Terms of Use

3. Services

3.1 We provide the elastic.io integration platform (“Platform”) as Platform as a Service (PaaS) in the scope set out in the current service description for the ordered package and in the order form, available at https://www.elastic.io/. Access and administration are provided via web interface, application programming interfaces (API) and, where enabled, the Model Context Protocol interface described in section 9 (“MCP Interface”).

3.2 Our services include hosting the Platform and providing storage and computing capacity for data the customer creates or processes on the Platform (“Customer Data”). We back up the Platform and Customer Data daily.

3.3 The customer may use the Platform for itself and to provide integration services to its own customers.

3.4 The handover point for our services is the router exit of the data centre used by us. We are not responsible for the customer’s hardware, software or telecommunications connection up to the handover point.

3.5 We provide open-source software, including SDKs, command line interfaces and templates, under the respective open-source licences (e.g. MIT, GPL), which the customer must comply with. Where we provide such software free of charge, we are liable only in accordance with the statutory rules for gifts (§§ 521, 523, 524 BGB), subject always to section 16.

3.6 We may develop the Platform further, including by releasing new versions, updates and upgrades, to adapt to technical progress, security requirements or legal changes, provided the agreed core functionality is preserved.

3.7 We will endeavour to maintain backward compatibility. We will notify the customer at least 14 days in advance of changes that we expect to impair integrations built by the customer, unless an immediate change is required for security or legal reasons. The customer is responsible for adapting its integrations.

3.8 Support is provided by email and/or telephone as described for the respective package, Monday to Friday, 8:00–18:00 Central European Time (CET).

4. Third-party systems and connectors

4.1 The Platform enables the customer to connect third-party applications, APIs and services (“Third-Party Systems”), including AI services. The customer selects these systems, is responsible for having the necessary rights and accounts, and must comply with their terms.

4.2 Third-Party Systems are not part of our services. We are not responsible for their availability, functionality, security, data processing or outputs, nor for changes their providers make to their interfaces.

4.3 Data the customer transfers to Third-Party Systems via the Platform is transferred on the customer’s instruction and leaves our area of responsibility once transmitted.

5. Registration and trial

5.1 Use of the Platform requires a user account. The customer must provide accurate information and keep it up to date.

5.2 New customers may use the Platform free of charge for a 14-day trial. To continue afterwards, the customer must order a paid package.

5.3 Trials are available only to registrations with an organisational email domain; registrations using generic domains (e.g. gmail.com, yahoo.com) may be deleted. Trial use is provided without availability commitments. Trial accounts and their data are deleted up to 30 days after the trial ends unless a paid package is ordered.

6. Availability

6.1 The Platform is available 99.9% of the time in each calendar month, measured at the handover point.

6.2 Planned maintenance does not count against availability. We will announce planned maintenance at least 3 business days in advance (we aim for two weeks) in suitable form, stating its type, scope and duration, and schedule it outside main business hours (CET) where possible.

6.3 Downtime also does not count against availability where it is caused by: (a) the customer’s breach of contract or misuse; (b) the customer’s hardware, software or integrations, or Third-Party Systems; (c) the customer’s internet access provider; (d) force majeure (section 18.4); (e) suspension under section 10; or (f) features designated as beta or preview, including the MCP Interface during its preview phase.

6.4 The customer must report outages without delay to [email protected], stating date, time and available evidence.

7. Rights of use and acceptable use

7.1 For the term of the contract, we grant the customer a non-exclusive, non-transferable right to use the Platform in accordance with the ordered package, for itself and its customers.

7.2 The customer may not modify, copy, distribute or make the Platform available to third parties except as required for the contractual use. Providing the Platform to non-affiliated companies as a service of its own (e.g. white-label or application service provision) requires our prior consent in text form. All rights not expressly granted remain with us.

7.3 The customer may not decompile, disassemble or otherwise reverse-engineer the Platform, except to the extent permitted by § 69e UrhG, and then only after requesting the necessary information from us and allowing a reasonable period for us to provide it.

7.4 The customer may not use the Platform: (a) for unlawful purposes or in violation of third-party rights; (b) to transmit malware or carry out attacks; (c) to circumvent security or usage limits; (d) to send unsolicited mass communications; or (e) to develop or train a product competing with the Platform.

7.5 Customer Data and integrations the customer builds remain the customer’s. We may copy them only as required to provide the services, including backups, and may remove integrations that endanger system integrity, after notice where possible.

7.6 We reserve the right to text and data mining of our website, documentation and Platform content within the meaning of § 44b UrhG and Art. 4 of Directive (EU) 2019/790. This reservation is also expressed in machine-readable form.

8. API and automated access

8.1 Automated access to the Platform, including by scripts, bots and AI agents, is permitted only through the documented API and MCP Interface, using credentials issued for that purpose.

8.2 Automated access to the web interface, including scraping, is not permitted unless we have agreed to it in text form.

8.3 We may set and change rate limits and usage quotas for automated access to protect the stability and security of the Platform.

