1. Who can use Asiri
You must be at least 18 and legally able to enter into a contract. You must follow the laws that apply to you. If you use Asiri for a company, workspace, or other organisation, you confirm that you can accept these Terms for that organisation.
2. What Asiri does
Asiri is a secrets access layer. Its hosted control plane coordinates accounts, workspaces, encrypted secret records, trusted devices, policies, grants, revocation, billing, and audit state. Its local runtime decrypts and uses secrets on trusted devices through approved actions such as command injection, temporary files, broker access, and sidecar access.
Asiri is operated by O'CLAN LIMITED. Your agreement for the service is with O'CLAN LIMITED.
3. Your account and workspace security
- You are responsible for activity under your account, workspaces, trusted devices, service accounts, and local runtime sessions.
- Keep sign-in access, device keys, recovery keys, session material, and local machines secure.
- Workspace owners and delegated admins are responsible for members, invitations, permissions, grants, devices, service accounts, and audit settings.
- Review commands, executables, scripts, agents, and processes before running them through an authenticated Asiri session. Their names are audit labels and do not receive grants.
- Tell us promptly if you suspect unauthorised access to an account, workspace, trusted device, or recovery path.
4. Your material and credentials
- You keep the rights you already have in secret material, metadata, and other information you submit.
- You give us a non-exclusive, worldwide permission to host, store, copy, transmit, and process encrypted secret material and the plaintext labels and metadata needed to provide, secure, support, bill for, and improve Asiri.
- You must have the authority to store, manage, share, and use every credential or other item you add to Asiri.
- Secret names, scope paths, workspace names, access-request reasons, and audit fields may be stored as plaintext. Do not put secret values or unnecessary personal information in those fields.
- Who can see or receive workspace material depends on roles, grants, policies, trusted devices, key coverage, and local runtime configuration.
5. The local security boundary
- The hosted service is designed to store encrypted secret values. Plaintext use and decryption happen on trusted devices during normal operation.
- Approved actions may place plaintext in a child process environment, temporary file, broker response, process memory, or another local destination you configure.
- A trusted device or host can use every secret it is authorised to access. A compromised host may extract those secrets or bypass local controls.
- Agent, app, process, and command names are audit labels only. They do not grant access or prove the identity of software running on a device.
- Revocation blocks future authorised access. It cannot erase copies that were already decrypted, cached, logged, or sent elsewhere. Rotate affected credentials with their provider after suspected exposure.
- If every trusted device and the workspace recovery key are lost, Asiri cannot decrypt or recover that workspace's secrets.
- Strict audit mode needs a matching control-plane acknowledgement before Asiri releases a secret. Network or service problems can therefore block strict-mode use. Buffered audit records may sync later.
6. Other providers
We use other companies to provide parts of Asiri. These include Cloudflare for hosting and storage, Google and GitHub for sign-in, Resend for service email, and Paystack for payments. Optional domain setup may connect to Cloudflare services at your request.
We may add, change, or remove providers and features. Provider outages, suspensions, policy changes, price changes, or service limits may affect Asiri. Credentials used through Asiri remain subject to the terms and availability of their own providers.
7. Acceptable use
You must not use Asiri to:
- Break the law or violate another person's rights.
- Store, obtain, share, or use credentials without authority.
- Access systems, accounts, data, or infrastructure without permission.
- Exfiltrate secrets, distribute harmful software, or facilitate fraud, harassment, abuse, or unlawful surveillance.
- Bypass policies, approvals, audit controls, usage limits, rate limits, or security measures.
- Probe, disrupt, overload, or weaken Asiri or another service.
- Use Asiri in a way that creates material legal, security, or regulatory risk for us, our providers, or other users.
8. Plans, payments, and taxes
- Free and paid plans have limits on scopes, members, domains, and other features. Current limits are shown in the dashboard or at checkout.
- Paystack processes paid subscriptions and checkout.
- Asiri may stop new actions or reduce access when a limit is reached, a payment fails, or a subscription ends.
- Cancellation or downgrade timing is shown when you make the change. Paid entitlements may change immediately under the current plan rules.
- Prices exclude taxes unless we say otherwise. You are responsible for taxes, duties, charges, and withholding that apply to you.
- We may change future prices, plans, limits, features, and packaging.
