Terms of Service

Version 1.0. Effective 2026-10-16.

These terms are an agreement between you and BETA BLOCKS PTE. LTD. (trading as openbinary), a company registered in Singapore under number 202513462K with its registered office at 68 Circular Road #02-01, Singapore 049422 ("openbinary", "we", "us"). They cover openbinary.ai and any analysis service, software or API we provide (the "Service"). Our Privacy Notice, our Data Processing Addendum and our removal policy are part of this agreement.

How you accept. You accept these terms by creating an account, by signing in to a free plan through a screen that references them, by clicking a box that indicates acceptance, or by paying for a plan. We record which version you accepted, and when.

Who you are. If you accept for a company or other organisation, you confirm you may bind it, and "you" means that organisation. You must be at least 18 and able to enter a binding contract. The Service is built for professional use, and if you are an individual using it for yourself rather than for an organisation, you are welcome to — and where the law gives you rights as a consumer, nothing in these terms takes them away. Section 7 says what that means for refunds.

These terms do not replace a separate written agreement that we sign with you. If we sign one, it prevails over these terms.

1. What the Service is

openbinary analyses software. You send it a binary, firmware image, package or source tree, and it produces metadata, behaviour, components, vulnerabilities, capabilities, a verdict, decompiled pseudocode and a reconstructed source package, depending on your plan.

The Service is a static and emulated analysis service. We do not run your code on your systems, we do not connect to your infrastructure, and we do not sell or ship the files you give us.

We may change the Service, including adding, altering or removing features and changing what each plan includes. We will give notice of changes that materially reduce what you paid for, as set out in section 10.

2. Accounts, workspaces and seats

You need an account to upload files or use the API. Sign-in is passwordless email.

Work is organised in workspaces. A plan belongs to an organisation, and each person in its workspaces is a seat. You are responsible for what happens under your accounts, for keeping API keys and access credentials secure, and for your members' compliance with these terms. Tell us promptly about unauthorised access.

3. Your files

Ownership. Your uploaded files remain yours. We claim no ownership of them. Where you upload software on behalf of a customer or employer, you confirm you may do so.

You must have the right to submit a file. You confirm that you own the file, or that you have the rights and permissions needed to submit it for analysis and to grant us the licence in this section.

The licence we need to run the Service. You grant us a worldwide, non-exclusive, royalty-free licence to store, copy, analyse, process and transmit your uploaded files and their analysis output, so that we can provide the Service to you and your workspace. It lasts while your content is on the Service, plus the retention periods in our Privacy Notice.

The licence we need to improve the Service. You also grant us a licence to use your files and their analysis to develop our analysis: to compare them with what we have already seen, to build and maintain our fingerprint, similarity and function libraries, to train and evaluate the models we use to analyse files, and to produce statistics and derived data.

What "private" means, precisely. It is about what we do. We do not publish your file, and we do not make it available to another customer, unless you direct us to. You can direct us to in three ways, and they are the exits from a workspace described in section 4: make it public, share it by link, or use a plan whose uploads are public by design. Outside those three, nothing in this licence lets us show your file, its analysis, or anything that identifies them, to anyone else.

It is worth being explicit about what that does and does not mean, because the distinction matters. A private file still contributes to what our engine learns. When our function library resolves the real name of a stripped function, it does so by comparing bodies across many files, and comparing against yours is part of how that answer gets better — for you, and for everyone. What you keep is that nobody else can see your file or anything traceable to it, unless you say so.

These libraries are cumulative, so this licence continues for what has already been derived after your file is deleted. That is the one place where deletion is not complete, and saying so is more honest than promising a clean slate: deleting a file deletes the file and its analysis, not the fact that the engine compared it once.

No redistribution. We never publish, license, sell or otherwise make available a downloadable copy of your uploaded file. There are no binary downloads from the corpus.

Submitting a file is a request, not a promise. We may decline to analyse a file, decline to publish it, remove it or stop working on it, and we do not guarantee that anything you submit will be analysed, published or kept. We may limit or suspend submissions that are junk, duplicative or clearly unfounded, without ending your account.

Malware. You may submit malware and other hostile files, and we expect you to. We analyse them in isolation. You are responsible for how you handle any sample and any output, and you acknowledge that samples may contain code designed to damage systems or exfiltrate data.

What you must not submit. Content that is unlawful where you or we are located; content that would make us provide a defence service or breach export controls, including material controlled by the ITAR; child sexual abuse material; and personal data you have no lawful basis to disclose to us. If you are unsure whether a file contains personal data, treat it as though it does and tell us.

