Skip to main content

Aurora Terms of Service

Effective date: 16 September 2026 Version: 2.0

Provider: Aurora Infrastructure EU spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Kraków, Poland, ul. Wadowicka 6/88, 30-415 Kraków, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy Krajowego Rejestru Sądowego), KRS 0001166368, NIP 6793328163, share capital PLN 5,000 ("Aurora", "Provider", "we", "us").

Portal: https://portal.aur.lu • Company site: https://www.aurorainfra.ai • Documentation: https://docs.aur.lu Support: support@aurorainfra.ai • Legal notices: legal@aurorainfra.ai • Abuse / illegal-content reports: abuse@aurorainfra.ai

These Terms of Service (the "Terms") form a binding agreement between Aurora and the business or other entity you represent — or, if you do not represent an entity, you personally, acting for professional purposes or as a consumer where Section 20.4 permits — (the "Customer", "you") governing your access to and use of the Aurora cloud services described in Section 3, the Portal, APIs, and Documentation (together, the "Services"). You accept these Terms by clicking to accept during account creation (and again when activating a paid plan). Before acceptance, and at any time afterwards in the Portal, we make the current and prior versions of these Terms available in a downloadable format that you can store and reproduce unchanged (Article 384 § 4 of the Polish Civil Code; Article 8 of the Act of 18 July 2002 on Providing Services by Electronic Means). Access to the Services is conditional on acceptance.

Incorporated documents. The following are part of these Terms: (a) the Acceptable Use Policy in Schedule A ("AUP"); (b) the Data Processing Addendum in Schedule B ("DPA"); (c) the Privacy Policy available on our websites (which describes how we handle personal data and is provided for information; it is not a contract term except where it records your instructions); and (d) the Documentation. If documents conflict, the order of precedence is: a signed order form or enterprise agreement (if any) → the DPA (for processing of personal data within Customer Content) → these Terms → the AUP → the Documentation.

Business and consumer use. The Services are designed for businesses and professionals. Consumers may purchase self-service paid Services only where the Portal expressly enables consumer purchases for their billing country (currently the United States, Singapore, and Hong Kong) — Section 20.4 applies to them. Elsewhere the Services are offered to businesses and professionals only. Section 20.3 addresses the mandatory rights of Polish sole traders to whom consumer-type protections apply under Polish law.

These Terms also constitute the regulamin świadczenia usług drogą elektroniczną (terms of provision of services by electronic means) required by the Polish Act of 18 July 2002 on Providing Services by Electronic Means. Section 21 contains the technical requirements and complaint procedure required by that Act.

1. Definitions​

  • "Account" — the Customer's tenant on the Portal, including all Users, workspaces, and resources under it.
  • "Customer Content" — data, files, objects, disk images, virtual-machine contents, prompts, and other materials that you (or your Users or end users) upload to, store in, transmit through, or process with the Services. Customer Content does not include Telemetry Data or account information.
  • "Documentation" — the technical documentation for the Services published at docs.aur.lu, as updated from time to time.
  • "Early Access Service" — a Service or feature identified as "early access", "beta", "preview", "trial-only", or similar in the Portal, the Documentation, or these Terms.
  • "Fees" — the amounts payable for the Services, as published in the Portal or agreed in an order form.
  • "Aurora Storage Provider" — a Filecoin storage-provider instance operated by Aurora on Aurora-controlled infrastructure located in the European Union (Sections 3.2 and 4.4).
  • "Filecoin Network" — the public, decentralized Filecoin storage network and protocol. Independent third parties operate storage providers on the network worldwide; storage deals for Customer Content are, however, concluded exclusively with Aurora Storage Providers in the current region (Sections 3.2 and 4.4(a)). Public retrievability by content identifier (Section 4.4) is a property of the protocol, regardless of who stores the data.
  • "Output" — content generated by a Model in response to your prompts through the Inference Service.
  • "Model" — a machine-learning model made available through the Inference Service.
  • "Prepaid Balance" — amounts you pay in advance that are credited to your billing account and drawn down against invoices (Section 7.4).
  • "Telemetry Data" — logs, metrics, usage records, and other operational and diagnostic data generated by the Services, excluding the content of Customer Content.
  • "User" — an individual whom you authorize to access your Account (including via invitation), or who uses your API credentials.

2. Account Registration and Eligibility​

2.1 Registration. To use the Services you must create an Account, providing accurate and current information (currently: first and last name, email address, organization name, and a password). You must keep this information up to date. We may decline registrations, and may use anti-abuse measures at signup (including CAPTCHA and rejection of disposable email addresses).

2.2 Capacity; age. You represent that (a) you are at least 18 years old and have full legal capacity; (b) you are entering into these Terms either in connection with a business or professional activity or, where Section 20.4 permits, as a consumer; and (c) if you act for an entity, you are authorized to bind it.

2.3 Email verification. You must verify your email address. We may restrict the Account until verification is complete.

2.4 Users and roles. You may invite Users to your Account and assign roles. You are responsible for all activity in your Account, including acts and omissions of your Users and anyone using your credentials or API keys, as if they were your own. You will ensure your Users comply with these Terms.

2.5 Credentials and API keys. Keep passwords, API tokens, and S3 access keys confidential. Secrets for API tokens and S3 access keys are displayed once at creation and cannot be re-displayed; API-token secrets are stored by us only in hashed form, and S3 access-key secrets are held in our storage gateway's protected credential store as required for request authentication. If lost, they must be revoked and re-issued. Notify us promptly at support@aurorainfra.ai of any suspected compromise. We are not liable for losses caused by unauthorized use of credentials that occurs other than through our fault.

2.6 One trial per customer. Unless we agree otherwise, each Customer (per legal entity or natural person) may register for one free trial only. We may refuse or revoke additional trials, including trials registered through related entities to circumvent this limit.

2.7 Accounts via partners. If your Account is provisioned by an authorized Aurora partner or reseller, your commercial terms (including pricing and billing) may be set by the partner agreement; these Terms continue to govern your use of the platform unless we tell you otherwise.

3. The Services​

3.1 Overview. Aurora currently offers:

  • Object Storage Service ("Aurora S3") — multi-tenant, S3-API-compatible object storage with optional publication to the Filecoin Network (Section 4);
  • Compute Service ("Aurora Compute") — virtual machines, block volumes, snapshots, and virtual networking (Section 5), currently an Early Access Service;
  • Inference Service ("Aurora Inference") — an OpenAI-API-compatible interface to open-weight AI models hosted by Aurora (Section 6);

together with the Portal, APIs, and Documentation.

3.2 Regions and data location. Services are provided from infrastructure located in the European Union. Currently: the Object Storage region is France (Albi), and Customer Content stored there — including its Filecoin copies, which are made exclusively with Aurora-operated storage providers located in the European Union — remains on EU infrastructure; stored data may additionally be backed up, in whole or in part, to a secondary Aurora location in France; and the Inference Service is served from infrastructure in Kraków, Poland. Available regions are listed in the Portal or Documentation. We may introduce additional regions in the future, including regions using third-party Filecoin storage providers; any such options will be clearly identified as separate regions and introduced with a corresponding update to these Terms (Section 17). Section 4.4 describes the public-retrievability characteristics of the Filecoin Network.

3.3 Compatibility disclaimers. "S3-compatible" means we implement commonly used S3 API operations; we do not promise full feature or behavioral parity with Amazon S3, and specific operations, headers, consistency behaviors, and error semantics may differ (see Documentation). "OpenAI-compatible" refers to API request/response format only. Amazon S3 is a trademark of Amazon Web Services, Inc.; OpenAI is a trademark of OpenAI; Qwen is a trademark of Alibaba Group Holding Limited; DeepSeek is a trademark of Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. Model names are used solely to identify the third-party Models hosted on the Inference Service; all trademarks remain the property of their respective owners. Aurora is not affiliated with, endorsed, or sponsored by Amazon, OpenAI, or the developers of the Models.

