terms

Singapore law governs this Agreement, and the courts of Singapore have exclusive jurisdiction, subject to mandatory law and the terms of any applicable mandatory transfer clauses. Neither party is liable for delay or failure caused by events beyond its reasonable control, except for accrued payment obligations. The parties are independent contractors. This Agreement and the documents it incorporates form the entire agreement for the service, subject to the priority of applicable signed terms and Section 5. Either party may assign this Agreement with the other party's written consent, or on notice in connection with a merger, reorganization, or sale of the relevant business if the successor assumes its obligations. This Agreement creates no third-party beneficiary rights except as provided by applicable law or mandatory transfer clauses. If a provision is unenforceable, the remaining provisions continue to apply. A failure to enforce a provision does not waive it.

API7 may send contractual notices to Customer's designated account or legal contact. Customer may send notices to support@api7.ai unless the Order Form identifies another address. API7 will notify Customer of material changes before they take effect. The notice will identify the effective date and the applicable acceptance or renewal process. Any amendment to a separately signed agreement follows that agreement's amendment terms.