Software License Terms

• “Customer Data”: all data that Customer or its Users connect to, load into or create in the Software, including the content indexed from the systems Customer connects (code, tickets, messages, documents, meeting text) and everything the Software derives from it on the Deployment (the graph, embeddings, answers, usage records, crash reports).
• “Deployment”: one installation of the Software, with its own database, in Customer’s own cloud account (AWS, Azure or GCP), set up with Mithrandir’s Terraform, or other infrastructure Customer controls, serving the license tenant named in the License File.
• “Documentation”: the operator documentation Mithrandir makes available with the Software, including the deployment runbook that the Software prints with mithrandir print-runbook.
• “License File”: the signed file Mithrandir issues for the Deployment. It names Customer, the license tenant, the number of Seats, the last day of the period it covers and a grace period of 7 days. The Software checks it on the Deployment, offline.
• “Order”: for a Subscription bought online, the details of the purchase as shown at Stripe checkout and in Customer’s Stripe receipts and billing portal (plan, billing period, number of Seats and price), as changed in the billing portal. For an enterprise customer, a signed Order Form.
• “Seat”: one named person’s active user account on the Deployment. A Seat belongs to a person, not to a device or a tool: that person may connect any number of their own AI agents and tools through it, and none of them is a Seat. A deactivated account does not use a Seat.
• “Software”: Mithrandir’s software in object-code form, delivered as container images, with the deployment kit (compose file, installer and upgrade scripts), the Documentation, and the updates and new releases Mithrandir makes generally available during the Subscription Term. It does not include the third-party components and services in section 6.
• “Subscription Term”: for a Subscription bought online, the billing period (monthly or annual) in the Order. For an Order Form, the period it states (12 months from the start date if none is stated). In both cases it includes each automatic renewal under section 4.2.
• “Telemetry”: the documents described in section 9.
• “Users”: Customer’s employees and individual contractors who hold a Seat.

2.1 Subject to these License Terms and to payment of the fees, Mithrandir grants Customer a non-exclusive, non-transferable, non-sublicensable license, during the Subscription Term, to install and run the Software on one Deployment (or the number of Deployments in a signed Order Form), for use by up to the number of Seats in the Order, for Customer’s internal business purposes. The license covers the right to reproduce the Software (in Türkiye, Law No. 5846 on Intellectual and Artistic Works (FSEK) art. 22) only as far as installing, running and backing up the Software on those Deployments requires, and no other right of use or exploitation.

2.2 Customer may keep backup copies of the Software and move a Deployment to new infrastructure (for example after a hardware failure), as long as only one installation serves per licensed Deployment at any time.

2.3 Customer may have its own IT service providers operate the Deployment on Customer’s behalf, under confidentiality duties at least as protective as section 14. Customer is responsible for its Users and those providers complying with these License Terms.

2.4 Mithrandir reserves every right not expressly granted.

Customer will not, and will not allow anyone else to:

1. copy, share, publish or disclose the License File outside Customer and the providers section 2.3 allows, or install it on any installation other than the licensed Deployment. The License File is tied to a license tenant, not to a machine, so the Software cannot tell one installation from another: keeping the file to the licensed Deployment is Customer’s obligation under these License Terms;
2. modify, bypass or disable the license check, including by altering the Software, the License File or the records the Software keeps about the license, or by setting the system clock to extend the term;
3. let more than one person use a Seat, or run more Deployments or Seats than the Order allows;
4. reverse engineer, decompile or disassemble the Software, or try to derive its source code, except to the extent applicable law permits this despite a contractual restriction;
5. sell, resell, rent, lease, lend or sublicense the Software, or provide it or access to it to third parties, including as a hosted, managed or service-bureau offering;
6. use the Software, the Documentation or Mithrandir’s Confidential Information to build a competing product or service;
7. copy the Software, except as strictly needed to install and run it on the licensed Deployment and to make reasonable backup copies kept under the same restrictions; or
8. remove or alter any proprietary or license notice in the Software.

