LEGAL

Terms of Use

Last updated: October 12, 2026

Welcome to caas.sh. These Terms of Use (the “Terms”) are a binding agreement between you and coresourceai, Inc., a Delaware corporation (“coresourceai,” “we,” “us” or “our”), which operates caas.sh. They set out the rules for using our websites, products and services, described below (together, the “Services”). Please read them carefully.

By creating an account, using an API key, or otherwise accessing or using the Services, you agree to these Terms. If you use the Services for a company or other organization, you agree to these Terms on its behalf and confirm that you have the authority to do so; “you” then means that organization as well as you. If you don’t agree to these Terms, don’t use the Services.

Will these Terms ever change?

Yes. The Services and the law change, and these Terms will change with them. When we update these Terms, we will post the new version at caas.sh/terms and change the date at the top of this page. If a change is material, we will also tell you before it takes effect, by email or in the console. If you keep using the Services after a change takes effect, you accept the updated Terms. If you don’t accept them, stop using the Services and close your account.

What about my privacy?

Our Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. Please read it alongside these Terms.

What are the Services?

caas.sh runs software for you in isolated cloud environments. The Services include:

  • Sandboxes: isolated, persistent virtual machines that deploy like containers, for coding agents and other workloads, with snapshots and backups of workspace files.
  • MCP server hosting: running Model Context Protocol servers from a command, a Git repository or a container image, behind an authenticated endpoint (the MCP Gateway).
  • Workflows: multistep runs in which each step runs in its own sandbox, with checkpoints between steps.
  • The console, CLI and API: the web console at console.caas.sh, the caas command-line interface, and the API at api.caas.sh.
  • The container registry: storage for your container images at registry.caas.sh.
  • Our websites, including caas.sh, and the documentation and support we provide.

We are always improving the Services, so we may add, change or remove features at any time. Features we label as previews may change or be withdrawn and may be less reliable than the rest of the Services. If we remove a feature you pay for, we will tell you in advance where we reasonably can.

Who can use the Services, and how do accounts work?

You must be at least 18 years old, or the age of majority where you live if that is older, to use the Services. You may not use the Services if the law, including U.S. export control and sanctions law, prohibits you from receiving them.

You need an account to use most of the Services. You can sign up with an email address and a password, or sign in with Google or GitHub. Give us accurate information and keep it up to date.

You are responsible for everything that happens under your account and its API keys. Keep your password and API keys secret, give each key only the access it needs, and revoke any key you think has been exposed. Tell us right away at legal@coresource.ai if you believe someone has used your account without permission.

Your sandboxes, servers, runs, images and balance belong to a workspace. A workspace’s owner can invite other people as members and choose their roles. The workspace owner, or the organization the owner acts for, is responsible for the workspace, for how its members use it, and for the charges it incurs. Each member must also accept these Terms.

Do the Services cost anything?

Yes. Each workspace pays for the Services in advance, from a prepaid balance.

  • Prepaid balance. You add funds to a workspace’s balance with a card, and a workspace needs a card on file and a positive balance to run workloads. As the workspace uses the Services, we draw down its balance at the rates published at caas.sh/pricing (the “Rates”) for each metered unit, such as active vCPU time, memory, disk, egress, storage, MCP Gateway requests, workflow steps and registry pulls.
  • Auto-recharge. You can turn on auto-recharge, which charges your saved card to bring the balance back up to an amount you choose whenever it falls below a threshold you choose. It is off until you turn it on, and you can turn it off at any time. While it is on, you authorize us to charge your card for each recharge, and to retry a charge that is declined.
  • Payment processing. Payments are processed by Stripe. Your card details go to Stripe, not to us, and Stripe’s terms and privacy policy apply to them. We don’t store full card numbers.
  • When the balance runs out. When a workspace’s balance reaches zero, its work stops: its running sandboxes are stopped, with their state saved, and new work is refused until you add funds. Usage recorded around the stop is still charged and can take the balance below zero; you agree to pay any negative balance.
  • Taxes. The Rates don’t include taxes. You are responsible for any sales, use, value-added or similar taxes on your purchases, other than taxes on our income. Where we must collect a tax, we will add it to your charges.
  • Refunds. Prepaid balances are non-refundable and can’t be exchanged for cash, except where the law requires otherwise.
  • Price changes. We may change the Rates. We will post new Rates at caas.sh/pricing and tell you by email or in the console before they apply to you. Usage before a change is charged at the Rates in effect when it happened.