9. MCP Interface and AI agents

9.1 Where enabled for the customer’s package, we provide an interface based on the Model Context Protocol, including MCP server software distributed as an npm package, through which AI applications and agents selected by the customer (“AI Agents”) can access the customer’s account, read and write Customer Data, and perform any action available via the API, within the access rights and permission level of the user account whose credentials are used. The MCP server software is open source; section 3.5 applies. We provide the interface only. We do not provide, operate, select or control any AI Agent or AI model.

9.2 Use of the MCP Interface is optional. By connecting an AI Agent to the Platform via the MCP Interface, the customer agrees to these Terms in the version published at that time, in particular this section 9. The customer shall ensure that every person who sets up the MCP Interface on its behalf is aware of these Terms.

9.3 The customer alone decides whether to connect an AI Agent, which AI Agent and provider to use, and which permissions to grant. AI Agents and their providers are Third-Party Systems within the meaning of section 4.

9.4 All actions carried out via the MCP Interface using the customer’s credentials, including reading, creating, changing, executing or deleting integrations and data, are deemed to be actions of the customer. This applies regardless of whether a natural person reviewed or approved the individual action.

9.5 The customer is responsible for: (a) connecting AI Agents only through user accounts and credentials whose permissions are limited to what the AI Agent needs, as the AI Agent can read, change and delete data within those permissions; (b) keeping MCP credentials secret and revoking them without delay if compromise is suspected; (c) monitoring the AI Agent’s activity; and (d) ensuring its use of the AI Agent complies with applicable law and these Terms. We recommend read-only access wherever possible, a dedicated user account for each AI Agent, and human approval for actions that change or delete data or trigger external effects.

9.6 Customer Data that an AI Agent retrieves via the MCP Interface is transmitted to the AI Agent and its provider on the customer’s instruction. The customer is responsible for having a legal basis for this transfer and appropriate agreements with the AI provider, in particular under data protection law. Section 4.3 applies.

9.7 We are not responsible for the instructions, decisions, outputs, errors or actions of AI Agents, nor for the processing of data by AI providers. Our liability for defects in the MCP Interface itself remains subject to section 16.

9.8 We may designate the MCP Interface, or parts of it, as beta or preview. Preview features are provided without availability commitments and may be changed or discontinued. We may rate-limit, restrict, suspend or revoke MCP access where necessary to protect the Platform, other customers or third parties (section 10).

9.9 Where the customer uses the Platform to build, connect or operate AI systems, the customer is responsible for compliance with applicable AI regulation, including Regulation (EU) 2024/1689 (AI Act).

9.10 We do not use artificial intelligence to process Customer Data, and we do not use Customer Data to train AI models, nor permit third parties to do so. If we intend to introduce AI-based features, we will amend these Terms in accordance with section 2 beforehand, and such features will be optional. This does not apply to AI Agents and AI providers selected by the customer (sections 9.3 and 9.6).

10. Suspension

10.1 We may block access to the Platform in whole or in part if: (a) the customer materially breaches its obligations under sections 7, 8, 9 or 12; or (b) the customer is more than 30 days in arrears with payment. We will notify the customer in text form beforehand and set a reasonable deadline to remedy the breach.

10.2 We may block access, including individual API or MCP credentials, without prior notice where this is necessary to avert a threat to the security or integrity of the Platform or to other customers. We will inform the customer without delay and restore access once the threat has been removed.

10.3 Blocking is limited to what is necessary. The customer’s payment obligation continues during a blocking it is responsible for.

11. Fees and payment

11.1 Fees are set out in the order form or, failing that, in the price list at https://www.elastic.io/. All prices are exclusive of statutory VAT.

11.2 Fees are payable in advance for the agreed billing period, starting from the day the Platform is made available. For part-months, each day is charged at 1/30 of the monthly fee.

11.3 Unless otherwise agreed, payment is by credit card, charged at the start of each billing period.

11.4 For fixed-term contracts, the agreed fees remain unchanged for the current term; we may change them for a renewal term if we notify the customer in text form before the deadline for terminating the current term. For monthly packages, we may adjust fees with effect from the start of a new billing period by notifying the customer in text form at least six weeks before the change takes effect; the customer may terminate with effect from that date.

11.5 The customer may set off only claims that are undisputed or legally established, or that arise from the same contractual relationship.

12. Customer obligations

12.1 The customer must check the technical requirements in the service description before use.

12.2 The customer must prevent unauthorised use of the Platform, keep all credentials (including API keys and MCP tokens) secret and protected, and notify us without delay of any suspected misuse.

12.3 The customer must oblige its employees and any persons it authorises to comply with these Terms, and is responsible for their actions as for its own.

12.4 The customer shall indemnify us against third-party claims, including reasonable legal defence costs, arising from: (a) Customer Data or integrations; (b) the customer’s use of Third-Party Systems or AI Agents; or (c) any use of the Platform in breach of these Terms or applicable law, in each case to the extent the customer is responsible for it. We will inform the customer promptly of such claims and allow it to take part in the defence.