A breach of (a) or (b) is a material breach. Use beyond the Order (more Deployments or Seats) is billable at the Order’s prices for the period of that use, in addition to Mithrandir’s other rights.

Annual confirmation. Because the Software does not report its use to Mithrandir, once a year, and on Mithrandir’s reasonable written request no more than once a year, Customer sends Mithrandir the output of mithrandir license-status from each Deployment and confirms in writing the number of Deployments it runs.

The Acceptable Use Policy also applies.

4.1 Offline check. The Software checks the License File on the Deployment, offline. It does not contact Mithrandir to check the license, and there is no remote kill switch.

4.2 Renewal. Every Subscription Term, whether bought online or under an Order Form, renews automatically for another term of the same length, until Customer cancels it (section 15.3). Mithrandir may decline to renew a subscription by giving the customer at least 30 days’ notice before the end of the current paid period. License renewal follows payment: when the fees for the new term are paid, Mithrandir issues a new License File ending at the end of that term. Customer either installs the copy Mithrandir emails, or turns on automatic renewal of the License File (section 4.6). Customer’s operator replaces the old file on the Deployment, and the Software picks it up within about a minute, with no restart.

4.3 Warnings. From 14 days before the end date, and throughout the grace period, every page of the Software’s web interface shows a one-line notice (more prominent from 7 days and from 1 day before), and the mithrandir license-status command shows the days left.

4.4 Grace period. For 7 days after the end date the Software keeps serving, with a warning. The license in section 2 continues during those 7 days, solely so that a renewal can be completed without interruption.

4.5 After the grace period the Software stops serving: nobody can sign in, ask questions, use the agent (MCP) tools or sync sources, and no product command that reads, adds to or changes access to Customer Data will run. Customer Data stays on Customer’s infrastructure, where it always was, and nothing is deleted because the license ended. The commands whose only effect is to delete Customer Data or enforce its retention periods keep working without a License File in force: erasing specific content (tombstone), the retention sweep (retention-sweep), purging crash reports (crash-reports purge), anonymising candidates (candidate-retention --confirm) and the full-deletion procedure in section 15.4 (offboard-tenant), so that the end of a subscription never blocks deleting Customer Data or enforcing its retention periods. Other commands, including placing or releasing a legal hold and revoking access, need a License File in force. Installing a renewed License File restores service.

4.6 Automatic renewal (opt-in). If Customer’s operator turns it on (LICENSE_AUTO_REFRESH=true), the Software sends the License File currently in force, and nothing else, to Mithrandir over HTTPS about every 6 hours, to fetch the next License File of a Subscription bought online. The request carries no usage, no Customer Data and no seat count. A License File fetched this way is checked offline exactly like one the operator installs. This is not a license check and not a kill switch: it can only add a newer License File, and the License File already installed lapses on its own date either way. It is off by default. With it off, Customer installs each License File by hand.

4.7 Downloads. The Software is downloaded from Mithrandir’s image registry by signing in with the License File. Downloads are available while a License File is in force, including its grace period. A download shows Mithrandir the downloading host’s IP address and the credential used, and nothing from the Deployment.

5.1 The number of Seats in the Order is a hard limit from the first day: the Software refuses to create or reactivate an account beyond it. There is no overage allowance.

5.2 Deactivating a person’s account frees their Seat at once, and the Seat can then be given to another person.

5.3 Changing Seats online. For a Subscription bought online, Customer changes the number of Seats in the Stripe billing portal (Terms of Service, section 9). Mithrandir then issues a replacement License File with the new number of Seats and the same end date.

5.4 Changing Seats under an Order Form. Customer asks in writing (email is enough). Mithrandir issues a replacement License File with the new number of Seats and the same end date, so all Seats renew together. Fees for added Seats are the Order Form’s per-Seat price, prorated by the days remaining to the end date, and are invoiced when the replacement file is issued. Under an Order Form, Seats can be reduced only at renewal, and fees are not reduced mid-term.