3.4 Service evolution. We may improve or modify the Services over time. Section 17 governs changes that materially reduce functionality.

3.5 Support. We provide reasonable support by email at support@aurorainfra.ai during business hours (Central European Time) on Polish business days. We do not commit to response times under these Terms; enhanced support may be offered under separate agreements.

3.6 No SLA at self-service tier. We provide the Services with reasonable skill and care, but we do not offer an availability commitment (SLA) or service credits under these Terms. Planned maintenance will be announced in advance where reasonably practicable. Availability commitments may be agreed in separate enterprise agreements.

4. Object Storage Service (Aurora S3)​

4.1 What it is. S3-API-compatible object storage served from our EU infrastructure, with automatic tiering of object data to the Filecoin Network for durability.

4.2 Features and limits. Current features include bucket versioning, Object Lock (Governance and Compliance modes, and legal holds), multipart upload, and scoped S3 access keys (with per-bucket scoping and optional expiry). Cross-region replication, object ACLs, customer-defined bucket policies, and customer-defined lifecycle rules are not currently offered. Current technical limits are set out in the Documentation and include: maximum 5 GB per single PUT; maximum 5 TB per object via multipart upload (up to 10,000 parts); bucket and access-key quotas per plan. Incomplete multipart uploads are automatically deleted after 24 hours.

4.3 Encryption choice — your responsibility. (a) Encryption at rest is configured per bucket, only at bucket creation, and cannot be changed afterwards. (b) If you enable encryption, objects are encrypted with provider-managed keys (SSE-KMS semantics, one key per bucket, managed in our key-management infrastructure). Customer-supplied or customer-managed keys are available only by arrangement with support. (c) If you do not enable encryption, your objects are stored and published in plaintext — see Section 4.4. (d) You are solely responsible for selecting the encryption mode appropriate for your data. Do not store personal data, confidential information, or regulated data in unencrypted buckets.

4.4 Filecoin publication — read this carefully. (a) Object data is transitioned to the Filecoin Network automatically, typically immediately after upload. The Filecoin Network is a public, decentralized storage network. In the current region, Filecoin storage deals for your data are made exclusively with Aurora-operated storage providers located in the European Union (France), so your object data — including its Filecoin copies — remains on EU infrastructure (Section 3.2). Regions using third-party or non-EU storage providers, if introduced, will be clearly identified as separate regions (Section 3.2). (b) Data stored on the Filecoin Network is content-addressed. For unencrypted buckets, this means your object data is publicly retrievable by anyone who knows or discovers its content identifier (CID) — a property of the public network's protocol that applies regardless of where the data is physically stored. Third parties who retrieve such data may access, copy, index, cache, or mirror it outside our control. (c) By storing data in an unencrypted bucket, you instruct us to publish that data to the Filecoin Network in publicly retrievable form. (d) Deletion limits. Deleting an object (or your Account) removes it from our primary systems and immediately ends its availability from Aurora-operated retrieval endpoints; the object's content identifier (CID) is unpublished from Aurora-operated indexes without undue delay, and the associated copies on Aurora-operated storage providers are removed (including through deal termination or sector turnover) within 365 days — the maximum term of the underlying Filecoin storage deals we make. However, copies of unencrypted data that third parties have already retrieved from the public network cannot be recalled by us. For encrypted buckets, what resides on the Filecoin Network is ciphertext; upon deletion of the bucket, or earlier on your request to support@aurorainfra.ai, we destroy the bucket's encryption key under our documented, logged deletion procedure within 10 business days — key destruction is irreversible and renders the ciphertext permanently unreadable. (e) We may retrieve your data from the Filecoin Network to serve your requests.

4.5 Deletion and versioning semantics. In versioned buckets, a simple delete creates a delete marker; deleting a specific version is irreversible. Object Lock (especially Compliance mode) prevents deletion for the configured retention period even at your request and even by us; storage Fees continue to accrue for locked objects. You are solely responsible for configuring retention periods and legal holds, and Object Lock is a platform feature, not a representation that any particular records-retention law is satisfied.

4.6 Not a backup service. The Object Storage Service is designed for durability through redundant storage, but it is not a backup, archival-compliance, or disaster-recovery service, and we do not warrant any specific durability level. Maintain independent backups of data you cannot afford to lose.

5. Compute Service (Aurora Compute) — Early Access​

5.1 What it is. Virtual machines with block volumes, volume snapshots, SSH key management, and virtual networking (VPCs, private networks, and public IPv4 addresses with shared source-NAT egress by default and optional dedicated public IPs with static NAT), based on Apache CloudStack.

5.2 Early Access status. The Compute Service is currently an Early Access Service (Section 8). In particular: (a) usage may currently be free of charge or arranged individually; usage is measured per Section 7.2(d) even where no fee currently applies; we may introduce or change Compute pricing with at least 30 days' notice, after which continued use constitutes acceptance of the new pricing; (b) features, quotas, and capacity may change; and (c) no availability commitment applies.

5.3 Networking and in-guest security — your responsibility. The Compute Service does not currently provide a managed firewall or security-group feature, and virtual networks default to allowing traffic. You are solely responsible for securing your instances, including operating-system firewalls, exposed services, patching, and access control. We may implement network-level abuse mitigations (including blocking specific ports, such as outbound TCP port 25, or rate-limiting traffic) to protect the platform and third parties. If your resources become the target of a denial-of-service attack, we may temporarily null-route ("blackhole") traffic to the affected addresses to protect the platform, other customers, and upstream networks; upstream transit providers may apply equivalent measures independently of us.

5.4 Instance lifecycle. Deleting an instance expunges it immediately and irreversibly, including its root volume. Enable delete protection ("protected mode") for instances you want to protect against accidental deletion. Detached volumes and snapshots persist until you delete them and may incur Fees where applicable. Volume resizes are increase-only. We do not provide console (VNC) access; access your instances over the network (e.g., SSH).

5.5 No backups. We do not back up your instances, volumes, or snapshots. Snapshots you create are stored on the same platform and are not an independent backup. Maintain external backups.

5.6 Capacity and quotas. Compute resources are subject to per-Account quotas (instances, vCPU, memory, storage, IPs, networks, snapshots) shown in the Portal or available on request from support@aurorainfra.ai. We may decline or queue capacity requests.

6. Inference Service (Aurora Inference)​

6.1 What it is. An OpenAI-API-compatible endpoint (chat and text completions, including streaming) serving open-weight Models hosted on Aurora-controlled infrastructure. The available Models and their prices are listed in the Portal/Documentation. We do not proxy your prompts to third-party AI API providers.

6.2 Prompt and output confidentiality. We process prompts and Outputs transiently to provide the Service. We do not store or log the content of your prompts or Outputs, and we do not use your prompts or Outputs to train Models. We record only technical metadata and token counts for billing, quota, and abuse-prevention purposes (model, endpoint, request status, token counts, timestamps, tenant/user identifiers).

6.3 Model licenses; changes. Models are developed by third parties and may be subject to their own license terms; you must comply with license terms applicable to your use. The license governing each Model (currently: the Apache License 2.0 for Qwen models; the MIT License for DeepSeek models) is identified, with a copy or link, in the model catalog in the Portal or Documentation. If a Model's license imposes use restrictions on users, we will identify those restrictions in the model catalog, and they apply to your use as if set out in the AUP. Model availability may change; we will give at least 30 days' notice before retiring a Model where reasonably practicable, except for security or legal reasons.

