Terms of Service
The terms governing SnitchOS for managed service providers and their teams.
1. Agreement to these terms
By creating an account, deploying the agent, or accessing the Service, you agree to these Terms for your organization, representing authority to bind it. If you disagree, do not use the Service.
A separate signed master services agreement or order form controls where it conflicts with these Terms. The Data Processing Addendum at /dpa.html is incorporated into this agreement.
2. The Service
SnitchOS is a multi-tenant employee-monitoring and workforce-analytics platform for managed service providers: a signed Windows endpoint agent plus a hosted management dashboard, on infrastructure SnitchOS controls, not on-premises software.
2.1 What the agent collects
On a company-owned, Customer-managed endpoint, the agent samples: active window (process name, title), idle/active state, app usage, website host/path (never query strings or fragments), input counts only (keystroke, mouse-click, and mouse-distance totals, never keys or content), one screenshot per minute by default, and device/OS metadata. Sampling and screenshot intervals are configurable defaults, not fixed values. Administrator identity runs through Microsoft Entra; if connected, the Service also ingests Microsoft 365 Graph signals like Entra sign-ins and Teams/Outlook activity.
2.2 What the Service does not intentionally extract
SnitchOS does not intentionally extract keystroke content, clipboard contents, file contents, message bodies, audio, webcam imagery, saved passwords, or URL query strings and fragments as data fields, though screenshots, window titles, and URL paths can still display sensitive information. The agent counts input and discards key content, so it is not a keylogger; it runs as a visible Windows service a local administrator can uninstall, so it is not a rootkit. It is installed as a system component, so it is removed with msiexec /x rather than Settings → Apps, and nothing about the running software is concealed from the operating system.
2.3 Changes to the Service
We may add, modify, or retire features. The Product page describes today's capabilities; unpublished work is not a commitment. We will not materially reduce a paid subscription's core functionality during its term without notice.
3. Accounts and authentication
Administrator dashboard access is through Microsoft Entra or Google single sign-on only. Admins are provisioned by SnitchOS or an existing Customer administrator and sign in with their Microsoft 365 account (bound to an immutable Entra object identifier) or their Google account (bound to an immutable Google account identifier).
3.1 Account security
You are responsible for the security of your Microsoft Entra tenant and Google accounts used to sign in, your enrollment keys, and all activity under your administrators' accounts. You must promptly deactivate departing administrators and notify us of suspected unauthorized access at the SnitchOS contact form.
3.2 Enrollment keys
Fleet enrollment keys embedded in your install scripts authorize devices to enroll into a specific tenant. Treat them as credentials and rotate or revoke any that may have been exposed.
4. Acceptable use
Your use of the Service is subject to our Acceptable Use Policy at /acceptable-use.html, incorporated by reference. You may not use SnitchOS to monitor unauthorized devices, to surveil individuals covertly where the law requires notice, to circumvent the input-count and content-exclusion limits above, or to interfere with the Service's security or integrity. We may suspend access presenting a security risk or violating the Policy.
5. Customer responsibilities
5.1 Lawful monitoring and employee notice
You, with your Client Tenant where applicable, must determine your employee monitoring is lawful in each jurisdiction where a Monitored User works, and provide any required notice or consent. Several U.S. states, including New York, Connecticut, and Delaware, require advance written notice to employees before electronic monitoring; other jurisdictions impose their own conditions. You must issue that notice and keep records of it. The agent must not be installed on personal devices or used without a lawful basis.
5.2 Authority over devices and data
You represent authority to deploy the agent on each endpoint you enroll and process the resulting data for the relevant Client Tenant. As between the parties, you and your Client Tenant are the data controller for monitored endpoint data; SnitchOS acts as processor on your documented instructions, per the Data Processing Addendum.
5.3 Configuration
You are responsible for configuring tenants, productivity classifications, alarm rules, retention within our offered ranges, and administrator scoping for each Client Tenant.
6. Fees and billing
SnitchOS is priced at US $100 per enabled Admin or Manager login, per month, billable while enabled at the monthly cutoff regardless of sign-in. Monitored endpoints, Monitored Users, and Client Tenants are included, not billed separately. Self-serve accounts begin with a 14-day pilot starting when provisioned; no payment method is required. The first paid term begins when the Customer starts a subscription and renews monthly on that date. If none starts by the pilot's end, the tenant is suspended: dashboard access and data collection stop until a subscription starts.
6.1 Invoicing and autopay
An invoice issues automatically on the monthly signup anniversary for the period beginning that day, based on enabled Admin and Manager logins at the billing cutoff. Stripe processes payments using the payment method on file; providing one authorizes recurring monthly charges. Stripe stores your payment details; SnitchOS does not store full card numbers.
6.2 Login changes
You may add or deactivate Admin and Manager logins anytime from the dashboard. Added logins appear on the next invoice; deactivating one stops it counting toward future periods. We do not prorate or refund partial months unless required by law.
6.3 Failed payments, dunning, and suspension
If a charge fails, Stripe retries automatically and we notify your billing contact. If the subscription stays unpaid after the retry window, we may lock the workspace: sign-in is disabled; agents stay installed but their data is refused, pausing collection. The workspace and its data stay intact for a 90-day recovery window during which you can restore access by updating billing details, with reporting resuming automatically once restored. If the account is not restored within that 90-day window, the workspace and its data are removed.
6.4 Taxes
Fees are exclusive of taxes. You are responsible for any sales, use, value-added, or similar taxes on your subscription, except taxes on SnitchOS's net income. Where we must collect tax, we add it to your invoice.
