Ordinance — Product Terms

Ordinance — Terms of Use

The terms you accept when you deploy Phaethon Ordinance.

Version 0.3.0-DRAFTStatus: DraftEffective date: TBD

Pre-general-availability draft. These terms have not yet been reviewed by legal counsel and contain items still to be settled. They are the terms currently shipped with Ordinance and acknowledged at startup. The authoritative copy for your deployment is the one inside the image you are running — read it at GET /terms, or from the image directly. If the version shown there differs from the version on this page, the copy in your image governs your deployment.

This is not the website Terms of Service. If you are looking for the terms covering this website, accounts and the marketplace, see /terms.
<!-- PHAETHON-TERMS version: 0.3.0-DRAFT status: draft effective_date: TBD product: Ordinance last_updated: 2026-07-15 -->

Phaethon Ordinance — Terms of Use

Licensor: Phaethon LLC, d/b/a Phaethon Security ("Phaethon," "we," "us") Software: Phaethon Ordinance — an API-based policy-enforcement layer (the "Software") Version of these terms: 0.3.0-DRAFT Effective date: [TBD — LEGAL REVIEW]

By setting ORDINANCE_ACCEPT_TERMS=1 (or otherwise installing, running, or using the Software), the individual or entity doing so ("you," "Licensee") acknowledges having had the opportunity to review these terms and agrees to them on behalf of the organization operating the Software.

0. What this document is

Ordinance is proprietary, closed-source software. It is licensed, not sold, and is gated by an Ed25519-signed License Key.

These Terms are the deploy-time acknowledgment surface — the text the operator accepts at startup and that GET /terms serves. The full agreement is the Phaethon Master End-User License Agreement + Exhibit B (Ordinance), together with your Order. Where these Terms and that Agreement differ, the Agreement and your Order control.

1. Definitions

  • Software — the Ordinance container image, License Key, Updates, the reference enforcement client, the policy bundles distributed with it, and the Documentation.
  • Policy Content — Phaethon's reference policy bundles and control mappings shipped with the Software. Proprietary; licensed, not assigned.
  • License Key — the Ed25519-signed credential enabling Production Use within its encoded scope and term.
  • Evaluation Mode — the keyless local mode (ORDINANCE_EVAL=1) that self-issues a short-lived local evaluation license.
  • Production Use — any use that is not Evaluation Use.
  • Order — an order form or written agreement stating scope, tier, term, fees.

2. License grant

Subject to these terms and the applicable Order, Phaethon grants you a non-exclusive, non-transferable, non-sublicensable, revocable license to install and run the Software in your own environment for your internal business use, within the scope and term encoded in the License Key. Documentation is licensed for your internal use only. All rights not expressly granted are reserved.

3. Evaluation Mode

Evaluation Mode (ORDINANCE_EVAL=1) self-issues a short-lived local evaluation license and grants Evaluation Use only. Running Evaluation Mode does not confer any production or perpetual right, and an Evaluation Mode build is not licensed for Production Use. Evaluation instances are provided "AS IS" with no support commitment and may not be used to provide any service to third parties.

Your machine mints the evaluation credential locally. The technical ability to obtain it says nothing about the licensed right to use it.

4. Restrictions

You shall not, and shall not permit any third party to:

  1. Redistribute, resell, sublicense, rent, lease, or host the Software for or on behalf of any third party, or provide it as a service, except as expressly licensed [TBD — LEGAL REVIEW: MSP / partner terms].
  2. Reverse engineer, decompile, or disassemble the Software, except to the limited extent applicable law expressly permits despite this restriction.
  3. Circumvent, disable, remove, or tamper with the License Key mechanism, signature verification, Evaluation Mode limits, or any technical protection.
  4. Remove or alter any proprietary notices, marks, or attributions.
  5. Use the Software or Policy Content to build, train, or operate a competing product or service.
  6. Exceed the licensed scope, or use an expired or another party's License Key.
  7. Use the Software in violation of law, or to process data you lack rights to.

Why these carry the weight. Ordinance is self-hosted: you receive a runnable image containing readable Python. Secrecy is not the control — this section is. If you need to review the source as part of due diligence, ask; see §11.

5. Ownership & intellectual property

Phaethon and its licensors retain all right, title, and interest in the Software, Documentation, Policy Content, License Keys, signing keys, and all related intellectual property. You receive only the express license in §2. You grant Phaethon a perpetual, royalty-free license to use any feedback or suggestions you provide. No trademark or brand rights in "Ordinance," "Phaethon," or "Phaethon Security" are granted except as needed to run the Software.

You retain ownership of your data, your policy bundles, and the decision records and exports the Software produces from your data.