4. Public and private

Every analysis has a visibility state: private or public.

Private means the analysis is available to your workspace, and to nobody else. Private is available on paid plans, and is the default for files you upload on paid plans.

Public means the analysis appears in the openbinary corpus, where other users can find it. What a public analysis exposes depends on the reader's own plan: the overview is visible to anyone, and reading the code — pseudocode, functions, disassembly — is available to signed-in users whose plan includes it.

Some plans publish by design. The free Developer tier analyses uploads into the public corpus; there is no private option on that plan. We say so on the plan and on the upload screen before you upload, and the choice of plan is the choice about visibility.

You can make a private file public. We provide a "make public" action in a workspace. Only a workspace administrator can use it, and it takes a second confirmation step. It can be applied to a file you uploaded, and it may be applied to a batch. When you use it you are telling us to publish that analysis. This is a deliberate act with lasting effect, so read what it does:

• The published analysis is derived from a file you were entitled to submit, and you confirm that again when you publish.
• It is permanent. It becomes available to other users, subject to their plan, and it does not come back. We can stop displaying it, and we will on legal grounds or on request, but we cannot recall how third parties used what they read, and the published facts about the file remain part of the corpus record.
• If the same file is already in the corpus, publishing your copy does not remove or replace that record. It may add attribution.
• Publication joins an anonymous public identity to the record. Your workspace is the publisher internally and we know which workspace published, but nothing public names you. If you want your workspace credited, ask us and we will show it.

When you publish, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to publish, display, distribute and retain that analysis, to include it in the corpus, and to build on it as section 15 allows. You cannot withdraw that licence. You can ask us to stop displaying the analysis, and we will, but the licence is what lets the record exist at all, and a corpus that could be retroactively emptied would not be worth keeping.

The same bytes are one record, whoever sends them. Analysis is keyed to the file's hash. If identical bytes are already in the corpus, or reach it later from someone else, there is one record and one analysis rather than two. Three consequences, and they are stated plainly because they are easy to be surprised by:

• If a file you keep private is also in the corpus from another source, the analysis is public because of that other copy, not because of yours. We will not hide a public fact because you also hold the file privately, and equally we will not disclose that you hold it.
• If you publish a file someone else already published, you have added no new public facts. You have joined the record.
• If a file is analysed once, later uploads of the same bytes reuse that analysis instead of repeating the work. That is the point — and it means the analysis can be available the instant you upload, without telling you anything about who else has the file.

You can share a single analysis by link. A member of a workspace can mint a read-only link to one file. Whoever holds the link can open that analysis at the workspace's plan, without an account of their own, and cannot upload, change or re-analyse anything: a link reads, it does not work. Three things to know before you send one:

• A share link does not expire. Revoking it is the control, and revocation stops it opening the analysis again. It does not recall what a recipient has already read, exported or copied, and it does not make the analysis confidential again.
• A share link is not publication. It does not put the file in the corpus, it cannot be found by searching, and it does not carry the licence we take when you publish. It does disclose the analysis to whoever holds it, so treat it as disclosure rather than as access control — and treat the link itself as sensitive.
• It follows your plan. The reader sees the depth your plan permits. If the workspace changes plan, the link shows what the new plan allows.

Public is the default where we harvest, not where you upload. Most of the corpus is software we obtained from public sources — package registries, vendor firmware, distribution mirrors, public repositories — and analysed ourselves. That analysis has no uploader and no private counterpart.

Secrets follow the analysis, not a separate rule. Where our analysis extracts credentials, keys, tokens or certificates from a file, they are part of that analysis:

• A private file. What we extract from it is visible to your workspace and to nobody else; another workspace never sees it.
• A public file. What we extract from it is published with the rest of the analysis, whether the file came from a workspace or from a public source. An extracted credential is a finding, and often the most important one in the file.
• A share link. It exposes the findings to whoever holds the link, at your plan's depth.

Three consequences worth knowing before you act:

• If you publish a file, you are publishing what we found inside it. Check the secrets findings first if that matters to you, and ask us to redact a specific finding if you need to. We do that.
• The one-record rule above applies here too: if the same bytes are already public, or become public from another source, the analysis of them — secrets included — is public because of that copy, not because of yours.
• Credentials inside a file usually got there because the software was built badly. If the credential is still live, its owner should rotate it, not ask us to hide the evidence — but where the owner or the affected service asks us to take a live credential down, we do it quickly, as the removal policy says.