6.4 Outputs — no warranty; your responsibility. (a) As between you and us, and to the extent permitted by law and any underlying model license, we assign to you (or waive in your favor) any rights we may have in Outputs, and we will not assert any right in Outputs against you or your end users. We make no representation that Outputs are protectable by intellectual-property rights. (b) Outputs are generated by statistical models and may be inaccurate, incomplete, biased, or unsuitable. Do not rely on Outputs without human review. Outputs are not professional (legal, medical, financial, or other) advice. Similar or identical Outputs may be generated for other customers. (c) The Inference Service applies no content moderation or filtering. The Inference Service provides programmatic access to third-party open-weight Models as hosting infrastructure and is not offered as a finished AI system for end users. Where you integrate the Inference Service into an AI system that you place on the market, put into service, or deploy, you — not Aurora — are the provider or deployer of that AI system under Regulation (EU) 2024/1689 (AI Act), as amended, and you are solely responsible for its compliance, including the prohibited practices of Article 5 (in application since 2 February 2025) and the transparency obligations of Article 50 (applying from 2 August 2026) — disclosure of AI interaction and machine-readable marking and detectability of AI-generated or manipulated content, which the Inference Service does not apply on your behalf. As between the parties, the upstream developers of the Models remain the providers of those general-purpose AI models within the meaning of the AI Act; Aurora hosts them without modification and does not place them on the market under its own name or trademark. You must not use the Inference Service for uses prohibited by the AUP.

6.5 Rate limits and metering. Requests are subject to rate and capacity limits. Usage is metered per token as described in Section 7.2.

7. Fees, Billing, and Payment​

7.1 Plans. The Services are offered as (a) a free trial (Section 9) and (b) a usage-based paid plan ("plan-as-you-go") billed monthly in arrears against metered usage, activated through the Portal checkout. Self-service activation of the paid plan is currently available to customers billed in: (i) the European Union, upon providing an EU VAT identification number validated through the European Commission's VIES service; (ii) the United States; (iii) Singapore, where GST-registered businesses should provide their GST registration number; and (iv) Hong Kong. Consumer purchases in the United States, Singapore, and Hong Kong are governed by Section 20.4. If your billing country is not listed, contact support to discuss options. Enterprise plans are available under separate agreements.

7.2 Meters. Current billable meters are: (a) Storage — stored volume in TiB-months, computed by sampling stored bytes, taking the daily peak, and summing daily peaks divided by 30 for the billing period; (b) Data transfer out (egress) — TiB transferred out of the Object Storage Service to the internet; (c) Inference tokens — input (non-cached), cached input, and output tokens, priced per million tokens per Model; (d) Compute — once fees are introduced under Section 5.2: instance running time per service offering, public IPv4 address allocation time, network data transfer, and volume and snapshot storage over time. We do not currently charge for S3 API requests or for Compute during Early Access; we may introduce additional meters or charges with at least 30 days' notice. Metering values determined by our measurement systems are presumed accurate; you may contest them with your own evidence within 30 days of the relevant invoice, and we will correct demonstrated errors. Egress attributable to switching or to the post-termination retrieval period is charged only as Section 12.5 permits. Prices are shown in the Portal before checkout and are generally denominated in US dollars (USD) unless a different currency is stated at checkout; unless stated otherwise, prices are net of VAT and other applicable taxes. Where Polish VAT applies, the VAT amount is additionally shown in PLN as required by law.

7.3 Payment processing; invoices. Payments are processed by Stripe. You authorize us (through Stripe) to charge your selected payment method for Fees due. Invoices are issued monthly. Where you have a payment method on file, we charge it automatically and the invoice is due upon issuance; otherwise, invoices are payable by the due date stated on the invoice (or, if none, within 14 days of issue). Where required by Polish law, invoices are issued as structured invoices in the National e-Invoicing System (KSeF): for Customers identified by a Polish NIP, the structured invoice is made available through KSeF, which constitutes delivery; for other Customers, you agree that we deliver invoices (or, where applicable, visualizations of structured invoices bearing the required verification code) electronically — via the Portal, email, or our payment processor — as the agreed manner of delivery, you consent to receiving invoices electronically, and you will not require paper invoices. Payment-processor documents are billing and payment summaries where a KSeF structured invoice is the legally issued invoice. If you initiate a chargeback of a properly charged amount, we may re-invoice the amount together with documented costs charged to us by the payment processor, and Section 10 applies to the resulting unpaid balance.

7.4 Prepaid Balance. Activation of the paid plan requires an initial prepaid amount, credited to your billing account and automatically applied against invoices. The Prepaid Balance may be used solely to pay Fees owed to us for the Services; it is not transferable or redeemable with any third party, cannot be used to make payments to anyone other than us, and accrues no interest. It constitutes an advance payment for the Services and is not a deposit, payment account, payment instrument, or electronic money. Upon closure of your Account we will refund any unused Prepaid Balance at your request, less any outstanding Fees, to your original payment method or — where that method is unavailable, expired, or the payment schemes' refund time limits have passed — by bank (SEPA/wire) transfer to an account in your name, subject to verification. Requests made more than 12 months after closure may require additional verification and processing time; your statutory rights remain unaffected. Promotional or bonus credits granted by us have no cash value, are non-refundable, and expire as stated at grant (or after 12 months if unstated).

7.5 Taxes. Fees are exclusive of VAT and similar taxes, which will be added where required. If you provide a valid EU VAT ID, the reverse-charge mechanism may apply to cross-border B2B supplies. Business customers outside the EU are responsible for self-accounting any VAT, GST, consumption, or similar tax applicable to cross-border supplies in their own jurisdiction; where no such tax applies, none is added. Where we are required to collect tax on sales to consumers (for example, US state sales tax in states where we are registered, or Singapore GST should we become registered under the overseas-vendor regime), it is calculated and charged at checkout. You are responsible for providing accurate tax information and for any taxes on your side (including withholding, which you must gross up so that we receive the full invoiced amount, unless prohibited by law).

7.6 Late payment. Overdue amounts bear statutory interest for late payment in commercial transactions (Polish Act of 8 March 2013 on Counteracting Excessive Delays in Commercial Transactions), and we may recover statutory debt-recovery compensation and reasonable collection costs. Section 10 describes suspension for non-payment.

7.7 Fee changes. We may change prices for valid reasons — changes in our costs of providing the Services (energy, hardware, licenses, network, taxes, or regulatory burdens), proportionately to the cost change, or changes in the scope of the Services — with at least 30 days' notice by email to your Account email address. Changes apply to usage after the effective date. If you object, you may terminate under Section 11 with effect no later than the effective date, and Section 7.4 (refund of unused Prepaid Balance) applies.

7.8 Continuing charges. Cancelling a subscription or ceasing use does not by itself delete stored resources. Storage and other resource-based Fees continue to accrue until you delete the resources or your Account is closed.

7.9 No refunds except as stated. Except as set out in Section 7.4, Section 11.4, or as required by mandatory law, Fees are non-refundable.

8. Early Access Services​

Early Access Services (including the Compute Service, and any feature so identified) are provided for evaluation "as available": they may be changed, suspended, or discontinued at any time, may have reduced or no support, are excluded from any availability commitments, and are used at your own risk. We may convert an Early Access Service to general availability, at which point standard terms and pricing apply (with notice under Section 7.2/17). Our aggregate liability for an Early Access Service is limited as set out in Section 16.3.

9. Free Trial​

9.1 Scope. The free trial lasts 30 days from Account creation and includes the allocation shown at signup or in the Portal (currently: Object Storage up to 5 GiB, 1 bucket, 5 access keys, and access to the Inference Service; the Compute Service is not included in the trial). No payment method is required. Trial allocations may be changed prospectively at any time.

9.2 Trial limitations. Trials are for evaluation. We may throttle, cap, or restrict trial usage to prevent abuse, and may revoke trials that violate Section 2.6 or the AUP. The trial is provided "as is", without support commitments. The free trial is a non-production service provided for testing and evaluation purposes for a limited period within the meaning of Article 31(2) of Regulation (EU) 2023/2854 (Data Act); we hereby inform you, pursuant to Article 31(3) of that Regulation, that the obligations of its Chapter VI which Article 31 disapplies do not apply to the trial — Section 12 nevertheless applies to retrieval of your trial data, and Section 9.3 preserves your retrieval window.