5.5 Above the limit. If a License File carries fewer Seats than the Deployment has active accounts (for example after a renewal or a change with fewer Seats), the Software shows a warning for 7 days. After that, only seat management (signing in and deactivating accounts) and the commands in section 4.5 work until the number of active accounts is at or under the limit, or a License File with more Seats is installed; full service then resumes on its own.

6.1 Open-source components. The Software includes open-source and other third-party components, each under its own license, listed in the THIRD_PARTY_LICENSES notice Mithrandir provides with the Software. Those licenses govern those components. Nothing in these License Terms limits Customer’s rights under them, and where an open-source license requires it, its terms prevail over these License Terms for that component.

6.2 Neo4j. The Software stores its data in Neo4j Community Edition, which runs as a separate, unmodified container from the official neo4j image on Docker Hub. Neo4j is licensed to Customer by its publisher under its own license (GPL-3.0), not by Mithrandir under these License Terms; the Software talks to it over Neo4j’s network protocol. By its own default, Neo4j sends usage data about the database (no Customer Data content) to its publisher. The shipped compose file turns that reporting off from v0.1.17; on an earlier release it is on unless Customer blocks it at its network egress.

6.3 Your own LLM provider. The Software sends model calls (fragments of Customer Data and Users’ questions) to the one LLM provider Customer configures, on Customer’s own account and API key, or to Amazon Bedrock in Customer’s own AWS account, under Customer’s own contract with that provider, or to a model server Customer runs itself, in which case no third-party provider is involved. The decision model the Software uses runs self-hosted in Customer’s own account. Mithrandir does not host Customer Data, does not sell its own API keys and does not supply LLM access under these License Terms and is not that provider’s customer or processor for this purpose. The Deployment runs with the evaluation (“mirror”) calls switched off, so the Software makes no shadow calls on Customer’s keys.

6.4 The same applies to the source systems Customer connects (for example GitHub, Jira, Linear, Google Workspace, Slack) and to the AI clients Users connect to the Software’s agent (MCP) tools: a tool result goes to that client and from there to the client’s own model vendor, under Customer’s terms with that vendor. Customer pays these providers and complies with their terms.

7.1 Ownership. Customer owns Customer Data. Mithrandir obtains no right in it except the limited rights these License Terms give.

7.2 Where it lives. The Software runs in Customer’s own cloud account (AWS, Azure or GCP), set up with Mithrandir’s Terraform, or on other infrastructure Customer controls, and Customer Data is stored and processed there: in the Neo4j database, with connector credentials encrypted at rest. Customer controls that infrastructure, its access, its network and its backups, and is responsible for securing them and for the settings it chooses.

7.3 No access by Mithrandir. Mithrandir has no access to the Deployment or to Customer Data, and does not take remote access to Customer’s hosts. Support is given by email or chat, by screen-share, or through commands Customer’s operator runs (section 11). If Customer shows or sends Customer Data to Mithrandir during support, Mithrandir uses it only to give that support, keeps it confidential, and deletes any copy it holds when the support case closes and in any event under section 15.4(c).

7.4 Nothing is sent to Mithrandir automatically, except the Telemetry Customer opts into (section 9) and, if Customer turns it on, the License File sent for automatic renewal (section 4.6).

7.5 Records kept on the Deployment. The Software keeps usage and error records on the Deployment: counts, timestamps, latencies and the account each event belongs to, never question or answer text (an error record can quote a path or a login). They are deleted after 365 days by the retention sweep, which Customer’s operator schedules (monthly is recommended; the Documentation gives the command). Crash reports recorded on the Deployment are deleted automatically after 30 days.

