Terms of Service

This summary is for convenience only; the full Terms below control.

• Headroom runs in your environment. The Headroom proxy and CLI run on your own machines. Your prompts, code and tool output go only to the model provider you configure, never to us.
• The open-source software is Apache-2.0. Your use of the open-source code is governed by that licence, not by these Terms.
• Signed contracts win. If your organisation has a signed agreement with us, that agreement controls.
• Telemetry is limited and switchable. The open-source build sends an anonymous compression beacon by default (no prompts, completions, code or file paths). You can turn it off with one setting. Enterprise builds ship with it off.

2.1 'Open-Source Software' means software we publish under an open-source licence, including the headroom-ai proxy, CLI and SDKs in the headroomlabs-ai/headroom repository, licensed under the Apache License 2.0.

2.2 'Commercial Software' means software, builds, licence keys, modules and support we provide under a paid or trial licence, including Headroom Enterprise, partner trial bundles and add-on modules.

2.3 Order of precedence. If you have signed an order form, software licence agreement, master services agreement or similar agreement with us (an 'Enterprise Agreement'), that agreement governs the Commercial Software and services it covers, and it controls over these Terms where they conflict. These Terms continue to apply to your use of our websites and of any Services the Enterprise Agreement does not cover.

2.4 Privacy Notice. Our Privacy Notice explains how we handle personal information. It forms part of these Terms.

3.1 Open-Source Software. You may use, modify and distribute the Open-Source Software under the terms of its licence. Nothing in these Terms limits the rights that licence grants you. The open-source licence's own warranty disclaimer and limitation of liability apply to the Open-Source Software.

3.2 Commercial Software. Subject to these Terms (or your Enterprise Agreement) and payment of any applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable licence to install and use the Commercial Software. This is for your internal business purposes, during the licence term and within any limits stated in your order or licence key. Licence keys are verified offline, against a public key bundled with the software; verification makes no network call to us.

3.3 Websites, documentation and partner portal. You may use our websites, documentation and the partner portal to learn about, obtain, configure and manage Headroom, and to view aggregate usage and savings information you have chosen to share with us.

3.4 Changes to the Services. We may change, add or remove features of the Services. If a change materially reduces the functionality of Commercial Software you have paid for, your Enterprise Agreement or order governs your remedies.

3.5 Beta and trial features. Features labelled beta, preview, trial or similar are provided as-is for evaluation. They may change or be discontinued, and Section 12 (Disclaimers) applies to them in full.

4.1 Some Services, such as the partner portal, require an account. You must give accurate information, keep your credentials confidential, and use multi-factor authentication where we offer or require it.

4.2 You are responsible for activity under your account and must tell us promptly at security@headroomlabs.ai if you suspect unauthorised access.

4.3 You must be at least 18 years old to use the Services.

You must not, and must not let anyone else:

1. use the Services in violation of law, or to infringe or misappropriate anyone's rights;
2. probe, scan or test the vulnerability of our systems or bypass security measures, except as permitted by our vulnerability disclosure policy (SECURITY.md and /.well-known/security.txt);
3. interfere with or disrupt the Services, or access them by automated means at a rate that places an unreasonable load on them;
4. circumvent licence-key checks, usage limits or other technical restrictions in the Commercial Software. This does not restrict anything the Open-Source Software licence permits;
5. resell, sublicense or provide the Commercial Software to third parties as a hosted service, except as your Enterprise Agreement permits;
6. use the Services to send malware or other harmful code; or
7. use the Services to violate the terms of any model provider or other third-party service you connect them to.

6.1 Your content stays with you. Headroom is designed to run inside your environment. The prompts, completions, source code, tool output and files your AI tools process ('Customer Content') are compressed in memory on your own machines. They are sent only to the model provider or endpoint you configure. We do not receive, store or have access to Customer Content through the normal operation of the software, and we have no standing access to your environment.

6.2 Local storage. Caches, indexes, logs and savings counters are stored on your own disk (by default under ~/.headroom). They are protected by your environment's controls, and you can disable or delete them.

6.3 Telemetry. The Open-Source Software sends an anonymous beacon by default. It describes how compression behaved: compression ratios, counters, provider and model identifiers, and operating system and architecture. It never includes prompts, completions, source code or file paths. You can turn it off with HEADROOM_BEACON=off, by setting DO_NOT_TRACK=1, or by running in --offline mode. Commercial Software for enterprise deployments ships with this telemetry off unless you enable it. The full field list is published in the proxy documentation.

6.4 Support bundles. Diagnostic bundles are generated only when you run the relevant command. They are redacted, and you can review them before you choose to send one. Do not include personal data or secrets in support requests.

6.5 Aggregate usage data you share. If you connect the optional savings or metrics exporter to our partner portal, we receive the numeric usage and savings metrics you send, such as token counts and savings totals. We use them to provide the portal's dashboards to you and, in aggregated and de-identified form, to improve Headroom.

6.6 No model training on your data. We do not use Customer Content, or your Feedback, to train, fine-tune or evaluate machine-learning models. Aggregated and de-identified numeric telemetry you have enabled may be used to improve the product.

6.7 Personal information. Our handling of personal information (for example, account and contact details) is described in our Privacy Notice.