9. Suspending or ending access
We may suspend, limit, or end access because of a security incident, legal requirement, abuse, non-payment, or a serious breach of these Terms. We may also change, limit, or stop any part of Asiri.
Terms that need to continue after access ends will remain in effect. These include payment duties, disclaimers, limits on liability, responsibility for claims, and dispute rules.
10. Beta and preview features
Features marked beta, preview, early access, or experimental may be unfinished, change significantly, or be removed without notice. We make no additional promises or guarantees about them.
11. What we can guarantee
Asiri is provided “as is” and “as available” as far as the law allows. We do not make promises beyond those the law requires, including implied guarantees about quality, suitability for a particular purpose, ownership, non-infringement, or uninterrupted use.
We cannot guarantee uninterrupted availability, complete audit capture, prevention of every disclosure, recovery or decryption of every secret, validity of third-party credentials, compatibility with every host or workflow, or protection of a compromised trusted device.
Asiri reduces secret sprawl, accidental exposure, and blast radius. It does not certify your security or compliance posture and does not replace host security, provider-side rotation, cloud IAM, professional security review, or incident response.
12. Claims connected to your actions
If a claim against O'CLAN LIMITED, Asiri, our related companies, or our staff is connected to your credentials, metadata, commands, devices, use of Asiri, breach of these Terms or the law, or violation of someone else's rights, you agree to defend us, compensate us, and protect us from legal responsibility. This includes claims, liabilities, damages, provider charges, court decisions, awards, losses, costs, expenses, and reasonable legal fees.
13. Limits on our responsibility
As far as the law allows, O'CLAN LIMITED, Asiri, and our related companies are not responsible for indirect, special, incidental, consequential, or punitive losses. This includes lost profits, lost data, lost credentials, lost goodwill, downstream provider charges, credential misuse, and business interruption connected to Asiri.
As far as the law allows, the most we will pay for all claims connected to Asiri or these Terms is the greater of the amount you paid us for Asiri during the 12 months before the event that caused the claim, or NGN 1,000.
These limits do not apply where the law does not allow us to limit responsibility, including fraud, fraudulent statements, deliberate misconduct, or another responsibility that cannot legally be limited.
14. Resolving disputes
Please email hi@oclan.co first so we can try to resolve the issue informally.
Unless the law does not allow it, disputes connected to Asiri or these Terms will be decided through private, binding arbitration in Lagos State, Nigeria, in English, by one arbitrator. Either side may still ask a court for an order or other equitable remedy concerning misuse of intellectual property, confidential information, or unauthorised access.
You and O'CLAN LIMITED agree to bring claims only for yourselves. Neither side will take part as a claimant, class member, or representative in a class, collective, combined, or representative case. As far as the law allows, you also give up the right to a jury trial for a dispute that is allowed to go to court.
15. Time limit for claims
As far as the law allows, any claim connected to Asiri or these Terms must be brought within one year of the event that caused it. After that, the claim is permanently barred.
16. Trade restrictions and sanctions
You must follow all export control, trade restriction, and sanctions laws that apply to you. You confirm that you are not based in, registered in, or normally living in a place where using Asiri would be unlawful. You also confirm that you are not subject to sanctions or restrictions that prohibit your use of the service.
17. Laws that apply
Nigerian law governs these Terms. Consumer rights that must apply where you live will still apply.
Our Privacy Policy explains how we handle personal data and the rights available under laws such as Nigeria's Data Protection Act, the GDPR, and California's CCPA.
18. Other legal terms
- These Terms and the Privacy Policy make up the full agreement between you and us for Asiri unless we have a separate written agreement.
- If a court or arbitrator cannot enforce one part of these Terms, the rest will continue to apply.
- If we do not enforce a term straight away, we may still enforce it later.
- You cannot transfer these Terms without our written permission. We may transfer them as part of financing, a merger, an acquisition, a reorganisation, or a sale of assets.
- We are not responsible for delays or failures caused by events beyond our reasonable control.
19. Changes to these Terms
We may update these Terms as Asiri changes. We will publish the latest version here and show its effective date. If a change materially affects your rights, we will take reasonable steps to provide additional notice.
20. Contact us
For legal notices, privacy requests, or questions about these Terms, email O'CLAN LIMITED at hi@oclan.co.