5. Analysis output — what it is and is not

Analysis output is produced by automated tools and, for some features, by third-party large language models. It can be wrong, incomplete or out of date, and no model or analysis is perfectly accurate. Use discretion. It can include credentials, keys and other sensitive values found inside a file: those are findings, and when the analysis is public they are public with it — see section 4. Nothing in the Service is legal, security, compliance, insurance or investment advice, and no verdict, score, finding or description should be relied on as a complete account of what software does.

Analysis output is not the source code of the software analysed. Decompiled pseudocode and reconstructed source are mechanical transformations produced for security research, interoperability and defensive purposes. We do not grant you any rights in the software that was analysed, and no licence from its author comes with the output. Whether you may act on any particular output — copy it, rely on it, disclose it — is your question to answer, and it depends on the law where you are and on the licences that apply to the software.

We do not take decisions about you by automated means that produce legal effects. Verdicts and scores inform your review; they do not replace it.

6. Your use of the corpus and the API

This section is about what you may do with what we publish. It does not restrict what we may do with the corpus: that is ours, and section 15 says so.

You may read, search and export corpus data through the Service and the API for your own internal purposes and for the purposes of your organisation.

You may not, without our written permission:

• scrape, mirror, bulk-export or resell corpus data, analysis output or the API, or build a substitute or competing corpus or dataset from them;
• use corpus data or analysis output to train, fine-tune, evaluate or benchmark any model or product that is offered commercially or that competes with the Service;
• publish a benchmark, comparison or performance analysis of the Service — unless you give us at least 30 days' notice and a chance to comment, and you publish our comment alongside your results;
• attempt to identify any individual, or to attribute authorship to any person, from corpus data;
• present corpus data as your own analysis or remove attribution from enrichment we license from third parties.

We may set and enforce rate and volume limits on the API, and we may suspend access that threatens the Service or other users.

No text or data mining, and no AI training. We do not consent to the use of the Service, the corpus, or anything published by it for text or data mining, or for developing, training, fine-tuning, validating or evaluating any artificial intelligence system or model — by scraping, by API, by bulk export, or by any automated analytical technique. This is an express reservation of our rights, including for the purposes of Article 4(3) of Directive (EU) 2019/790 and equivalent reservations in other jurisdictions.

If you want to train on our data, that is a licence, not a consent — ask.

A third party may claim that what you published infringes their rights. If they do, we may identify you to them as the publisher, and you agree that we may. We will tell you before we do unless we are prohibited from doing so.

7. Plans, fees and credits

Plans, what each includes and current prices are published on our pricing page. Fees are charged in US dollars by our payment processor.

Fair use on the free tier. Free access is for evaluation, research and small-scale use, measured in the seats, uploads and queries your plan states. If use goes well beyond that, we may ask you to move to a paid plan, limit the rate, or suspend the free access.

Contributor access. We may grant free or discounted access at our discretion — to people and organisations whose submissions improve the corpus, to open-source maintainers, and to early-stage companies — and we may withdraw it on notice. It is a discretionary grant, not an entitlement, and losing it does not entitle you to a refund of anything you have not paid.

Monthly plans may be cancelled at any time and end at the end of the paid period. Annual plans renew for successive years unless either of us gives at least 30 days' notice before the renewal date. We may change prices with at least 60 days' notice before a renewal, and the change applies from that renewal.

Credits and upload packs are prepaid, do not expire while your account is open, and are not refundable except where the law requires it or where we terminate for our own convenience.

A 14-day refund, to anyone. If you have paid us and you ask within 14 days of the charge, we refund it — no questions, no reason needed. That includes a consumer in the European Union exercising a withdrawal right, and it is simpler than deciding case by case whether one applies. After 14 days: a monthly plan ends at the end of the paid month, an annual plan is not refunded for the unused part, and prepaid credits and packs are not refunded — except where the law requires it, or where we end your plan for our own convenience.

Fees exclude taxes. You are responsible for any sales, use, value-added, goods and services or similar tax arising from your purchase, other than tax on our net income. Where withholding applies, we may require the amount to be grossed up.

We may suspend or end your access for non-payment after notice, and we may decline or end a customer or a plan at our discretion where we have a lawful reason, including sanctions, export controls, security or abuse concerns.

8. Acceptable use

You agree not to use the Service to break the law; to infringe anyone's rights; to gain unauthorised access to any system; to send us files you have no right to send; to interfere with or overload the Service; to circumvent plan limits, authentication or paywalls; to provide the Service to third parties as a service in its own right; or to help anyone else do any of those things.

