Effective 20 September 2026
This licence governs the Soreg gateway software that you install and run on your own infrastructure. It sits underneath the Terms of Service, which govern your account and subscription. Where the two conflict, the Terms of Service win.
“Soreg”, “we” and “us” means SOREG LTD, a Delaware corporation. “You” means the organisation that subscribed.
You accept this licence by downloading, installing, copying or running the Software, or by clicking to accept it. If you are accepting on behalf of an organisation, you confirm you have authority to bind it. If you do not accept, do not install the Software, and delete any copy you have.
Software means the Soreg gateway in object or source form as we supply it, including container images, installation scripts, configuration templates, database schemas, compliance mappings and updates.
Documentation means the administrator guide, end user guide, and troubleshooting material we supply with the Software.
Instance means one running deployment of the Software with its own database.
Deployment Scope means the number of Instances, environments, users or other units of measure stated in your order or subscription confirmation. If your order is silent, the Deployment Scope is one production Instance.
Licence Key means a credential we issue that identifies your subscription to an Instance.
For as long as your subscription is active and you are not in material breach, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable licence, within the Deployment Scope, to:
Your staff and your contractors may use the Software on your behalf, provided their use is for your benefit, complies with this licence, and you remain responsible for it.
Security testing is expressly permitted. You may perform penetration tests, vulnerability scans, code review and adversarial testing against your own Instances on your own infrastructure, without asking us first. Nothing in section 6 prohibits it. We would be glad to receive what you find at security@soreg.ai, and we will not pursue anyone for good-faith security research conducted against their own deployment. This permission does not extend to the soreg.ai website or to our own systems.
4.1 Where the Software requires a Licence Key, we issue one when your subscription starts and reissue it on renewal. Keys are confidential and are issued to you alone. Do not share or publish them.
4.2 A Licence Key may encode your Deployment Scope and an expiry date, and the Software may record which Instances a key has been used on.
4.3 A licence check will never take your gateway down. If the Software cannot validate a Licence Key — because a key has expired, because a licensing endpoint is unreachable, because of a network failure at either end, or for any other reason — the gateway will continue to enforce masking, role checks and audit logging, and will continue to serve queries. It may warn administrators, degrade non-essential functions, or refuse to accept new configuration, but it will not stop protecting data and it will not stop working.
This is a commitment we make to you in this agreement, not merely a description of current behaviour. Soreg is a control in your compliance path. Our billing arrangements are not a reason for it to fail, and we will not build it so that they can be.
4.4 If your subscription ends, we may decline to issue a new key. That is a commercial consequence, not a technical kill switch, and section 9 explains what you must then do.
The Software is designed to run without reporting anything back to us. It contains no analytics, no usage telemetry and no diagnostic beacon. In normal operation the only outbound network connection it makes is to the model provider endpoint that you configure, using the credentials that you supply.
If we ever add a component that transmits anything to us, we will say so in the release notes before it ships, explain what it sends, and make it something you can switch off. We will not turn one on quietly in an update.
This means we cannot see your queries, your data, your configuration or your logs. It also means we cannot diagnose a problem for you unless you tell us about it, which is why the Documentation explains what to collect — and why the Terms of Service ask you to redact before you send it.
Except where the law gives you a right that cannot be excluded by contract, you may not:
You may publish factual performance or security findings about your own deployment. We do not require our consent for that, and we do not prohibit benchmarking.
The Software includes third-party open-source components, each licensed under its own terms. Those terms govern those components, and to the extent an open-source licence grants you rights broader than this agreement, the open-source licence prevails for that component.
As at the date above, the Software's direct dependencies include the FastAPI web framework,
the Uvicorn server, Pydantic, python-multipart and ReportLab, together with the model
provider SDK where you choose to install one. The authoritative and current list, with the
full text of each licence and the attributions those licences require, is distributed with
each release in the NOTICE file.
We do not charge you for the open-source components, and we do not warrant them beyond what section 12 says about the Software as a whole.
While your subscription is active we make updates available to you, and your licence covers them. We do not install them for you — the Software is in your environment and updating it is your decision and your operation.
You should keep reasonably current. We support the current major version and the one before it. We will give at least 90 days' notice before ending support for a version, and we will always tell you when an update carries a security fix, so you can decide how urgently to take it.
An update may change behaviour. Where a change would alter how data is classified, masked or re-identified, we will call it out in the release notes rather than leave you to find it. Test updates in a non-production Instance first; section 3 lets you run one at no extra cost, and this is what it is for.
Support is provided at the level stated in your order.
This licence runs for as long as your subscription does. It ends when the subscription ends, or immediately if you materially breach it and do not cure the breach within 30 days of our written notice.
When it ends, you must stop using the Software and, within 30 days, uninstall it and delete or destroy all copies, including container images and backups, other than copies you are required by law or by your own retention obligations to keep. An officer of your organisation should confirm to us in writing that you have done so, if we ask.
What you keep. Your data is in your database, your audit log is in your environment, and any evidence pack you generated is a file you already hold. None of it belongs to us and none of it goes away when this licence does. What ends is your right to keep running our Software. Before you uninstall, export anything you still need — the Documentation explains how, and we will help.
If we have a reasonable, specific concern that use exceeds the Deployment Scope, we may ask you in writing to confirm your Instance count and configuration. You will respond within 30 days. We may not audit your systems, we may not require access to your environment, and we may not require you to disclose your data or configuration. A written statement from an authorised person is enough.
If it shows underpayment, you pay the difference for the period concerned. We will not exercise this more than once in any twelve months.
We and our licensors own the Software, the Documentation and the compliance mappings, and all intellectual property in them. This is a licence, not a sale. Rights not expressly granted are reserved.
You own your data, your database, your audit log, your configuration and anything the Software produces from them. We claim nothing in it.
We warrant that we have the right to grant this licence, and that for 30 days after you first receive a release, it will perform materially as the Documentation describes. If it does not, tell us, and we will correct it, replace it, or refund the fees for the affected period — your choice of the three, and your sole remedy for breach of this warranty.
Otherwise, and to the fullest extent the law allows, the Software and Documentation are provided “as is”, and we disclaim all other warranties, express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.
We do not warrant that the Software is error-free, that it will detect every item of sensitive data, or that its use makes you compliant with any law or framework. Section 9 of the Terms of Service sets that out in full and applies equally here.
The limitation of liability in section 14 of the Terms of Service applies to this licence, and the two are subject to one combined cap rather than two separate ones. Nothing in this agreement increases that cap.
The Software is subject to US export laws. You confirm you are not located in, and not acting for anyone located in, a country subject to a US embargo, and that you are not on a US government restricted party list. You will not export or re-export the Software in breach of those laws.
The Software is “commercial computer software” under FAR 12.212 and DFARS 227.7202. US government licensees receive only the rights granted here.
This licence is governed by Delaware law and subject to the courts and dispute process in section 18 of the Terms of Service. The notice, assignment, force majeure, severability, waiver and entire agreement provisions in section 19 of the Terms of Service apply here too.
Sections 6, 9, 11, 12, 13 and 14 survive termination.