7.6 Erasure. Customer can erase specific content at any time with the Software’s erasure commands (Documentation). Revoking a person’s access when they leave removes their credentials and sessions and keeps their attribution (their name on their work, and the record of who did what); it is not erasure, and Customer decides, as controller, whether specific content should be erased. A legal hold placed on specific content pauses its erasure until the hold is lifted.

Customer is the controller of the personal data in Customer Data. Mithrandir processes Customer’s personal data only in Telemetry Customer opts into and in data Customer shows or sends it during support, and then as Customer’s processor, under the Data Processing Addendum. Each party complies with the data protection law that applies to it, including Turkish Law No. 6698 (KVKK) and, where it applies, the GDPR. Customer is responsible for having a lawful basis for the data it connects, and for giving any notice its Users and other people whose data appears in Customer Data are owed.

9.1 Telemetry is off unless Customer and Mithrandir agree in writing to turn on a tier (under a signed Order Form, when it records “Yes” for that tier). A Subscription bought online sends no Telemetry unless such an agreement is made.

1. Usage reports (tier 1). A weekly document of counters: per-tool call and error counts, latencies, request and response sizes, the Software’s own LLM token usage, configuration values and software version identifiers, the license id, and salted seat pseudonyms. A salted seat pseudonym is a keyed hash of an account id, not a name or a login, but it is still personal data. A usage report never contains Customer content, questions or answers.
2. Crash reports (tier 2). Sent only after Mithrandir issues crash inbox credentials. Each report is masked on the Deployment for secrets and personal-data patterns before it is sent, and the seat appears only as a salted pseudonym. Its text depends on the agreed content class: full (the masked error message, stack trace and question and, for a failed answer, the prompt assembled for it, which quotes masked excerpts of Customer Data the asking User was cleared to see), question (the masked question or tool arguments only; other text is reduced to hashes and code locations) or metadata (no free text at all).
3. Either tier sends pseudonymised personal data to GitHub in the United States. Customer turns a tier on only after it has met the requirements for that transfer that apply to it as controller (under KVKK art. 9, for example, standard contractual clauses notified to the Personal Data Protection Authority).

9.2 Switching off. Customer can stop either tier at any time on the Deployment (TELEMETRY_PUSH_ENABLED=false, TELEMETRY_CRASH_PUSH_ENABLED=false). The change takes effect once Customer’s operator restarts the services with the new setting, with no action needed from Mithrandir.

9.3 Where it goes and how long we keep it. Telemetry is held in private GitHub repositories Mithrandir operates for Customer’s Deployment alone, one per tier, each with its own access token. Mithrandir deletes usage reports older than 13 months and crash reports older than 90 days, and within 30 days after the Agreement ends deletes every Telemetry document from Customer’s Deployment by deleting both repositories, version history included. Mithrandir uses Telemetry only to support, secure and improve the Software and to apply any usage-tier discount, and never sells it. Subprocessor changes are notified as the Subprocessors page states.

10.1 Customer secures the Deployment and its infrastructure. Mithrandir secures its release process, its license-signing keys and the Telemetry it holds. Mithrandir does not monitor the Deployment and cannot see it, so detecting incidents on the Deployment is Customer’s task.

10.2 If Mithrandir confirms a security incident affecting Customer Data in its possession, or a vulnerability in the Software that puts Customer Data at risk, it notifies Customer without undue delay and at the latest within 72 hours of confirmation, with what it knows and the steps it recommends, so that Customer can meet its own notification deadlines.

10.3 Mithrandir’s incident contact is help@trymithrandir.com. Customer’s is the email address on its Subscription, or the one in its Order Form.

11.1 Mithrandir and its licensors own the Software, the Documentation, the License Files and all improvements, modifications and derivative works of them, whoever suggests them. No ownership passes to Customer.

11.2 Answers and other output the Software produces from Customer Data on the Deployment are Customer Data.

11.3 Feedback. If Customer or its Users give suggestions or feedback about the Software, Mithrandir may use them for any purpose, without payment or other obligation, and will not name Customer as their source in public without Customer’s consent.

