Terms of service

1. The service

PermitUSB is a USB device control platform: a Windows endpoint agent that enforces the policy you define, and a cloud dashboard and API where you manage policies, review device events and configure alerts. We operate the cloud control plane, ship agent updates, and provide support by email.

2. Your account

• Provide accurate account and billing information and keep it current
• Keep your credentials secure. You are responsible for activity under your account, including the actions of admin users you invite. Multi-factor authentication is available and can be enforced workspace-wide; we recommend enabling it
• You must be at least 18 and using PermitUSB for business purposes. The service is not offered to consumers

3. Trial

The free trial runs 14 days, requires no payment card, and is capped at 25 endpoints. When a trial expires without conversion, agents stop enforcing policy and devices fail open to allowed, the dashboard becomes read-only, and your data is preserved for 30 days before deletion. Adding a payment method during that window resumes service without data loss.

4. Fees and billing

Pricing

$2 per endpoint per month, or $20 per endpoint per year on the annual option. One tier, no minimum license count. Current pricing is always published on the pricing page. Payments are processed by Stripe.

Licenses

Your license count sets your endpoint capacity and enrollment is gated by it. On monthly billing, additions and removals prorate against your next invoice. On annual billing, adding a license charges the prorated remainder of the year immediately; removing one takes effect immediately and the unused remainder of the prepaid year is not credited or refunded, so reduce licenses at renewal if you want the lower count reflected in what you pay.

Taxes

Fees exclude taxes. You are responsible for applicable sales tax, VAT or similar, and for providing accurate tax information.

Price changes

We will not raise your price mid-term. Price changes apply from your next renewal, and we will email your admin contacts at least 30 days before an increase takes effect.

Nonpayment

If payment fails we will retry and notify you. Continued nonpayment may result in suspension and, ultimately, termination under section 12.

5. Cancellation and refunds

You can cancel any time from the dashboard Billing page or the Stripe customer portal. Cancellation takes effect at the end of the current billing period, meaning the month you have paid for or the prepaid year on annual billing, and service continues until then. We do not refund partial periods, on monthly or annual billing. After cancellation your data is preserved for 30 days and then deleted, unless you ask us to delete it sooner.

6. Installing the agent: your responsibilities

The agent is a privileged Windows service that can disable USB devices on the machines where it runs. By deploying it you agree that:

• You will install it only on endpoints you own or are authorized to manage, and you are authorized to permit its installation and operation on each of them
• You are responsible for notice to and consent from your own employees and users, under your acceptable-use policy and applicable workplace and monitoring laws. The data the agent collects is described in the privacy policy; disclosing that monitoring to your employees is your obligation, not ours
• You are responsible for testing policies before broad rollout. Blocking device classes that include input devices can make a machine hard to use; the documentation describes safeguards, and applying them is in your control

7. Acceptable use

You will not:

• Resell, sublicense or operate the service for third parties without a written agreement with us
• Circumvent or attempt to circumvent per-endpoint billing, including by manipulating enrollment, capacity checks or license counts
• Reverse engineer, decompile or disassemble the software except where law permits it despite this restriction
• Interfere with the service or other tenants, probe or test the security of the service without our written permission, or use the service to violate any law

8. Your data

Customer data, meaning your policies, endpoint inventory, device events and everything else the service holds for you, is yours. You grant us a limited license to host and process it solely to provide and protect the service. We act as a data processor on your behalf. We do not sell customer data or use it to train machine learning models, and you can export your event data as CSV or JSON at any time.

9. Availability

We target 99.5% availability for the cloud control plane. That number is a target, not a contractual service level: these terms include no uptime guarantee and no service credits. We also do not promise that device events reach the dashboard within any specific time. Delivery is near-real-time in normal operation, but an offline endpoint, maintenance or an infrastructure incident can delay it, and agents buffer events locally until connectivity returns. Enforcement on the endpoint does not depend on cloud availability: the agent applies its last-synced policy while offline.

10. What PermitUSB does not promise

PermitUSB enforces the policy you define. It is one layer of a security program, not a guarantee. We do not promise that the service will block every malicious, unauthorized or harmful USB device, that a policy you write achieves any particular compliance outcome, or that the service is error-free. No security software can promise that, and vendors who do are not being straight with you. You remain responsible for your overall security program and for the policies you choose to enforce.

11. Intellectual property

We own the PermitUSB software, agent and service, and all related intellectual property. These terms grant you a limited, non-exclusive, non-transferable right to use them for your internal business during your subscription, not ownership. If you send us feedback or suggestions, we may use them without obligation to you.

12. Termination

You may terminate by canceling under section 5. We may suspend or terminate your account for material breach of these terms, including nonpayment, if the breach is not cured within 14 days of notice, or immediately for a breach that threatens the service or other customers. On any termination, your access ends at the effective date, data is preserved for 30 days and then deleted, and sections 8, 10, 11, 13, 14, 15 and 16 survive.

13. Warranty disclaimer

The service is provided as is and as available. To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

14. Limitation of liability

To the maximum extent permitted by law: neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data; and our total liability arising out of or relating to the service is capped at the fees you paid us in the 12 months before the event giving rise to the claim. Nothing in this section limits your payment obligations or either party’s liability for willful misconduct or for matters that cannot be limited under applicable law. Some jurisdictions do not allow certain limitations; in those, this section applies to the fullest extent permitted.

15. Indemnification

You will defend and indemnify JJMK against third-party claims arising from your breach of section 6 or 7, including deployment of the agent on endpoints you were not authorized to manage, or failure to provide legally required notice to your employees, except to the extent the claim results from our own breach of these terms.

16. General

Governing law and venue

These terms are governed by Oregon law, excluding its conflict-of-laws rules. Disputes will be resolved in the state or federal courts located in Multnomah County, Oregon, and both parties consent to that venue.

Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control.

Assignment

You may not assign these terms without our consent, except to a successor in a merger or sale of substantially all assets. We may assign them in connection with a merger, acquisition or sale.

Severability and waiver

If a provision is unenforceable, the rest remains in effect. Not enforcing a provision is not a waiver of it.

Entire agreement

These terms, the privacy policy, and your order details in Stripe are the whole agreement between us and supersede prior discussions. If you have a separately signed agreement with us, that agreement controls where it conflicts.

Notices

We send notices to your admin contact email. Legal notices to us go to legal@permitusb.com.

17. Changes to these terms

We may update these terms as the service evolves. For material changes we will email your admin contacts at least 30 days before the change takes effect, and continued use after that date is acceptance. The last-updated date above always reflects the current version.