Analysis obtained from the Service may not be used to build a product that substitutes for it, or to attack the systems or reputation of another user, of openbinary, or of any third party.

We may report criminal activity to law enforcement and cooperate with them, including disclosing what we hold about an account, where we are permitted or required to do so. Attacking the Service is a criminal offence in Singapore and elsewhere, and we treat it as one.

9. Confidentiality

Each of us will keep the other's non-public information confidential, use it only to perform this agreement, and protect it with at least reasonable care. Your uploaded files are confidential while they are private. Analysis that you choose to publish, and analysis of software we obtained from public sources, are not confidential. Confidentiality obligations last five years after the agreement ends, and indefinitely for information that remains a trade secret.

If we are required by law or a valid order to disclose your information, we will notify you unless we are prohibited from doing so.

10. Changes, term and termination

These terms are versioned, and every previous version stays available.

How changes work. Changes take effect when we post them, except that we give at least 30 days' notice of one that materially reduces your rights or increases your obligations. That is the whole rule, and it applies to everyone: paid, free, and anyone who has ever had an account.

Two exceptions, because they protect you as much as us. A change required by law or by a regulator, or a change made to close a security or abuse hole, may take effect sooner than 30 days. We will give you what notice we can, and we will not use either exception to reduce what your plan provides.

Continuing to use the Service after a change takes effect means the new version applies. If you do not accept it, stop using the Service and cancel — a monthly plan ends at the end of the paid month, and an annual plan simply does not renew.

If we materially reduce what your plan provides — as opposed to changing the text — you may end the affected plan and we will refund the prepaid, unused part. And where the law gives you a right to end the agreement because of a change, nothing here removes it.

If your paid plan ends, your account does not. Your workspace drops to the free tier. Private files stay private and do not become public because you stopped paying; we keep them while your account is open, and they are visible to you again if you subscribe again. If a free account sits unused for 12 months, we may delete its contents after giving notice to your email address.

This agreement runs while you have an account. You may end it at any time by closing your account. We may end it or suspend your access for breach (with a chance to fix anything capable of being fixed, except non-payment or a security risk), if your account is inactive for 24 months with no paid plan, or if we discontinue the Service with reasonable notice.

On termination: your right to use the Service ends, and we remove your workspace and the private records that point at your files, so nothing on the Service surfaces them to anyone. You choose whether we delete those files and their analysis or return a copy to you first, as our Data Processing Addendum sets out. Where we cannot delete — the same bytes held by another workspace, or a corpus record — we tell you which applies and sever your connection to the record rather than pretending it never existed. What we keep either way is what the comparison libraries learned, as section 3 says. Published corpus records remain, per our removal policy, and we may keep what we must for legal, tax, security and dispute purposes.

11. Support, service levels and warranties

Support. We answer support requests from the email on your account and through the Service. Response targets, by severity, are:

Severity	What it means	First response
1	The Service is unavailable	4 business hours
2	A core function is broken, no workaround	1 business day
3	A function is broken or degraded, workaround exists	3 business days
4	Question, request, cosmetic issue	5 business days

Enterprise plans may state their own targets in the order. The remedy for failing to meet a target is a credit against your next invoice, and that is the only remedy for it.

Warranties. For paid plans, we warrant that the Service will conform in all material respects to its documentation during your term. If it does not, we will repair or re-perform the affected part, and if we cannot do so within 30 days you may end the affected plan and we will refund prepaid, unused fees. That is the remedy for this warranty.

We do not warrant that the Service will be uninterrupted or error-free; that analysis output will be accurate, complete or current; that the Service will find every vulnerability, threat or component; or that it will identify everything a piece of software does. The free tier is provided as-is, without this warranty.

12. Liability

Neither of us is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, business, goodwill, or data, however caused and whatever the theory, even if warned of the possibility.

Our total liability under this agreement is limited to:

• US$100 if you are on the free tier; and
• otherwise, the fees you paid us in the 12 months before the event giving rise to the claim.

The cap does not apply to your payment obligations, your indemnity in section 13, either of us in respect of confidentiality, our liability for death or personal injury caused by negligence, or anything else that cannot be limited by law.

We are not liable for what you or anyone else does with analysis output, or for any decision taken on the basis of it.

13. Indemnities

You will defend us against third-party claims arising from a file you submitted or published, from your use of analysis output, or from your breach of these terms, and you will pay the resulting costs, damages and reasonable legal fees.