Who owns what I put into the Services?

You do. “Your Content” means the code, files, images, data and other material that you or your workspace’s members put into the Services, including into sandboxes, snapshots, MCP servers, workflows and the container registry, and the output your workloads produce. As between you and coresourceai, you keep all of your rights in Your Content.

You grant coresourceai a worldwide, non-exclusive, royalty-free license to host, store, copy, transmit and process Your Content only as needed to operate, secure and support the Services for you and to comply with the law. This license ends when Your Content is deleted from the Services, except for any copy we must keep by law. We don’t use Your Content to train machine learning models.

You are responsible for Your Content. You must have the rights you need to put it into the Services, and it, and your use of it, must comply with these Terms and the law. You are also responsible for the credentials, secrets and API keys you connect to the Services, such as a GitHub token or a key for a model provider, and for the requests your sandboxes, servers and workflows make with them. We store connected credentials encrypted and use them only to make the requests you configure.

Are there restrictions in how I can use the Services?

Yes. You may use the Services only lawfully and as these Terms allow. You won’t, and won’t let anyone else, including your workspace’s members and your workloads:

  • store, run or share anything illegal, including content that exploits or endangers children;
  • create, host or distribute malware, ransomware, spyware or other malicious code;
  • attack, probe, scan or disrupt any system or network, including through denial-of-service attacks, unauthorized access or phishing;
  • mine cryptocurrency, or run proof-of-work or similar blockchain workloads;
  • send spam or other unsolicited bulk messages;
  • get around or interfere with any limit, quota, rate limit, meter, billing control, egress control or other security measure of the Services, or try to reach another customer’s sandboxes or data;
  • resell or sublicense the Services, or offer them to others as a hosting service, without our written agreement;
  • infringe or misappropriate anyone’s intellectual property, privacy or other rights;
  • use the Services where a failure could lead to death, personal injury, or severe physical or environmental damage, such as operating nuclear facilities, aircraft navigation, life-support systems or weapons; or
  • copy, reverse engineer or decompile the Services, except where the law allows it despite this restriction.

When your sandboxes, servers or workflows reach other services, including through credentials you connect or through the Model Gateway, you must follow those services’ terms and policies. We may investigate suspected violations, and we may remove content or suspend activity as described below.

What about third-party services?

The Services work with services we don’t control: GitHub and Google, when you sign in with them or connect them; Stripe, for payments; and model providers and other services that your sandboxes, servers and workflows reach. Your use of a third-party service is governed by its own terms and privacy policy. We aren’t responsible for third-party services, for their availability, or for what they do with the data you send them.

What are my rights in the Services?

The Services, including our software, websites, documentation, designs and logos and the caas.sh name, belong to coresourceai and its licensors and are protected by intellectual property laws. While you follow these Terms, we give you a limited, non-exclusive, non-transferable and revocable right to use the Services. The caas CLI is also released under the Apache License 2.0, which governs its source code. We reserve all rights that these Terms don’t expressly grant.

If you send us ideas, suggestions or other feedback about the Services, we may use them for any purpose without restriction or payment to you.

Can my access be suspended or ended?

You may stop using the Services at any time. To close your account, write to us at legal@coresource.ai.

We may suspend or end your access to all or part of the Services, such as a sandbox, a workspace or an account:

  • if a workspace’s balance is used up, or a payment fails or is reversed;
  • if you breach these Terms, including the restrictions above;
  • if your use poses a security risk, could harm the Services, other customers or anyone else, or could expose us to liability; or
  • if the law or a government authority requires it.

Where we reasonably can, we will tell you first and give you a chance to fix the problem, but we may act at once when that is needed to prevent harm. When your account ends, your right to use the Services ends, and we delete Your Content and your account’s data, except what we must keep by law and records we keep for billing, tax and security. Export anything you want to keep before your account ends. Sections of these Terms that by their nature should survive, such as those on fees owed, ownership, disclaimers, limitation of liability, indemnity and governing law, survive the end of your account.