7.1 Our commitments. We maintain a written information security program appropriate to our size and the nature of the Services. It is described on our Trust & Security page and covers:

• information security, access control, secure development, incident response, supply-chain and vulnerability management, business continuity, and personnel security policies;
• code review on every change, plus automated security and dependency scanning in our build pipeline;
• signed releases, and least-privilege access to our source code, build systems and infrastructure, protected by multi-factor authentication; and
• encryption in transit (TLS 1.2 or higher) for our websites and portal.

7.2 Incidents. If we confirm a security incident affecting the Services that we reasonably believe affects your data or account, we will notify you without undue delay. We will also share information reasonably needed for you to respond. Enterprise Agreements may set specific notification timelines.

7.3 Your responsibilities. You are responsible for securing the environment where you run Headroom. That includes your machines, network, model-provider credentials and the endpoints you configure.

7.4 Reporting vulnerabilities. Report suspected vulnerabilities to security@headroomlabs.ai. We aim to acknowledge reports within 48 hours. Good-faith research that follows our disclosure policy is welcome.

8.1 Headroom works with third-party services you choose, such as model providers (for example Anthropic, OpenAI, AWS Bedrock or Google Vertex) and AI coding tools. Your use of those services is governed by your agreements with those providers. You are responsible for your accounts with them and for complying with their terms.

8.2 We do not control third-party services and are not responsible for their availability, outputs or data handling.

8.3 AI outputs. Context compression is lossy by design. Headroom does not guarantee any particular level of token or cost savings, or the accuracy of any model output. You are responsible for reviewing model outputs before relying on them.

Commercial Software and paid services are billed as set out in your order, Enterprise Agreement or the pricing shown at purchase.

10.1 Ours. Except for rights expressly granted in these Terms, an Enterprise Agreement or an open-source licence, we and our licensors keep all rights in the Services, the Commercial Software, our trademarks and our documentation. The 'Headroom' name and logos may be used only as described on our brand page.

10.2 Yours. You keep all rights in your Customer Content and your data.

10.3 Feedback. If you give us suggestions or feedback, we may use them without restriction or obligation to you. Contributions to our open-source repositories are governed by that repository's contribution terms.

Information we share with you that is marked confidential, or should reasonably be understood to be confidential, must be kept confidential. Examples include non-public pricing, security documentation shared under NDA, and roadmap information. You must use it only to evaluate or use the Services. If we have a separate NDA or Enterprise Agreement with you, its confidentiality terms control.

EXCEPT AS EXPRESSLY STATED IN AN ENTERPRISE AGREEMENT, THE SERVICES ARE PROVIDED 'AS IS' AND 'AS AVAILABLE'. WE DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT THEY WILL ACHIEVE ANY PARTICULAR SAVINGS OR RESULTS. SOME JURISDICTIONS DO NOT ALLOW CERTAIN DISCLAIMERS, SO SOME OF THESE MAY NOT APPLY TO YOU.

13.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, EVEN IF ADVISED OF THEIR POSSIBILITY.

13.2 TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID US FOR THE SERVICES IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) US $100.

13.3 These limits do not apply to liability that cannot be limited by law. If you have an Enterprise Agreement, its liability terms apply instead for the Services it covers.

You will defend and indemnify Headroom Labs against third-party claims arising from (a) your breach of Section 5 (Acceptable use), or (b) your Customer Content, or your use of third-party services with the Services, in violation of law or of a third party's rights. You must pay resulting damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement. We will give you prompt notice of the claim and reasonable cooperation, and let you control its defence. You may not settle a claim in a way that admits fault on our behalf without our consent.

15.1 These Terms apply while you use the Services.

15.2 You may stop using the Services at any time. You may close your portal account by emailing us.

15.3 We may suspend or terminate your access to the hosted Services if you materially breach these Terms and do not cure the breach within 10 days of notice. We may act immediately where needed to prevent harm to the Services, other users or third parties, or to comply with law. Suspension of Commercial Software under an Enterprise Agreement is governed by that agreement.

15.4 Sections 6.6, 10, 11, 12, 13, 14, 16 and 17 survive termination.

We may update these Terms. We will post the updated version here and change the 'Last updated' date. For material changes, we will give at least 30 days' notice, by email or in the portal, to account holders before the changes take effect. Continued use of the Services after the effective date means you accept the updated Terms. Changes do not apply retroactively, and they do not change a signed Enterprise Agreement.

17.1 Governing law and venue. These Terms are governed by the laws of the State of California, without regard to conflict-of-laws rules. The state and federal courts located in Alameda County, California have exclusive jurisdiction, and each party consents to them.

17.2 Export and sanctions. You will comply with applicable export-control and sanctions laws. You confirm you are not located in, or acting on behalf of anyone in, a comprehensively sanctioned jurisdiction.

17.3 Assignment. You may not assign these Terms without our consent, except to a successor of your entire business. We may assign them in connection with a merger, acquisition or sale of assets.

17.4 Entire agreement. These Terms, together with the Privacy Notice and any Enterprise Agreement or order, are the entire agreement between you and us about the Services.

17.5 Severability and waiver. If any provision is unenforceable, the rest remains in effect. Failure to enforce a provision is not a waiver.

17.6 Notices. We may give notices by email to your account address or by posting in the Services. Notices to us go to the addresses below.

• Legal and these Terms: tejas@headroomlabs.ai
• Security and vulnerability reports: security@headroomlabs.ai
• Sales and enterprise: hello@headroomlabs.ai