12.5 The customer must report defects without delay, with a description sufficient to reproduce them.

13. Data protection and security

13.1 Both parties comply with applicable data protection law. Where we process personal data on the customer’s behalf, the data processing agreement under Art. 28 GDPR concluded separately between the parties applies and forms part of the contract, including its list of sub-processors.

13.2 The customer is responsible for the lawfulness of the data it processes on the Platform, including any consents, and for transfers it instructs to Third-Party Systems and AI Agents.

13.3 Customer Data is hosted with the cloud provider and in the region agreed for the customer’s account, as specified in the data processing agreement. The Platform is cloud-independent, and other providers or regions may be agreed on request. Our current hosting providers, regions and the jurisdiction of the infrastructure we use are listed at the link.

13.4 We maintain appropriate technical and organisational measures as described in the data processing agreement and will inform the customer without undue delay of security incidents affecting Customer Data.

14. Confidentiality

14.1 Each party will keep confidential all non-public information of the other party it receives in connection with the contract, use it only for that purpose and protect it with at least reasonable care. This obligation continues for three years after the contract ends.

14.2 This does not apply to information that is publicly known, was lawfully known to the recipient beforehand, was independently developed, or must be disclosed by law or official order.

15. Warranty

15.1 We will remedy defects within a reasonable period. For material defects, the customer may reduce fees appropriately for the duration of the defect. The right to extraordinary termination for cause remains unaffected.

15.2 The following are not defects: (a) impaired functionality of customer-built integrations resulting from changes under sections 3.6 and 3.7; (b) malfunctions of Third-Party Systems or AI Agents; and (c) the behaviour or outputs of AI Agents.

16. Liability

16.1 We are liable without limitation for damage caused by intent or gross negligence; for injury to life, body or health; under the Product Liability Act; for fraudulently concealed defects; and within the scope of any guarantee we have given.

16.2 In cases of slight negligence, we are liable only for breach of material contractual obligations, i.e. obligations whose fulfilment makes proper performance of the contract possible in the first place and on whose fulfilment the customer may regularly rely. In that case, liability is limited to the damage foreseeable and typical for this type of contract, and in total to EUR 5,000 per contract year.

16.3 Otherwise, liability for slight negligence is excluded.

16.4 Liability for loss of data is limited to the cost of restoring it that would have been incurred had the customer made regular backups appropriate to the risk.

16.5 Strict liability for defects existing at the time the contract is concluded (§ 536a(1), 1st alt. BGB) is excluded.

16.6 The above limitations also apply to the personal liability of our employees, representatives and vicarious agents. The defence of contributory fault remains unaffected.

17. Term, termination and exit

17.1 The contract runs for the term stated in the order form and renews automatically for the same term unless terminated. Monthly packages may be terminated by either party with 30 days’ notice to the end of a calendar month; longer terms with three months’ notice to the end of the current term.

17.2 The right to terminate for cause remains unaffected. Termination requires text form.

17.3 Switching and data export (EU Data Act). In accordance with Regulation (EU) 2023/2854, the customer may at any time request to switch to another provider or to its own infrastructure, or to export its exportable data and digital assets, giving notice of no more than two months. Following the notice period, a transition period of up to 30 days applies, during which we provide reasonable assistance and continue to provide the services. The customer may extend the transition period once. If the transition is technically unfeasible within 30 days, we will inform the customer within 14 days of the request, giving reasons, and may extend the period to no more than seven months.

17.4 Exportable data includes: integration flows, including their configuration, and execution logs within their retention period. Custom components remain in the customer’s own code repositories. Account settings and access credentials cannot be exported. Exportable data does not include our proprietary software, internal operational data, or data whose export would infringe our or third parties’ trade secrets or security. We provide exports in a structured, commonly used and machine-readable format. Export methods and log retention periods are described in our documentation at the link.

17.5 After the transition period, the customer may retrieve its data for at least 30 days. We will then delete Customer Data, unless we are legally obliged to retain it.

17.6 We do not charge for exporting data or for switching using the Platform’s export functions. Our assistance is limited to the Platform; setting up integrations or migrating workflows on another provider’s platform is not part of our services.

18. Final provisions

18.1 German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

18.2 The exclusive place of jurisdiction for all disputes arising from the contract is Frankfurt am Main, Germany. We may also sue the customer at its general place of jurisdiction.

18.3 The customer may assign rights under the contract only with our prior consent in text form. § 354a HGB remains unaffected.

18.4 Neither party is liable for failure to perform due to force majeure, including natural disasters, pandemics, war, terrorism, government measures, large-scale cyberattacks or failure of public infrastructure, for as long as the event and its effects last. If the event lasts more than 60 days, either party may terminate the contract.

18.5 The customer may not use the Platform in breach of applicable export control and sanctions law, including EU sanctions regulations, and confirms that neither it nor its users are subject to such sanctions.

18.6 Notices under these Terms may be given by email to the addresses stored in the customer account or notified by us.

18.7 Should any provision of these Terms be or become invalid, the validity of the remaining provisions is unaffected.