Terms of Service

Acceptable Use Policy

The Services are provided exclusively for defensive cybersecurity, document malware (maldoc) analysis, threat intelligence research, SOAR attachment triage, upload validation, and AI/RAG prompt-injection protection. You agree that you will not:

• Use the Services to design, test, or optimize malware, exploit kits, or prompt-injection payloads for unlawful or offensive evasion purposes;
• Circumvent API rate limits, monthly scan quotas, or authentication controls by creating fraudulent accounts or rotating unauthorized keys;
• Resell, redistribute, publicly mirror, or sublicense the commercial Pro YARA & AI Security Rule Feed (GET /v1/rules/pro) outside your licensed organization without prior written authorization;
• Submit files to the Services that you do not have the lawful right or authority to inspect;
• Interfere with or disrupt the integrity, availability, or performance of the Cloud Run API or storage infrastructure.

Plans, Quotas & Stripe Billing

• API Credentials: You are responsible for maintaining the confidentiality of your mt_live_... API keys and for all requests authenticated with your keys. You may rotate or revoke keys at any time in the API Portal.
• Subscription Tiers & Renewals: Paid plans (Startup API, Business & Pro Feed, and Pro YARA Feed Annual) are billed in advance on a recurring monthly or annual cycle via Stripe. Subscriptions automatically renew unless cancelled prior to the end of the current billing period.
• Quota Enforcement: Each tier includes a stated monthly scan allocation (1,000 scans/mo for Community Free; 50,000/mo for Startup; 500,000/mo for Business & Pro; 100,000/mo included with Pro YARA Annual). Requests exceeding your monthly quota may return HTTP 429 Too Many Requests until the next billing cycle or plan upgrade.
• Taxes: Listed prices are in U.S. Dollars (USD) unless otherwise stated during checkout and exclude applicable Canadian Harmonized Sales Tax (HST), Goods and Services Tax (GST), or provincial sales taxes, which will be calculated where required by law.

Open-Source Engine vs. Commercial Pro Feed

The core QuickSand document stream parser is made available under its respective open-source MIT license on GitHub.

The hosted Malware Tracker Document Malware Analysis Server, website brand assets, and the commercial Pro Zero-Day YARA & AI Safety Rule Feed (GET /v1/rules/pro) are proprietary to TyLabs / Malware Tracker. Active subscribers to eligible Pro plans are granted a non-exclusive, non-transferable, internal business license during their subscription term to deploy the Pro YARA rules within their internal security pipelines, SOC environments, and cloud workloads.

Ownership & Zero-Retention Guarantee

You retain all ownership rights in documents and files submitted to the REST API. When using the REST API in its default zero-retention mode (POST /v1/scan?store=false or POST /v1/triage), Malware Tracker processes the document strictly in volatile memory (RAM) to return your synchronous analysis verdict and acquires no rights to store or retain the file contents.

When you upload a sample via the unauthenticated public web dropzone or explicitly pass ?store=true, you grant Malware Tracker a non-exclusive, worldwide, royalty-free license to analyze the sample, extract structural stream telemetry and cryptographic hashes, and display the resulting security report on the Services for threat intelligence and research purposes.

Static Stream Analysis & Security Verdicts

No Guarantee of 100% Detection: Threat actors continuously evolve document exploits, obfuscation techniques, and adversarial AI prompt injections. While the Malware Tracker Document Malware Analysis Server inspects nested streams against 239+ YARA signatures and structural heuristics, a clean verdict or ai_safety.safe: true result does not guarantee that a file is free of all unknown zero-day vulnerabilities or malicious logic. The Services are intended to operate as one layer of a defense-in-depth security architecture.

“AS IS” Basis: To the maximum extent permitted by the laws of the Province of Ontario and Canada, the Services are provided “AS IS” and “AS AVAILABLE” without warranties, representations, or conditions of any kind, whether express, implied, or statutory, including implied warranties or conditions of merchantability, fitness for a particular purpose, or non-infringement.

Limitation of Liability: To the maximum extent permitted by applicable law, in no event shall TyLabs, Malware Tracker, or its founder, employees, or suppliers be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, revenue, or business interruption arising out of or related to your use of the Services. Our total aggregate liability for any claim arising out of or relating to these Terms or the Services shall not exceed the total fees paid by you to Malware Tracker in the twelve (12) months immediately preceding the event giving rise to the claim (or $100 CAD if you use the free tier).

Ontario Governing Law & Dispute Resolution

These Terms and any dispute, claim, or controversy arising out of or relating to the Services shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply to these Terms.

You irrevocably attorn and submit to the exclusive jurisdiction of the provincial and federal courts located in Ontario, Canada for the resolution of any disputes arising hereunder.

Questions or Legal Notices:
TyLabs — Malware Tracker Legal
Province of Ontario, Canada
Email: legal@malwaretracker.com / info@tylabs.com