9.3 End of trial. Unless you upgrade to a paid plan: (a) at the end of the trial your Account becomes read-only; (b) 7 days after trial end the Account is suspended (access denied); and (c) we may delete Customer Content and close the Account no earlier than 30 days after suspension. At any time before deletion, we will restore read-only access upon request to support@aurorainfra.ai so that you can retrieve your Customer Content. Upgrading during this window restores access and preserves your data.

10. Suspension​

10.1 Non-payment. If an invoice remains unpaid, the following steps may follow; we will send a reminder to your Account email before each step: (a) 14 days past due — we may place your Account in read-only mode; (b) 28 days past due — we may cancel your subscription and suspend the Account (access denied) and/or terminate for cause (Section 11.3(c)); termination is followed by the 30-day retrieval period and deletion under Section 11.4. Non-payment limits your use of the Services, not your access to your data: retrieval remains available in read-only mode, during suspension (on request to support@aurorainfra.ai — Section 10.3), and during the post-termination retrieval period (Section 11.4(b)), and egress solely to retrieve your Exportable Data while suspended or during the retrieval period is free of charge. While the Account is in read-only mode, full payment restores service. After suspension, self-service payment and reactivation are no longer available: contact support@aurorainfra.ai to settle the outstanding balance and request reinstatement. We will consider reinstatement requests in good faith, but we cannot guarantee that the Account or its resources can be restored after suspension.

10.2 Other suspension grounds. We may suspend or restrict the Account or specific resources, with notice where practicable (before or promptly after), if: (a) you materially breach these Terms or the AUP; (b) your use poses a security risk to the Services or third parties, or causes material harm to platform integrity; (c) suspension is required by law or a competent authority; or (d) usage substantially exceeds quotas or indicates compromise. We will scope suspensions to what is reasonably necessary and lift them once the ground ceases.

10.3 Effect. Fees continue to accrue for stored resources during suspension. Suspension itself does not delete Customer Content and does not affect your rights under Section 12: upon request to support@aurorainfra.ai we will restore read-only access to the extent necessary for you to retrieve your Exportable Data; outstanding Fees remain payable. Suspension does not limit our termination rights.

11. Term and Termination​

11.1 Term. These Terms apply from Account creation until terminated.

11.2 Termination by you. You may stop using the Services and terminate at any time by notice to support@aurorainfra.ai (or via the Portal, where a dedicated option is available), with effect at the end of the current billing period at the latest. No termination fee applies; the maximum notice period you can be required to give is 30 days.

11.3 Termination by us. We may terminate: (a) for convenience on at least 60 days' notice by email; (b) for cause with immediate effect if you materially breach these Terms (including the AUP) and — where the breach is curable — fail to cure within 14 days of notice; (c) immediately where required by law, where an invoice remains unpaid more than 28 days past due (Section 10.1), or where your Account has been suspended without remedy for more than 30 consecutive days under Section 10.2; or (d) immediately for free trial Accounts under Section 9.3.

11.4 Effect of termination; data retrieval; deletion. Upon termination or expiry: (a) your access rights end, and outstanding Fees become due; (b) for at least 30 days after the effective date of termination, your Customer Content remains retrievable in a commonly used, machine-readable format via the Service APIs (Section 12.4; egress in this window is free of charge per Section 12.5); where the Account was suspended before termination, we will re-enable read-only API access for the retrieval period upon your request to support@aurorainfra.ai; where specific content has been removed or disabled under Section 13.4 or an order of a competent authority, that content — and only that content — is excluded from retrieval; (c) after the retrieval period we will delete Customer Content (Section 12.4), except where Union or Member State law or Object Lock retention requires otherwise; Account data may be retained for the establishment or defense of claims as described in the Privacy Policy; Section 4.4(d) applies to copies already retrieved by third parties; (d) if we terminate for convenience under 11.3(a), we will refund the unused Prepaid Balance without a request being needed and, where you have prepaid for a period, the pro-rata unused portion. Sections intended to survive (including 4.4, 7, 13–16, 18–22 and accrued rights) survive termination.

12. Switching and Data Portability (EU Data Act)​

12.1 Your switching rights. We support your rights under Regulation (EU) 2023/2854 (the "Data Act") to switch to another provider of data processing services covering the same service type, to switch to your own on-premises ICT infrastructure, to use the Services in parallel with other providers, or to erase your data. You may export your Exportable Data at any time during the term using the Service APIs (for Object Storage, standard S3 API operations) in structured, commonly used, machine-readable formats, free of charge apart from Fees for your ordinary use of the Services.

12.2 Exportable Data; Switching Annex. "Exportable Data" means your input and output data, including metadata, directly or indirectly generated or co-generated by your use of the Services, together with your digital assets, excluding only assets of ours or of third parties protected as trade secrets or by intellectual-property rights. The categories of Exportable Data and digital assets for each Service, their formats, the export methods, an up-to-date register of the applicable data structures, standards, and open interoperability specifications, known restrictions, known risks to continuity, and the step-by-step switching procedure are exhaustively specified in the Switching and Portability Annex published at docs.aur.lu/switching — a versioned, dated document available for download before contracting in a form you can store and reproduce unchanged, which forms part of these Terms (the version current at your acceptance, or at an amendment under Section 17.2, applies). Exportable Data includes, at minimum: for Object Storage — objects, object metadata, version and Object Lock metadata, and bucket configuration; for Compute — volume and snapshot images in standard formats, and instance, network, and SSH-key configuration; for Inference — your usage and billing records and stored configuration. Exempted, to the extent necessary to protect our trade secrets: internal scheduler and placement logs and infrastructure-level diagnostics; this exemption does not impede switching, and your usage and billing records remain exportable.

12.3 Initiating switching; transition; termination. You may initiate switching (or elect erasure) by notice to support@aurorainfra.ai (or via the Portal, where a dedicated option is available), stating whether you will (a) switch to another provider (naming it where applicable), (b) move to your own infrastructure, or (c) erase your Exportable Data. The maximum notice period for initiating switching is 30 days. After the notice period, a transitional period of 30 calendar days begins, during which we, you, and any destination provider will cooperate in good faith; we will provide reasonable assistance, maintain service continuity, support your exit strategy (including by providing all relevant information), and maintain a high level of security throughout the switching process and the retrieval period. If completing switching within 30 days is technically unfeasible, we will notify you within 14 working days of your switching request, duly justifying the unfeasibility and indicating an alternative transitional period not exceeding 7 months; you may in any event extend the transitional period once, for a period you consider more appropriate for your purposes. The contract remains applicable, and this Section's duties continue, throughout the transitional period. The contract for the affected Service is terminated (i) upon successful completion of the switching process, or (ii) at the end of the notice period, where you elected erasure of your Exportable Data instead of switching; we will notify you of the termination, and Fees for the affected Service cease to accrue upon it, except charges permitted under Section 12.5.

12.4 Retrieval and erasure guarantee. After the end of the transitional period, you have a data-retrieval period of at least 30 calendar days during which your Exportable Data remains retrievable through the Service APIs. Following successful completion of switching and expiry of the retrieval period (or a later date agreed with you), we will fully erase all of your Exportable Data and digital assets from our primary systems — including destruction of bucket encryption keys, which is irreversible, logged, and renders encrypted Filecoin-resident ciphertext permanently unreadable — and will confirm the erasure, except only where Union or Member State law requires retention. Residual copies on Aurora-operated storage providers are removed within the period stated in Section 4.4(d); where such copies remain at the time of our confirmation, the confirmation states this, and a further confirmation is issued once removal completes. For encrypted buckets, erasure is effective upon key destruction. Section 4.4(d) applies solely to copies of unencrypted data that third parties already retrieved from the public network before erasure.

12.5 Charges. We do not impose switching charges or early-termination charges: switching-related assistance and data egress attributable to switching or to the retrieval period are free of charge. Egress for in-parallel use of another data processing service is charged at no more than cost. Standard Fees for your ordinary use of the Services remain payable until termination under Section 12.3. Information on applicable Fees, early-termination charges (there are none), and switching charges (there are none) is published in a dedicated section at www.aurorainfra.ai/legal/data-act.

