Terms of Service — Vaporkernel

1. Service Description

Vaporkernel ("the Platform", "we", "us") is a decentralized compute platform that connects hardware providers ("Providers") with users who deploy virtual machine instances ("Customers"). The Platform orchestrates compute resources across a global mesh of Provider hardware, enabling Customers to deploy, manage, and access full Linux virtual machines.

The Platform consists of:

Orchestrator: A centralized control plane that handles scheduling, health monitoring, billing, and Provider/Customer management.
Provider Daemon: Software installed on Provider hardware that manages VM lifecycle, snapshots, and replication.
Edge Ingress: Network endpoints that route Customer traffic to active instances via encrypted WireGuard tunnels.
REST API and CLI: Interfaces for Customers and Providers to interact with the Platform.

2. Account and Authentication

Access to the Platform requires an API key. API keys are 256-bit random values with a vk_ prefix and are SHA-256 hashed server-side. The plaintext key is shown only once at creation time. You are responsible for safeguarding your API key and all activity conducted under it.

You must not share, publish, or embed your API key in client-side code, public repositories, or any publicly accessible location. If you suspect your key has been compromised, contact us immediately. We may revoke keys at any time if we detect suspicious activity.

3. Customer Obligations

As a Customer, you agree to:

Use the Platform only for lawful purposes and in compliance with all applicable laws and regulations.
Not use instances for cryptocurrency mining, distributed denial-of-service attacks, spam distribution, hosting illegal content, or any activity that violates the laws of your jurisdiction.
Not attempt to exploit, probe, or attack Provider hardware, the orchestrator, or other Customers' instances.
Not attempt to circumvent resource limits, billing, rate limiting, or authentication mechanisms.
Maintain responsibility for all software, data, and activity within your instances.
Keep your SSH keys and API credentials secure.

4. Provider Obligations

As a Provider, you agree to:

Provide accurate hardware specifications during registration. Resource verification challenges will validate declared capabilities.
Maintain reasonable uptime and connectivity. Your reputation score (0-100) is calculated from uptime (40%), performance (30%), behavior (20%), and tenure (10%).
Not attempt to access, inspect, modify, or exfiltrate Customer VM data, memory, network traffic, or SSH keys. The Platform employs defense-in-depth technical controls to protect Customer data (see Section 6), and Providers are contractually prohibited from circumventing these controls.
Not tamper with the Provider daemon, snapshot encryption, or replication mechanisms.
Accept that your hardware identity (Ed25519 public key and hardware fingerprint) is registered on the Platform. One registration per hardware fingerprint is enforced.
Notify us before planned maintenance or extended downtime. Use the graceful shutdown mechanism when possible to avoid reputation penalties.

5. Billing and Payment

5.1 Customer Billing

Instances are billed on a monthly basis, prorated to the hour. Pricing tiers (Standard):

Nano: $3/mo (1 vCPU, 1 GB RAM, 20 GB disk)
Micro: $8/mo (1 vCPU, 4 GB RAM, 40 GB disk)
Small: $18/mo (2 vCPU, 8 GB RAM, 80 GB disk)
Medium: $40/mo (4 vCPU, 16 GB RAM, 160 GB disk)

Replicated tier (N+1 hot standby with block-level replication) is available at approximately 1.6x Standard pricing. Billing begins when an instance enters the "booting" state and ends when the instance is terminated. Billing is reconciled on each Provider heartbeat.

5.2 Provider Earnings

Providers receive 80% of the Customer charge for each instance hosted on their hardware. The Platform retains 20%. Effective earnings are adjusted by a reputation tier multiplier:

Gold (score 80-100): 100% of base earnings
Silver (score 50-79): 90% of base earnings
Bronze (score 20-49): 75% of base earnings
Probation (score 0-19): 0% of base earnings

Earnings are tracked per instance and visible via the Provider dashboard and earnings API endpoints. Payout schedules and methods will be announced before the production launch.