7. Term, termination, and data deletion
These Terms apply while you have an active subscription or account. Either party may terminate for convenience on written notice, effective at the current monthly period's end, or for a material breach uncured 30 days after written notice.
7.1 Effect of termination
On termination, your administrators lose dashboard access and you must stop deploying the agent and uninstall it from enrolled endpoints. Fees accrued before termination remain payable.
7.2 Data deletion and retention
Endpoint data is purged when a tenant is offboarded. Screenshots are retained hot for 30 days and cold through day 365, then hard-deleted; the administrative audit log is retained for three years. On closure we delete or return endpoint data per the Data Processing Addendum, subject to any retention required by law. Backup copies expire through the normal backup cycle within 14 days of deletion.
8. Intellectual property
SnitchOS and its licensors own all right, title, and interest in the Service, including agent software, dashboard, documentation, and the SnitchOS name and marks. Subject to these Terms and fee payment, we grant you a non-exclusive, non-transferable, revocable license to use the Service and deploy the agent to endpoints you are authorized to manage during the term.
8.1 Your data
As between the parties, you and your Client Tenants retain all rights in the monitored endpoint data. You grant SnitchOS limited rights to host, process, secure, and display that data to provide the Service and meet our obligations under the Data Processing Addendum.
8.2 Feedback
If you send us suggestions or feedback about the Service, we may use them without restriction or obligation to you.
9. Confidentiality
Each party may receive non-public information of the other marked or reasonably understood confidential. The receiving party will use it only under these Terms, protect it with reasonable care, and disclose it only to personnel and sub-processors bound by comparable obligations. These duties do not apply to information public through no fault of the receiving party, already known to it, or independently developed, nor prevent disclosure required by law with reasonable notice where permitted.
10. Sub-processors and hosting
We host the Service on infrastructure we control and engage limited sub-processors: Stripe for payments; Microsoft for Entra ID authentication and, where connected, Microsoft 365 Graph data; Google for Google Sign-In authentication, only for administrators who sign in with Google; SMTP2GO for transactional account email; and NotifyBell for alerting. Compute, storage, and network are OS Labs Inc’s own; no third-party hosting operator processes your data. The current list and change notifications are in the Data Processing Addendum and sub-processor list. Data in transit uses TLS 1.2+; tenant isolation covers database rows, object-store keys, and API layers; the agent is code-signed; and administrative actions log to an append-only audit log. Off-site backups are encrypted in transit, not at rest.
11. Compliance with data-protection law
Where the General Data Protection Regulation applies, SnitchOS acts as a processor under Article 28; the Data Processing Addendum sets the required processor terms, including Standard Contractual Clauses for transfers needing them. Where U.S. state privacy laws such as the California Consumer Privacy Act, as amended by the CPRA, apply, SnitchOS acts as a service provider, processing personal information only for the Service, not its own purposes. The legal basis for monitoring, and honoring Monitored Users' rights, remains the Customer's responsibility under Section 5.
12. Warranties and disclaimers
Each party warrants authority to enter these Terms, and we will provide the Service with reasonable skill and care.
Except as expressly stated, the Service is provided “as is” and “as available.” To the fullest extent permitted by law, SnitchOS disclaims all other warranties, express, implied, or statutory, including merchantability, fitness for particular purpose, and non-infringement. We do not warrant uninterrupted or error-free operation, that sampling captures every event, or that the Service suits any particular legal or compliance outcome. The Service is a monitoring tool, not legal advice, and does not by itself make your monitoring program lawful.
13. Limitation of liability
To the fullest extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, goodwill, or data, arising out of these Terms, even if advised of the possibility.
Each party's total aggregate liability arising out of these Terms will not exceed the total fees paid or payable by the Customer to SnitchOS for the Service in the twelve months before the event giving rise to the claim. These limits do not apply to your payment obligations, either party's indemnification obligations, or liability that cannot be limited under applicable law.
14. Indemnification
You will defend, indemnify, and hold harmless SnitchOS and its officers, employees, and agents from third-party claims and losses, damages, and reasonable legal costs arising from: (a) your or your Client Tenants' monitoring of Monitored Users, including failure to give required notice or consent; (b) deploying the agent to unauthorized devices; (c) violating the Acceptable Use Policy; or (d) breaching these Terms or applicable law. SnitchOS will likewise defend, indemnify, and hold you harmless against third-party claims that the Service infringes that party's intellectual property rights. The indemnified party must give prompt notice, reasonable cooperation, and defense control to the indemnifying party.
15. Governing law and disputes
These Terms are governed by the laws of the United States and the State of Ohio, without regard to conflict-of-laws rules. The parties submit to the exclusive jurisdiction of the state and federal courts in Franklin County, Ohio for unresolved disputes, except either party may seek injunctive relief in any competent court to protect its intellectual property or confidential information.
16. Changes to these terms
We may update these Terms as the Service and law evolve. For a material change, we will update the effective date above and give reasonable notice via the dashboard or your billing or administrative contact before it takes effect. Continued use after that is acceptance of the updated Terms.
17. General
If any provision is unenforceable, the remainder stays in effect. Failure to enforce a provision is not a waiver. You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets; we may assign to an affiliate or successor. Neither party is liable for delay or failure from events beyond its reasonable control. These Terms, with the Acceptable Use Policy, Data Processing Addendum, Privacy Policy, and any signed order form, are the entire agreement between the parties for the Service.
18. Contact
- Legal and contractual matters: the SnitchOS contact form
- Privacy and data-protection matters: the SnitchOS contact form
- Product and account support: the SnitchOS contact form