12.6 Technical measures. For the Compute Service (infrastructural service), we take all reasonable measures to facilitate your achieving functional equivalence in the destination environment, and provide capabilities, adequate information, documentation, and technical support to that end. For the Object Storage and Inference Services, we provide open interfaces free of charge (including the documented S3-compatible and OpenAI-compatible APIs) with information sufficient to enable software to communicate with the Services, and will, on request, export Exportable Data in a structured, commonly used, machine-readable format. Nothing in this Section requires us to develop new technologies, or to disclose or transfer assets protected as trade secrets or by intellectual-property rights.

12.7 Infrastructure jurisdiction; governmental access. The information required by Article 28 of the Data Act — the jurisdictions to which our deployed ICT infrastructure is subject, and a description of the measures we take to prevent international governmental access to or transfer of non-personal data held in the EU where this would conflict with Union or Polish law — is published and kept current at www.aurorainfra.ai/legal/data-act. Section 13.5 describes our handling of governmental demands.

13. Customer Content; Acceptable Use; Illegal-Content Notices​

13.1 Your content, your responsibility. You retain all rights in Customer Content. You are solely responsible for Customer Content and your end users' data, including its legality, security, backup, and the decision where and how to store it (including encryption choices under Section 4.3). You represent that you have all rights and lawful bases necessary to store and process Customer Content on the Services and to grant the license in Section 13.2.

13.2 License to us. You grant us a non-exclusive, worldwide, royalty-free license to host, store, reproduce, transmit, display, and technically adapt Customer Content solely as necessary to provide the Services (including, where you so instruct under Section 4.4(c), publication to the Filecoin Network), to comply with law, or as you otherwise instruct.

13.3 Acceptable use. You must comply with the AUP (Schedule A). We do not monitor Customer Content proactively and have no general monitoring obligation, but we may investigate suspected abuse and act under Section 13.4 and the AUP's enforcement provisions. Good-faith, voluntary own-initiative investigations or measures against illegal content do not deprive us of the liability exemptions available to hosting providers (Article 7 DSA). We are not liable to you for good-faith removal or disabling of access to content in response to an order of a competent authority or a notice or credible report of illegality, where we inform you as provided in Section 13.4.

13.4 Illegal-content notices (DSA notice-and-action). Anyone may report allegedly illegal content hosted on the Services to abuse@aurorainfra.ai, providing: (a) a sufficiently substantiated explanation of why the content is considered illegal; (b) the exact electronic location of the content (e.g., URL(s), bucket/object identifier or CID, or, for Compute, IP address and port) and, where necessary, additional information enabling its identification; (c) the notifier's name and email address — except for notices concerning offences referred to in Articles 3–7 of Directive 2011/93/EU, which may be submitted anonymously; and (d) a statement confirming the notifier's bona fide belief that the information and allegations in the notice are accurate and complete. We will confirm receipt without undue delay where contact details are provided; assess notices in a timely, diligent, non-arbitrary, and objective manner, with human review and without automated decision-making; and inform the notifier and (where we act against content) the affected Customer of our decision without undue delay, with a statement of reasons and information on available redress, as required by Regulation (EU) 2022/2065 (the "DSA"). We may remove or disable access to content, suspend processing of notices from persistent bad-faith notifiers, and suspend Accounts that frequently provide manifestly illegal content. Where we remove or disable access to content (under this Section, the AUP, or an order of a competent authority), we will also block retrieval of the affected objects and their content identifiers (CIDs) from Aurora-operated retrieval endpoints and Aurora-operated Filecoin storage providers, so that the content ceases to be publicly retrievable from our infrastructure without awaiting expiry of the underlying storage deals; Section 4.4(d) applies only to copies already retrieved by third parties and to infrastructure outside our control. Our single point of contact for Member State authorities, the Commission, the Board, and recipients of the Services under DSA Articles 11–12 is legal@aurorainfra.ai; communications may be in English or Polish.

Terrorist-content policy (Regulation (EU) 2021/784). Terrorist content is prohibited on the Services (AUP A.1). Our contact point for removal orders under that Regulation is abuse@aurorainfra.ai, which may be addressed in Polish or English; we give effect to removal orders as required by Article 3 of that Regulation. We do not use automated tools to identify terrorist content. Where we remove or disable access pursuant to a removal order, we will inform the affected Customer and, on request, provide the reasons and available remedies, except where the competent authority requires non-disclosure for as long as required (Article 11 of that Regulation). In Poland the competent authority is the Head of the Internal Security Agency (Szef ABW).

13.5 Legal process. We may disclose Customer Content or Account data where required by law or a valid order of a competent authority. Unless legally prohibited — or where notification could prejudice the prevention or investigation of a criminal offence involving a threat to the life or safety of a person, in which case we notify law-enforcement or judicial authorities of our suspicion as required by Article 18 DSA — we will notify you before disclosure so you may seek protective measures, and will limit disclosure to what is required. For non-personal data held in the European Union, we will not grant a third-country governmental authority access or transfer where this would conflict with Union or Polish law: we act only as permitted by Article 32(2)–(3) of the Data Act, provide the minimum amount of data permissible, and inform you before complying, unless the demand serves law-enforcement purposes and such notice is prohibited.

13.6 Repeat infringers; rights-holder notices. We may terminate Accounts that repeatedly infringe third-party intellectual-property rights. Rights holders may use the Section 13.4 mechanism.

14. Security; Shared Responsibility; Personal Data​

14.1 Our responsibilities. We implement appropriate technical and organizational measures to protect the Services, including TLS 1.2+ in transit, optional encryption at rest (Section 4.3), hashed storage of API-token secrets, role-based access control, infrastructure secret management, and audit logging of S3 API operations.

14.2 Your responsibilities. You are responsible for: (a) credential and key hygiene (Section 2.5); (b) access configuration (bucket key scoping, User roles); (c) encryption-mode selection and its consequences (Sections 4.3–4.4); (d) in-guest security of Compute instances (Section 5.3); (e) backups (Sections 4.6, 5.5); (f) lifecycle, versioning, and Object Lock configuration (Section 4.5); and (g) the security and lawfulness of your applications and end-user relationships.

14.3 Security incidents. We will notify you without undue delay of a personal-data breach affecting your Customer Content, as set out in the DPA, and will inform affected Customers of other material security incidents affecting their resources where required.

14.4 Personal data. (a) Where we process personal data contained in Customer Content, we act as processor and you as controller; the DPA (Schedule B) applies and is incorporated into these Terms for all Customers. (b) Where we process personal data relating to you, your Users, and your representatives for our own purposes (account management, billing, security, analytics), we act as controller as described in the Privacy Policy. (c) Do not store personal data in unencrypted buckets. Publication to a public network is generally incompatible with data-protection obligations for personal data, and erasure cannot be guaranteed (Section 4.4(d)).

14.5 Security testing. You may perform vulnerability testing of your own Compute instances and your own applications hosted on the Services, provided it does not target the platform itself, shared infrastructure, or other customers, and does not involve denial-of-service techniques or volumetric load testing. Any other security testing (including of the Portal, APIs, or storage/inference infrastructure) requires our prior written consent.

15. Warranties; Disclaimers​

15.1 Mutual. Each party warrants that it may lawfully enter into these Terms.

15.2 Service warranty and disclaimer. We will provide the Services with due professional care. Otherwise, to the maximum extent permitted by law, the Services (including Early Access Services, trials, Models, and Outputs) are provided "as is" and "as available", and we disclaim all other warranties, express or implied, including fitness for a particular purpose, merchantability, non-infringement, uninterrupted or error-free operation, and any warranty regarding inherent properties of the public Filecoin protocol or the conduct of Filecoin network participants other than Aurora Storage Providers, or regarding other third-party networks and providers. To the extent any element of the Services were to qualify as a sale or a work (dzieło), the parties exclude warranty for defects — rękojmia (Articles 556 et seq. and 638 § 1 in connection with Article 558 § 1 of the Polish Civil Code); this exclusion does not apply to Customers under Section 20.3 or to defects fraudulently concealed (Article 558 § 2).

15.3 Third-party dependencies. The Services depend in part on third-party networks and services (including the public Filecoin protocol and network, payment processing, and identity providers). We are not responsible for acts or omissions of third parties outside our reasonable control — Aurora Storage Providers are our own infrastructure, not third parties for this purpose — without prejudice to our responsibility for our subcontractors under Section 19.2.

16. Liability​

16.1 Cap. To the maximum extent permitted by law, each party's total aggregate liability arising out of or relating to these Terms in any 12-month period is limited to the greater of (a) the Fees paid by you to us in the 12 months preceding the first event giving rise to liability, and (b) EUR 500.

16.2 Exclusions. To the maximum extent permitted by law, neither party is liable for lost profits, lost revenues, loss of goodwill, loss of anticipated savings, business interruption, loss or corruption of data (subject to our obligations under the DPA and Section 14), or indirect or consequential loss. The exclusion for loss or corruption of data does not apply to damage caused by our breach of these Terms (including Sections 11.4 and 12), the DPA, or Section 14; such damage remains subject to the cap in Section 16.1.

16.3 Early Access and trials. For free trials and Early Access Services, our total aggregate liability is limited to EUR 500.

16.4 Carve-outs. Nothing in these Terms excludes or limits liability: (a) for damage caused intentionally (Article 473 § 2 of the Polish Civil Code) or by gross negligence; (b) for death or personal injury caused by fault; (c) under mandatory provisions of law that cannot be contractually limited, including mandatory rights described in Section 20.3; or (d) your obligations to pay Fees, your indemnity under Section 18, or either party's breach of Section 22.6 (confidentiality) — which are not subject to the cap in 16.1, provided that liability for confidentiality breaches is capped at three times the amount in 16.1.

16.5 Your configuration choices. We are not liable for consequences of configuration decisions reserved to you, including publication of unencrypted data (Section 4.4), Object Lock settings, deletion of resources, or absence of backups, except where caused by our breach.

17. Changes to the Services and these Terms​

17.1 Changes to Services. We may change the Services for valid reasons (development, security, legal compliance, technical or economic necessity). For changes that materially reduce core functionality of a generally available Service, we will give at least 30 days' notice by email or the Portal, except where a shorter period is necessary for security or legal reasons. For backward-incompatible API changes we will aim to provide a reasonable migration period (at least 30 days where practicable). Early Access Services may be changed, suspended, or discontinued at any time as set out in Section 8, and the notice periods in this Section 17.1 do not apply to them; the introduction of or changes to Compute pricing remain subject to Section 5.2.

17.2 Changes to these Terms. We may amend these Terms solely for one or more of the following important reasons: (i) changes in law or in its authoritative interpretation, or judicial or administrative decisions, affecting these Terms or the Services; (ii) security or fraud-prevention necessity; (iii) technical changes to, or discontinuation of, Services under Section 17.1; (iv) the introduction of new Services or features; (v) changes in our costs of providing the Services, proportionately to the cost change (as regards Fees, Section 7.7); or (vi) correction of errors or clarifications that do not worsen your position. We will give notice by email to your Account email address, attaching or linking the full amended text in a durable, downloadable format, at least 30 days before the effective date. If you do not agree, you may terminate with effect no later than the effective date (Section 11.2); if you do not terminate, the amended Terms bind you from that date (Article 384¹ of the Polish Civil Code). Changes that are (a) required by law, (b) purely beneficial to you, or (c) applicable only to new features or to Early Access Services that you have not yet started using may take effect without the notice period; the notice period and the termination right above always apply to changes affecting Early Access Services you already use, your rights under Section 12, Schedule B, and Customers under Section 20.3.

18. Indemnity​

You will defend and indemnify Aurora and its officers, employees, and contractors against third-party claims, and resulting damages and reasonable costs (including legal fees), to the extent arising from: (a) Customer Content (including its publication under Section 4.4 or personal data it contains); (b) prompts submitted to the Inference Service by you or on your behalf, and your use, publication, or distribution of Outputs — excluding claims alleging that a Model as hosted by us infringes third-party rights independently of your prompts; (c) your use of the Services in breach of these Terms, the AUP, or applicable law; or (d) your products, services, or end-user relationships, to the extent connected with your use of the Services. This indemnity does not apply to the extent a claim results from our breach of these Terms, the DPA, or applicable law, or from our fault. Your aggregate liability under limbs (a), (b), and (d) is capped at the greater of EUR 100,000 and three times the Fees paid by you in the 12 months preceding the first event giving rise to the claim; limb (c) is not subject to that cap. For Customers under Section 20.3, this Section applies only to claims caused by your breach of these Terms or applicable law, and your liability under it is capped at three times the amount in Section 16.1. We will notify you promptly of the claim (failure to do so relieves you only to the extent you are prejudiced by it), allow you to control the defense (provided you do not settle in a way that admits our fault or imposes obligations on us without consent; we may participate with our own counsel at our own expense and may assume the defense if you fail to conduct it diligently), and reasonably cooperate at your expense.

19. Assignment; Subcontracting​

19.1 Assignment. You may not assign these Terms without our prior written consent, except to an affiliate or a successor in connection with a merger or sale of substantially all relevant assets, with notice to us. We may assign these Terms to an affiliate or a successor in interest; we will notify you of any assignment.

19.2 Subcontractors. We may use subcontractors and sub-processors (including identity, payment, and infrastructure providers). In the current region, Filecoin storage operates on Aurora-operated infrastructure in the EU; if regions using third-party storage providers are introduced, Section 3.2 applies. We remain responsible for our subcontractors' performance; the public-retrievability characteristics described in Section 4.4 are an inherent property of the Filecoin Network, not a subcontractor failure. Sub-processing of personal data is governed by the DPA.

20. Governing Law; Disputes; Mandatory Rights​

20.1 Governing law. These Terms are governed by the laws of Poland, excluding conflict-of-law rules.

20.2 Venue. Disputes will be resolved by the Polish common court having jurisdiction over Aurora's registered office (Kraków), except where mandatory law provides otherwise. This Section does not apply to Customers under Section 20.3 or consumers under Section 20.4, for whom statutory venue rules apply.

20.3 Sole traders with consumer-type protections. If you are a natural person entering into these Terms in direct connection with your business activity, but the contract is not of a professional character for you (within the meaning of Article 385⁵ and related provisions of the Polish Civil Code and the Polish Consumer Rights Act), then: (a) provisions of these Terms that would qualify as prohibited contractual clauses are not binding on you, and mandatory statutory rights (including, where applicable, a 14-day right of withdrawal for distance contracts) remain unaffected; (b) where you have such a withdrawal right and wish the paid Services to start immediately, we will ask you — by email or during the ordering process, before activation of the paid Services — to expressly request immediate performance and acknowledge that, for digital services, full performance or (for continuous services) pro-rata charging affects the right of withdrawal accordingly; (c) Sections 15.2 (rękojmia exclusion), 16 (to the extent limiting mandatory liability), and 20.2 apply to you only to the extent permitted by mandatory law; (d) the statutory provisions on conformity of digital content and digital services (Articles 43h–43q of the Polish Consumer Rights Act) apply to the Services provided to you, and Sections 15.2 and 16 do not limit the rights and remedies they provide; (e) before activation of the paid Services we provide — by email (durable medium) or during the ordering process — instructions on the right of withdrawal together with the statutory model withdrawal form, and we confirm the concluded contract — and any express request of yours to begin performance before the withdrawal deadline — by email (durable medium); (f) during registration or onboarding (including by email) you may (but need not) declare whether the contract has a professional character for you (Article 7aa(2) of the Polish Consumer Rights Act); conclusion of the contract is not conditional on such a declaration. We do not participate in voluntary out-of-court consumer dispute-resolution schemes.