6. Security Model

The Platform employs defense-in-depth technical controls to protect Customer data on Provider hardware. Providers are contractually prohibited from accessing Customer data, and the following technical measures raise the bar against unauthorized access:

VM isolation: Guest workloads run inside KVM (Linux) or HVF (macOS) micro-VMs with CPU-level process isolation. Note: guest memory is mapped into the daemon process for VM operation. A Provider with root access could read guest memory. Hardware memory encryption (AMD SEV-SNP, Intel TDX) for full isolation is planned.
Encrypted snapshots: All snapshots are encrypted with AES-256-GCM using HKDF-derived keys unique to each instance. Note: encryption keys are derived from a seed stored on the Provider host. True hostile-host snapshot protection requires orchestrator-side key escrow or hardware TEE, which are planned.
Encrypted networking: All data-plane traffic uses WireGuard point-to-point tunnels. All control-plane traffic uses TLS 1.3 (rustls). Note: WireGuard private keys are held in daemon process memory on the Provider host.
SSH key injection: Customer SSH keys are injected via a secrets page at a dedicated guest physical address.
Cryptographic authentication: Providers authenticate via Ed25519 challenge-response. API keys are SHA-256 hashed server-side. Auth nonces expire after 30 seconds.

No security system is absolute. The current technical controls provide defense-in-depth but do not guarantee that a Provider with root or physical access to their hardware cannot access Customer data. Hardware-enforced isolation via Trusted Execution Environments (AMD SEV-SNP, Intel TDX) is on the roadmap. Customers should evaluate whether the Platform's current security model meets their requirements for sensitive workloads. See our Security Model documentation for full details.

7. Data Handling

Customer data inside VMs is the sole responsibility of the Customer. We do not access, inspect, back up, or retain Customer VM contents. When an instance is terminated, the associated VM memory and data are destroyed.

Snapshots are encrypted and distributed to 2-3 storage nodes for durability. Snapshot data is encrypted with instance-specific keys derived via HKDF-SHA256. We do not hold the decryption keys for Customer snapshots in cleartext.

Platform operational data (instance metadata, billing records, Provider reputation scores, API key hashes) is stored in SQLite databases with WAL mode on the orchestrator. See our Privacy Policy for details on data collection.

8. Service Availability

We strive for high availability but do not guarantee uninterrupted service. The Platform includes:

Standard tier: Periodic snapshot recovery. If a Provider goes offline, instances are restored on an alternate Provider from the most recent snapshot.
Replicated tier: N+1 hot standby with block-level replication. Primary failure triggers near-instant failover to the standby node.
Orchestrator HA: Active-passive failover with epoch-based split-brain fencing. Running instances survive orchestrator downtime.

Recovery times depend on snapshot age (Standard tier) or replication lag (Replicated tier). We do not guarantee specific recovery time objectives (RTOs) or recovery point objectives (RPOs) during the beta period.

9. Limitation of Liability

To the maximum extent permitted by law, Vaporkernel and its operators shall not be liable for:

Loss of data, revenue, or business arising from service interruptions, Provider failures, or instance termination.
Unauthorized access to Customer VMs resulting from Provider compromise, software vulnerabilities, or side-channel attacks.
Actions taken by Providers that violate these terms, including unauthorized data access.
Network outages, NAT traversal failures, or degraded connectivity between Customer and instance.

The Platform is provided "as is" and "as available" without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement.

Our total liability for any claim arising from use of the Platform shall not exceed the amount paid by you to us in the 12 months preceding the claim.

10. Termination

We may suspend or terminate your access to the Platform at any time if:

You violate these Terms of Service.
Your usage poses a security risk to the Platform, other Customers, or Providers.
You fail to pay outstanding charges.
We are required to do so by law.

You may terminate your account at any time by terminating all running instances and contacting us. Provider deregistration requires graceful shutdown of all hosted instances.

Upon termination, all running instances will be stopped and billing will cease. Snapshot data may be retained for up to 30 days before deletion.

11. Intellectual Property

The Vaporkernel Platform, including its software, documentation, APIs, and branding, is the intellectual property of Vaporkernel. You may not reverse-engineer, decompile, or create derivative works of the Platform software, except as permitted by applicable law.

You retain all rights to your own data and software running inside your instances.

12. Modifications

We may update these Terms at any time. Material changes will be communicated via the Platform dashboard or email at least 14 days before taking effect. Continued use of the Platform after changes take effect constitutes acceptance of the updated Terms.

13. Dispute Resolution

Any disputes arising from these Terms or use of the Platform shall be resolved through good-faith negotiation. If negotiation fails, disputes shall be submitted to binding arbitration under the rules of the jurisdiction in which Vaporkernel is incorporated. You agree to waive any right to participate in class-action lawsuits or class-wide arbitration.

14. Contact

For questions about these Terms, contact us at: