Terms of Service

Effective 2026-07-24. Applies to obsideo.io, the Obsideo storage service (signup.obsideo.io, s3.obsideo.io, coordinator.obsideo.io), the obsideo-cli package, the @obsideo/sdk package, and the Obsideo MCP server / desktop extension.

The short version: Obsideo stores object data (encrypted before upload, if you want it private even from us) on a replicated network of storage providers, and continuously verifies that providers still hold it. We are an early-stage service and we describe our guarantees honestly rather than generously: this page states what we actually do, what we do not promise, and who is responsible for what. If a claim here ever conflicts with a marketing page, this page governs.

1. The agreement

These terms are an agreement between you and Obsideo ("we", "us"), operated from British Columbia, Canada. By creating an account, requesting credentials, or storing data with the service, you accept these terms. If you are accepting on behalf of an organization, you confirm you have authority to bind it.

2. The service

Obsideo provides S3-compatible object storage on a distributed network of storage providers. It is designed for encrypted backups, artifacts, exports, and application file storage. Every stored object is placed on multiple provider nodes (three by default) and its continued possession is re-checked with cryptographic challenge proofs on a continuous cycle. Obsideo is object storage: it is not a database, query engine, RPC service, or indexing platform, and nothing in these terms grants you such a service.

3. Accounts and credentials

Your email address is your account identifier. Credentials (S3 access keys, API keys, and your account signing keypair) are generated for or by you and are yours to safeguard. Anyone holding your credentials can read, write, and delete your stored data; we cannot distinguish them from you.
Re-running email verification for an existing account mints fresh credentials and revokes the previous keypair. This is by design; do not re-verify unless you intend to rotate.
Free accounts include the free-tier quota stated at signup (currently 12 GB, no payment card, no expiry). We may adjust the free-tier quota for new signups at any time; we will not reduce your existing stored data's quota below what you already store without notice.

4. Encryption: what we do, what you do

The platform is built so that it cannot read content you encrypt client-side. Keys are generated and held on your machines and never enter Obsideo's systems. Storage providers and the coordinator hold bytes as sent.

Encrypt-first pattern (S3 surface): the storage layer stores whatever bytes you send. If you want content unreadable by Obsideo and by providers, you must encrypt before upload (our docs show verified patterns). If you upload plaintext, it is stored as plaintext.
Managed mode (SDK): the SDK encrypts client-side using keys derived from your recovery manifest, before any byte leaves your machine.
External mode (SDK): you hand the SDK bytes you already encrypted with your own encryption layer. The SDK does not encrypt or decrypt for you.

External-mode attestation. If your account uses external mode, you accepted the following attestation at account creation, and it is a term of this agreement: "I will encrypt my data client-side before uploading. Obsideo cannot decrypt my data and is not responsible for plaintext exposure if I fail to encrypt." Delivering ciphertext (not plaintext) to the SDK is your responsibility. The platform accepts opaque bytes and cannot detect a failure to encrypt; if you ship plaintext in external mode, that is your breach of this agreement, and Obsideo bears no responsibility for the resulting exposure.

Key loss is unrecoverable by design. If you lose your encryption keys or recovery manifest, we cannot decrypt, reset, or recover your content. The ciphertext remains stored, but no one, including us, can turn it back into your data.

5. Durability: the honest model

We publish the durability model rather than a durability percentage. We do not offer an "eleven nines" style figure, because we will not publish a number our verification system cannot yet back.

Replication: every contracted object is placed on three provider nodes by default. Under-replication is treated as a defect to repair, and the network re-replicates automatically.
Verification: stored objects are challenge-verified with cryptographic possession proofs on a continuous cycle, targeting roughly every 4 hours. Proofs do fail, and the rate varies by node; that is why replication is 3x and providers are paid only for verified storage.
Economics: providers earn only on data they cryptographically prove they hold. A provider that drops data stops earning on it.
What we do not guarantee: operator and facility independence of replicas is not guaranteed (some nodes currently share a datacenter). Proofs are issued and recorded by Obsideo's own coordinator; they are not currently independently verifiable by you or third parties. Data loss, while engineered against, is possible.