20.4 Consumers outside the European Union. Where the Portal permits self-service purchases for your billing country and you purchase as a consumer — that is, for purposes outside your trade, business, or profession (currently possible for the United States, Singapore, and Hong Kong) — this Section applies to you: (a) nothing in these Terms limits rights you enjoy under mandatory consumer-protection law of your place of habitual residence; Sections 15.2, 16, and 22.2 (deemed receipt) apply to you only to the extent permitted by that law, and Section 20.2 does not deprive you of any mandatory venue available to you; (b) your paid plan continues month to month until cancelled; you may cancel at any time via the Portal or by contacting support@aurorainfra.ai, with effect no later than the end of the current billing period (Section 11.2), and no cancellation or early-termination fee applies — cancelling is at least as simple as subscribing, and we will send renewal or price-change notices where the law of your state or country of residence requires them; (c) refunds are governed by Section 7.4 and mandatory law, and complaints are handled under Section 21.3 with a response within 14 days; (d) the Services remain subject to the Acceptable Use Policy, and Section 2.2 (age and capacity) continues to apply.

21. Provisions Required by the Polish Act on Providing Services by Electronic Means​

21.1 Technical requirements. Use of the Portal requires a device with internet access, a current version of a modern web browser with JavaScript and cookies enabled, and a valid email address. Use of the APIs requires software compatible with the documented interfaces (e.g., S3-compatible clients; OpenAI-API-compatible clients). Connections are encrypted (TLS 1.2 or higher).

21.2 Prohibition of unlawful content. Providing unlawful content through the Services is prohibited (see the AUP).

21.3 Complaints. Complaints regarding the Services may be submitted to support@aurorainfra.ai and should include your Account identifier and a description of the issue. We will respond within 14 days for complainants covered by Sections 20.3 or 20.4, and within 30 days otherwise. Submitting a complaint does not limit your other rights.

21.4 Specific risks. Using services provided by electronic means involves inherent risks (including malware, phishing, and unauthorized access), which we mitigate through the measures in Section 14.1; Section 14.2 describes your part of the shared-responsibility model.

22. General​

22.1 Entire agreement. These Terms (with incorporated documents and any order form) are the entire agreement regarding the Services and supersede prior agreements on the same subject. Article 66¹ § 1–3 of the Polish Civil Code (offer submitted electronically) is excluded to the extent permitted in dealings with businesses.

22.2 Notices. We may give notices by email to your Account email address or via the Portal; they are deemed received on the business day after sending. Legal notices to us must be sent to legal@aurorainfra.ai or in writing to our registered office. Keep your Account email current (to change it, contact support@aurorainfra.ai).

22.3 Force majeure. Neither party is liable for failure to perform (other than payment obligations) caused by events beyond its reasonable control, including power or network failures beyond its systems, DDoS or other attacks despite reasonable defenses, acts of authorities, war, or natural disasters. The affected party will notify the other and mitigate.

22.4 Severability; waiver. If a provision is invalid, the remainder stays in force, and the invalid provision is replaced by a valid one closest to its purpose. Failure to enforce is not waiver.

22.5 Publicity; feedback. With your consent (email suffices), we may identify you as a customer using your name and logo. You grant us a perpetual, irrevocable, royalty-free license to use feedback and suggestions you provide, without obligation.

22.6 Confidentiality. Each party will protect the other's non-public information disclosed under these Terms with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisers bound by confidentiality, or as required by law (with notice where permitted). This obligation lasts for 3 years after termination; for Customer Content and trade secrets, for as long as the information remains confidential.

22.7 Language. These Terms are concluded in English. If we publish translations, the English version prevails to the extent permitted by law.

22.8 No partnership; no third-party beneficiaries. These Terms create no agency, partnership, or joint venture, and confer no rights on third parties.

22.9 Export and sanctions. You must comply with applicable export-control and sanctions laws (including EU, UN, and, where applicable, US regimes). You represent that you (and entities you act for) are not subject to restrictive measures, and you must not permit access to or use of the Services from or for the benefit of sanctioned persons, or in violation of such laws.

Schedule A — Acceptable Use Policy (AUP)

This AUP applies to all use of the Services, including by your Users and end users. Capitalized terms have the meaning given in the Terms.

A.1 Illegal content and activity​

You must not use the Services to store, publish, transmit, or facilitate:

  1. content or conduct that is illegal under applicable law, including child sexual abuse material (which we will report to competent authorities), terrorist content, incitement to violence, or human trafficking;
  2. content that infringes intellectual-property rights, trade secrets, privacy, or other third-party rights;
  3. fraud, phishing, identity theft, sale of stolen data or credentials, or money laundering;
  4. malware, ransomware, botnet command-and-control, exploit kits, or other malicious infrastructure.

A.2 Network and platform abuse​

You must not:

  1. conduct denial-of-service attacks, port or vulnerability scanning of third parties, credential stuffing, or unauthorized access attempts;
  2. run open proxies, open DNS resolvers or other reflection/amplification services, Tor exit nodes, or public/anonymizing VPN egress services;
  3. operate open mail relays or send bulk or unsolicited email from the Services; running mail servers for your own legitimate transactional mail requires our prior written approval (we may block outbound port 25 and similar vectors);
  4. engage in cryptocurrency or similar proof-of-work mining, or comparable sustained compute-exhaustion workloads, on the Compute Service without our prior written approval;
  5. interfere with the integrity of the platform, other customers' use, metering, or billing, or circumvent quotas, trial limits, or suspension measures;
  6. resell or white-label the Services except under an authorized partner agreement.

A.3 High-risk and sensitive uses​

  1. Do not use the Services in safety-critical or life-critical systems (including medical life support, aviation, or weapons systems) where failure could lead to death, personal injury, or severe damage, unless separately agreed in writing with adequate safeguards.
  2. Do not use the Inference Service for practices prohibited by Article 5 of the EU AI Act (e.g., harmful manipulation or exploitation of vulnerabilities, social scoring, predictive policing based solely on profiling, untargeted scraping of facial images to build facial-recognition databases, emotion recognition in the workplace or education, or unlawful biometric categorization or identification), to generate CSAM or unlawful deepfakes, or to provide regulated professional advice without a qualified human in the loop.
  3. You must not store personal data (as defined in the GDPR), confidential information, or regulated data in unencrypted buckets (see Sections 4.3–4.4 of the Terms — such data becomes publicly retrievable on the Filecoin Network). Storing such data in an unencrypted bucket is a material breach of these Terms. If we become aware of personal data in an unencrypted bucket, we may disable its public retrievability, re-tier, quarantine, or suspend the affected bucket, and will notify you.

A.4 Fair use​

Resources are subject to documented quotas and technical limits. We may apply reasonable technical measures (throttling, queuing, connection limits) to protect shared infrastructure, and will apply them in a non-discriminatory manner.

A.5 Enforcement​

We may investigate suspected AUP violations (without assuming a general monitoring obligation). Depending on severity, we may: issue a warning; remove or disable access to specific content; throttle, restrict, or suspend resources or the Account (Section 10.2 of the Terms); terminate for cause (Section 11.3); and/or notify authorities where legally required. Where we restrict content or the Account on the ground that content is illegal or incompatible with these Terms, we will provide a statement of reasons containing the information required by Article 17(3) DSA — the nature and scope of the restriction, the facts and circumstances, whether it follows a notice or an own-initiative review, any use of automated means (our decisions involve human review), and the legal or contractual ground — together with clear information on redress: you may contest the decision free of charge via support@aurorainfra.ai (Section 21.3 of the Terms), lodge a complaint with the competent Digital Services Coordinator under Article 53 DSA (in Poland, once designated — expected to be the President of UKE; users in other Member States may complain to their local Coordinator), and seek judicial redress before the competent court. Except where prohibited or counter-productive (e.g., security, ongoing investigations), we will give you an opportunity to respond.

