Compliance & model licensing

Every model we serve is open-weight and published under its own licence. We do not serve proprietary models through undisclosed arrangements, and nothing in your stack depends on a grey-area resale relationship.

The model’s licence governs your use of its output. Our terms do not override it. Most licences here are permissive, but some carry conditions — acceptable-use clauses, attribution, or restrictions above a user-count threshold. If your use is commercial, read the licence for the specific model you intend to use.

We bill on metadata, not content. Prompts and outputs are not written to our long-term stores, do not appear in usage history, and are never used to train any model. The privacy policy states this in full, including the two exceptions.

Retention windows, subprocessors and international transfer mechanisms are set out at /privacy#retention. We will sign a DPA; request one at affiliate@xark.io.

• TLS for all traffic, in transit end to end.
• API keys stored as hashes. A key is displayed once, at creation, and cannot be recovered afterwards — only rotated.
• Per-key spending caps, so a leaked key has a bounded blast radius.
• Least-privilege access to production, limited to staff who need it, and logged.
• Authentication delegated to Clerk, which supports SSO, MFA and session revocation. We never handle your password.
• Card data handled entirely by a PCI-DSS compliant processor. Full card numbers never reach our systems.

We do not currently hold a SOC 2 or ISO 27001 attestation, and we are not going to imply otherwise. If your procurement process requires one, tell us at affiliate@xark.io so we can tell you where that work stands rather than leaving you to guess.

Report security issues to affiliate@xark.io. Include enough detail to reproduce. We acknowledge within two business days and will keep you updated until it is resolved.

We will not pursue legal action over good-faith research that respects user privacy, avoids degrading the service, and does not access, modify or exfiltrate data belonging to anyone other than you. Please give us a reasonable window to fix an issue before publishing.

Prohibited uses are listed in the terms of service. In summary: nothing illegal, no CSAM, no non-consensual intimate imagery, no targeted harassment, no malware, no impersonation intended to deceive.

Report abuse originating from the platform to affiliate@xark.io.

The service is not available to users in jurisdictions subject to comprehensive sanctions, or to parties on applicable restricted-party lists. By using it you confirm you are not such a party and will not re-export access in violation of applicable law.

Live service status is at /status. For a security incident affecting your data, we notify affected account holders by email without undue delay, and regulators where the law requires it — including within 72 hours under the GDPR.