Your role: Obsideo is designed to be a strong leg of a multi-copy backup strategy, not a reason to have no other copy. For data you cannot afford to lose, keep at least one copy outside any single service, including ours.

6. Availability

We do not currently offer an uptime SLA or service credits. The network is engineered to route around failed providers and complete requests at reduced redundancy rather than fail them, but as an early-stage service we make no contractual availability commitment yet. When we introduce an SLA, it will appear here with an effective date.

7. Recovery and service continuity

Normal restores are served through the coordinator and are available whenever the service is operating.
Recovery manifest: SDK users receive a local recovery manifest recording their objects, content hashes, and provider locations. Keep it with your keys; it is your inventory of what you stored.
Coordinator outage: the SDK's evacuation tooling can pull your ciphertext directly from storage providers using your most recent pre-fetched download authorizations and cached provider directory. This works for the validity window of those authorizations; it is a bounded bridge, not an indefinite capability. Durable coordinator-independent recovery is under active development, and this section will be updated when it ships.
Wind-down commitment: if we discontinue the service, we will give you at least 30 days written notice at your account email, keep downloads operating during that period at no additional charge, and publish instructions for retrieving all stored data before shutdown.

8. Deletion

Deletes are authorized by your account credentials. The coordinator has no administrative delete path, so the platform cannot destroy your contracted data unilaterally.
Deleted or no-longer-contracted data stops being paid for, and providers prune it in their own economic interest; removal from all provider disks is eventual, not instantaneous.
Storage providers run hardware they own. The protocol makes retaining paid data economically rational and deleting it economically irrational, but no protocol can make deletion by a hardware owner physically impossible; replication across nodes is the protection.

9. Pricing and payment

Free tier: 12 GB, no card, no expiry, for new signups while offered.
Paid storage: $15 per TB-month, billed on logical (not replicated) size, egress included, unless a separate written agreement with you states otherwise.
Storage that is no longer paid for or under contract is treated as deleted (section 8). We will contact your account email before releasing lapsed paid storage.
Prices for new commitments may change; we will not change the price of a prepaid or contracted period retroactively.

10. Acceptable use

Store only content you have the right to store. Illegal content, malware distribution, and content that victimizes others are prohibited, and we may suspend accounts and refer reports to authorities where required by law.
We cannot inspect client-side-encrypted content, and we do not try. Enforcement is limited to what we can see: metadata, usage patterns, and credible third-party reports.
Object keys (file names) are stored in the clear; do not put sensitive information in them.
No abuse of the service itself: no attempts to disrupt the network, defraud the payment or proof system, or circumvent quotas.

11. Warranties and liability

The service is provided "as is" and "as available", without warranties of any kind, express or implied, including fitness for a particular purpose and non-interruption. To the maximum extent permitted by law: our total aggregate liability for any claims arising out of or relating to the service or these terms is capped at the fees you paid us in the 12 months before the event giving rise to the claim; and we are not liable for indirect, incidental, special, or consequential damages, including lost profits or lost data, even if advised of the possibility. Nothing in these terms excludes liability that cannot be excluded under applicable law.

12. Changes, suspension, termination

We may update these terms; material changes will be announced at your account email or on this page with an updated effective date, and continued use after the effective date is acceptance.
You can stop using the service and delete your data at any time (sections 5 and 8 of the privacy policy cover account records).
We may suspend or terminate accounts for breach of these terms, non-payment, or legal necessity. Except where legally prevented, we will notify you and provide a reasonable window to retrieve your data; the wind-down commitment in section 7 applies to full service discontinuation.

13. Governing law and contact

These terms are governed by the laws of British Columbia, Canada, and applicable Canadian federal law, without regard to conflict-of-law rules. Questions, notices, or disputes: regan@obsideo.io. We prefer to resolve issues directly and quickly; email us first.