Schedule B — Data Processing Addendum (DPA)

This DPA is incorporated into the Terms and applies where Aurora processes personal data contained in Customer Content on the Customer's behalf within the meaning of Regulation (EU) 2016/679 ("GDPR"). For this processing, Customer is the controller (or a processor acting for another controller, in which case Customer warrants its instructions are consistent with the controller's) and Aurora is the processor.

B.1 Subject matter, duration, nature, and purpose​

  • Subject matter and nature: hosting, storage, transmission, retrieval, and technical processing of Customer Content within the Services (object storage, compute, inference), as configured and instructed by Customer through the Services' interfaces.
  • Duration: the term of the Terms plus the retrieval and deletion periods in Sections 11.4 and 12 of the Terms.
  • Purpose: provision of the Services under the Terms.
  • Categories of data subjects and personal data: determined by Customer; potentially any categories contained in Customer Content. Customer must not process special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) on the Services except with encryption enabled and where lawful.

B.2 Instructions​

Aurora will process Customer Content only on Customer's documented instructions — consisting of the Terms, Customer's configuration of the Services (including bucket encryption settings and the Filecoin publication instruction in Section 4.4(c) of the Terms), and API requests — unless processing is required by EU or Member State law (in which case Aurora will inform Customer unless prohibited). Aurora will inform Customer if, in its opinion, an instruction infringes data-protection law.

Filecoin acknowledgment. Customer acknowledges and instructs that: (a) object data is tiered to the Filecoin Network — in the current region, exclusively to Aurora-operated storage providers located in the European Union (Sections 3.2 and 4.4 of the Terms); (b) for unencrypted buckets this constitutes making the data publicly retrievable by content identifier; and (c) erasure of unencrypted data already retrieved or copied by third parties from the public network cannot be guaranteed (Section 4.4(d) of the Terms). Aurora hereby informs Customer, pursuant to Art. 28(3) GDPR, that in Aurora's opinion an instruction to publish personal data in unencrypted form to a public network would infringe the GDPR, and Aurora may refuse or suspend execution of such an instruction.

Essential means. The parties agree that Customer alone determines the purposes and the essential means of the processing — including the categories of personal data, the storage duration, and, through its encryption and bucket configuration, the categories of recipients (including whether object data becomes publicly retrievable). Aurora's selection of storage technology, including tiering to Aurora-operated Filecoin storage providers in the EU, constitutes non-essential technical means within Aurora's discretion as processor, under Customer's general instruction to store data durably on EU infrastructure. Customer is responsible for ensuring this processing model is lawful for the personal data concerned, and specifically must enable encryption for any Customer Content containing personal data.

B.3 Confidentiality and personnel​

Aurora ensures that persons authorized to process Customer Content are bound by confidentiality obligations and access Customer Content only as needed to provide the Services.

B.4 Security​

Aurora implements appropriate technical and organizational measures under Art. 32 GDPR, including: encryption in transit (TLS 1.2+); optional per-bucket encryption at rest with managed keys (KMS-backed); network and tenant isolation; role-based access control with least privilege; hashed credential storage; secret-management infrastructure; logging of storage API operations; and vulnerability and patch management. Aurora may update measures provided security is not materially degraded.

B.5 Sub-processors​

Customer grants general authorization to engage sub-processors for the processing of Customer Content. The current list is set out in Annex 1 and/or published in the Documentation. Aurora will give at least 30 days' prior notice (email or Portal) of intended additions or replacements; if Customer objects on reasonable data-protection grounds and no resolution is found within 30 days, Customer may terminate the affected Service under Section 11.2 of the Terms as its sole remedy. Aurora imposes data-protection obligations on sub-processors materially equivalent to this DPA and remains liable for their performance. In the current region, Filecoin storage operates on Aurora-operated infrastructure within the EEA and involves no additional sub-processor; if regions using third-party storage providers are introduced (Section 3.2 of the Terms), the affected providers will be added to the sub-processor list with notice under this B.5 before being used for Customer Content.

B.6 Assistance​

Taking into account the nature of processing, Aurora will reasonably assist Customer: (a) with appropriate technical and organizational measures, in fulfilling Customer's obligations to respond to data-subject requests (noting that Aurora generally cannot identify or access data subjects within Customer Content, and self-service tools — deletion, retrieval via APIs — are the primary mechanism); and (b) in ensuring compliance with Arts. 32–36 GDPR (security, breach notification, DPIAs, prior consultation), with information reasonably available to Aurora. Aurora may charge reasonable costs for assistance exceeding self-service tools and legal minimums.

B.7 Personal-data breach​

Aurora will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal-data breach affecting Customer Content, by email to the Account email address, providing information reasonably available to Aurora (nature, categories and approximate numbers, likely consequences, measures taken or proposed), and will supplement as information becomes available. Notification is not an admission of fault.

B.8 Deletion and return​

Upon termination, Sections 11.4 and 12 of the Terms apply: Customer may retrieve Customer Content during the retrieval period; thereafter Aurora will delete Customer Content — including removal from Aurora-operated storage providers within the period stated in Section 4.4(d) of the Terms and deletion of managed encryption keys, rendering encrypted Filecoin-resident ciphertext unreadable — unless EU or Member State law requires storage. Key deletion is executed as an operator-performed step of our documented deletion procedure, is irreversible and logged, and covers all key material under our control. Because encryption keys are managed per bucket, crypto-erasure operates at bucket level; erasure requests concerning individual data subjects are fulfilled by object deletion (with removal per Section 4.4(d) of the Terms), and Customer should architect its data layout accordingly (e.g., per-data-subject objects or application-layer envelope keys). The limits in B.2 (Filecoin acknowledgment) apply to unencrypted data already distributed to the public network.

B.9 Audits​

Aurora will make available information reasonably necessary to demonstrate compliance with Art. 28 GDPR, primarily through documentation, security summaries, and completed questionnaires. Where these are insufficient, Customer (or an independent auditor not being a competitor) may audit once per 12 months on at least 30 days' notice, during business hours, without access to other customers' data, subject to confidentiality and Customer bearing costs. Audits extend to Aurora-operated storage providers and infrastructure processing Customer Content, but not to third-party nodes of the public Filecoin Network that Aurora does not operate.

B.10 Transfers​

Aurora processes Customer Content on infrastructure located in the European Union (currently: primary storage and compute in France (Albi); backup, in whole or in part, in France (Champs-sur-Marne); inference in Kraków, Poland — see Annex 1). Aurora will not transfer Customer Content outside the EEA except with a valid transfer mechanism under Chapter V GDPR and notice under B.5. For clarity, Customer's own choice to publish unencrypted data to the public Filecoin network — which makes it retrievable worldwide by content identifier — is Customer's decision as controller.

B.11 Liability; precedence​

Liability under this DPA is subject to Section 16 of the Terms, without prejudice to data subjects' rights and mandatory law (including Art. 82 GDPR). In case of conflict between this DPA and the Terms regarding processing of personal data in Customer Content, this DPA prevails.

Annex 1 — Sub-processors for Customer Content (current)​

EntityRoleLocation
CELESTE — "Fil d'Ariane" data centre, 1 Rue Pierre Gilles de Gennes, 81000 Albi, FranceColocation / physical hosting of primary storage and compute infrastructureFrance (EU)
CELESTE — "Marilyn" data centre, Cité Descartes, 20 rue Albert Einstein, 77420 Champs-sur-Marne, FranceColocation / physical hosting of secondary (backup) infrastructureFrance (EU)
S-NET — ul. Królewska 57, 30-081 Kraków, PolandColocation / physical hosting of inference (GPU) infrastructurePoland (EU)

Filecoin storage in the current region runs on Aurora-operated infrastructure at the locations above. Providers processing Aurora-controller data (e.g., Auth0, Stripe, Google reCAPTCHA) are listed in the Privacy Policy, not here, because they do not process Customer Content.