If a third party claims that software we supplied you — not the software you analysed — infringes their rights, we will defend that claim and pay the costs, at our option procure the right for you to continue, replace the affected part, or end the affected plan and refund prepaid, unused fees. That is the remedy for such a claim.

It does not apply where the claim arises from your files, from your modifications, from your combination of our software with something else, or from your instructions. It also does not apply to anything to do with software that was analysed through the Service, to analysis output, or to a claim by a rights holder in software in the corpus. Those are dealt with under our removal policy, and your warranty and indemnity for what you submit is what answers them. We do not warrant that analysis, decompilation or reconstruction of third-party software is free of third-party claims, and we give no indemnity for it.

14. Export control and sanctions

You confirm that you are not subject to sanctions imposed by the United Nations, Singapore, the European Union, the United Kingdom or the United States; that you are not located in an embargoed country; and that you will comply with export and import control law applicable to you and to us. You will not submit or export anything controlled by the ITAR or that would make us provide a defence service.

We may suspend or end the Service, and refuse or cancel an order, where we believe this section is breached or where continuing would put us at risk under sanctions or export law.

15. Our intellectual property and publicity

The Service, the corpus, our analysis engine, our function and fingerprint libraries and our documentation remain ours. You get no rights in them except the licence these terms give you to use the Service. If you send us feedback or a suggestion, we may use it without obligation to you.

We may build on the corpus without restriction. We may analyse it, run any analysis over it, build fingerprints, libraries, indices, statistics and models from it, publish its contents subject to the Privacy Notice and the removal policy, and license derived data and feeds to others. Nothing you do with the corpus, and nothing in this agreement, limits that.

We claim no rights in the software we analyse. Our rights in the corpus are rights in our analysis of it, and in the derived data we build from that.

We will not use your name or logo in a press release without your written consent. We may include your organisation's name and logo in customer lists and on our website, unless you tell us not to.

16. Governing law and disputes

These terms are governed by the laws of Singapore. The parties submit to the exclusive jurisdiction of the courts of Singapore, and the United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before starting proceedings, each of us will give the other 30 days' written notice and a chance to resolve the dispute in good faith. Nothing in this section stops either of us from seeking urgent injunctive relief.

17. General

If a provision is unenforceable it is severed and the rest stands. A failure to enforce is not a waiver. You may not assign this agreement without our consent; we may assign it to an affiliate or in a merger or sale of assets, and we will tell you if we do. We may use subcontractors to provide the Service and remain responsible for what they do. Neither of us is liable for delay caused by events beyond reasonable control, except for payment obligations. Notices go to the email on your account and to legal@openbinary.ai. Nobody who is not a party to this agreement has any right under it. This agreement, with the documents it incorporates, is the whole agreement between us. The sections that by their nature should survive termination — confidentiality, intellectual property, liability, indemnities, governing law and this section — do survive it.

18. Self-hosted and downloadable software

If we make a downloadable or on-premises version of the Service available to you, these additional terms apply to it. Nothing else in this agreement changes.

• You are licensed to install and use it for your internal business purposes, in object code form, for the term and quantity stated when you obtain it. A perpetual licence lasts as long as the intellectual property rights in the software; a subscription licence is for its stated term and renews unless either of us gives 30 days' notice.
• Licences are per named user, per fixed host, or floating, as stated when you obtain them. A named user may use the software on up to three machines they control, on one at a time. A floating licence permits one concurrent use.
• You may make reasonable backup copies, and you may transfer a perpetual licence once, permanently, with the software and these terms, if the recipient accepts them.
• You may not make the software available to third parties as a service, use it to provide an analysis service to others, or include it in a product you offer, without our written agreement. Our SDKs and APIs may be used to build integrations for your own internal use.
• You may not remove or circumvent licence, activation or usage limits.
• We may collect activation data and, unless you are on an air-gapped installation, basic usage telemetry, as described in our Privacy Notice. A self-hosted installation does not send your analysed files or their analysis to us. If we offer a feature that contacts us — a corpus lookup, for instance — it is off unless you turn it on, and we will say what it sends before you do.
• Support, updates and upgrades are provided as described on the page or order where you obtained the software, and end when your support term ends. We will provide security updates for the software throughout the support period, and we will state that period's length before you buy, so it is written down rather than implied.
• Reverse engineering the software is not permitted except where the law gives you that right.

Contact

legal@openbinary.ai for anything legal: these terms, your personal data, a takedown notice, or a question about this agreement. Takedown notices have their own route in the removal policy. security@openbinary.ai to report a vulnerability or a leak.