6. What Ordinance does — and what it does not

Decisions are advisory. Ordinance evaluates an action against your policy bundles and returns ALLOW / DENY / ESCALATE, with the controlling control(s) attached as evidence. It does not block, permit, or perform any action. Enforcement happens only if the system that called Ordinance honors the decision.

What you are acknowledging:

  • A DENY your integration ignores prevents nothing.
  • Matching evaluates context only. subject and resource are recorded as evidence but are not evaluated. A rule written as though subject were matched will not fire as its author expects. (The API returns a hint when it detects this shape — a courtesy, not a guarantee.)
  • An action matching no rule falls through to the bundle's default_decision (or ORDINANCE_DEFAULT_DECISION, default escalate). Configure this deliberately — a permissive default silently allows anything unmatched.
  • Malformed policy bundles are skipped with a warning, not fatal. A skipped bundle enforces nothing. Check startup logs; validate with python -m app.validate before relying on a bundle.
  • A decision is only as good as the context you send. Ordinance cannot evaluate what it was not told.
  • Single-tenant. One shared ORDINANCE_API_KEY per deployment; no per-client key separation or tenant isolation.

Phaethon disclaims liability for what your systems do or fail to do in response to a decision, and for decisions produced from incomplete or inaccurate context.

7. No guarantee of compliance

Ordinance helps you express, apply, and evidence policy. It does not guarantee, and Phaethon does not warrant, that you will achieve or maintain compliance with any framework, control, law, or regulation. Outcomes depend on your policies, your integration, the context you supply, your practices, and your assessor's judgment. Phaethon is not an assessor, a C3PAO, or your legal or compliance advisor, and nothing Ordinance outputs is an assessment, certification, or legal opinion.

Exports are not signed. GET /v1/audit/export renders the decision ledger as plain CSV/zip; it is not cryptographically signed. A control×decision matrix shows decisions were recorded against a control — not that the control is implemented or effective.

8. Data & security posture

The Software runs entirely in your environment. Phaethon does not access, collect, store, or transmit your data or your policy decisions, and the Software makes no outbound telemetry calls — no phone-home, no analytics, no licensing check-in. License verification is offline against a public key embedded in the Software.

Verified 2026-07-15 by inspecting app/ for outbound network primitives: none found. Re-verify before any release that changes the app.

You are solely responsible for your data, your environment's security, network policy, backups, access control, key management, and your own regulatory obligations.

9. Updates, support & maintenance

Updates or patches, if provided, are governed by these terms. Support and service levels apply only if a support plan is purchased [TBD — LEGAL REVIEW: tiers]. Phaethon may modify the Software across versions and is not obligated to maintain prior versions.

10. Warranties, liability, term

THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PHAETHON DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PHAETHON WILL NOT BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, OR SPECIAL DAMAGES, OR LOST PROFITS OR DATA. PHAETHON'S TOTAL LIABILITY IS CAPPED AT [TBD — LEGAL REVIEW: e.g., fees paid in the preceding 12 months], except where law forbids such limitation.

These terms apply for the term stated in the applicable Order. Phaethon may terminate for uncured material breach after a cure period, and immediately for a violation of §4 or any circumvention of the License Key. On termination you must stop all use and remove the Software and License Keys. You may retain decision records and exports generated from your own data. Sections 4, 5, 6, 7, 8, 10, and 12 survive.

11. Source access for due diligence — under NDA

Ordinance is closed-source. If you need to review the code as part of security due diligence, Phaethon may grant read-only source access under a separate non-disclosure agreement, at its discretion and for that review only. Such access grants no license to use, run, modify, or redistribute the source beyond the review. Contact info@phaethonsecurity.com.

[TBD — LEGAL REVIEW: access form, scope, duration, and whether your external assessor may review.]

12. General

Governing law and venue are [TBD — LEGAL REVIEW: U.S. state — Washington is the natural default; Phaethon LLC is in Camano Island, WA]. You may not assign these terms without Phaethon's consent; Phaethon may assign. If any provision is unenforceable, the rest remains in effect.

Order of precedence: your Order, then the Master EULA + Exhibit B, then these Terms. Where any of them conflicts with this placeholder, that document controls.

Export & sanctions. You will comply with applicable export-control and sanctions laws. Government and prime-contractor procurement terms are [TBD — LEGAL REVIEW].

Third-party components. The Software includes third-party open-source components (Docker base image, Python, FastAPI, Uvicorn, Pydantic, PyYAML, cryptography, and others), each governed by its own license. A NOTICE file is provided with the Software. These terms do not restrict that software beyond its own terms.

The NOTICE file is generated at image build time from the installed dependency tree and ships at /srv/NOTICE. Confirm it is present on the first release run.

Questions about licensing: info@phaethonsecurity.com. This placeholder will be superseded by counsel-approved terms; the version field in the header tracks which text is in force, and the acknowledged version is recorded in the boot log.

Last updated: 2026-07-15