11.4 Support. Mithrandir provides support by email at help@trymithrandir.com (or the channel in a signed Order Form), on a best-effort basis. A response target is a target, not a guarantee. There is no service level (uptime, resolution time or performance) unless a signed Order Form states one. Support is given by email or chat, by screen-share, or through commands Customer’s operator runs. Mithrandir does not take remote access to the Deployment.

11.5 Updates. During the Subscription Term Customer may download and install the updates and new releases Mithrandir makes generally available. The Software never updates itself: Customer’s operator decides when to upgrade. Mithrandir may ask Customer to upgrade to the latest release to reproduce or fix a problem.

12.1 Each party warrants that it has the authority to enter into these License Terms.

12.2 Mithrandir warrants that, for 30 days after it first makes the Software and the License File available to Customer, the Software will materially conform to the Documentation. Customer must report a non-conformity in writing within that period, with enough detail to reproduce it. Mithrandir will then fix it or provide a workaround within a reasonable time; if it cannot do so within 30 days of the report, Mithrandir refunds the fees paid for the non-conforming part, and the license for that part ends. This is Customer’s sole remedy for breach of this warranty. It does not cover problems caused by changes Customer makes, unsupported environments, the third-party components and services in section 6, or use not in line with the Documentation.

12.3 Customer warrants that it has the rights and authorisations needed to connect its systems to the Software and to have the Software process Customer Data, including any notices, consents and consultations the law requires for personal data.

12.4 Disclaimer. Except as this section 12 expressly states, and to the extent the law allows, the Software is provided “as is”, and Mithrandir disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation. The Software uses large language models: an answer can be incomplete or wrong even when it cites sources, and Customer is responsible for checking an answer before relying on it for a decision. Quality figures Mithrandir has published or quoted do not guarantee results on Customer Data.

13.1 Cap. Each party’s total liability arising out of or relating to the Agreement is limited to the fees paid and payable by Customer under it in the 12 months before the event giving rise to the claim.

13.2 Exclusions. Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, business, goodwill, anticipated savings or data, however caused.

13.3 Carve-outs. Sections 13.1 and 13.2 do not apply to (a) a breach of section 14 (confidentiality), (b) Customer’s obligation to pay the fees, (c) Customer’s breach of section 3 (restrictions), or (d) liability that cannot be limited or excluded by law, including liability for intent or gross negligence.

14.1 “Confidential Information” is non-public information a party discloses under the Agreement that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is Customer’s Confidential Information. The non-public parts of the Software, the Documentation, the License Files, pricing and security information are Mithrandir’s. Information that is or becomes public through no fault of the recipient, was already known to it, is independently developed, or is received lawfully from a third party is not Confidential Information.

14.2 The recipient uses Confidential Information only to perform the Agreement or exercise its rights under it, discloses it only to its employees, contractors and advisers who need it and are bound by duties at least as protective, and protects it with at least reasonable care. If the law requires disclosure, the recipient may disclose what is required, after telling the other party where the law allows.

14.3 This section survives for 5 years after the Agreement ends, and for Customer Data and trade secrets for as long as they remain confidential. A non-disclosure agreement the parties signed earlier continues to govern information exchanged before it.

15.1 Either party may terminate the Agreement by written notice if the other party materially breaches it and does not cure the breach within 30 days after written notice describing it.

15.2 Either party may terminate the Agreement by written notice, to the extent the law allows, if the other party becomes insolvent, enters bankruptcy or a similar proceeding, or stops doing business.

15.3 Customer may cancel at any time, online or under an Order Form, by notice in writing (for a Subscription bought online, in the billing portal or by email, Terms of Service, section 10). The cancellation takes effect at the end of the current paid Subscription Term, and there is no refund for the rest of that term. Neither party may otherwise end a paid Subscription Term early for convenience.

15.4 On termination, or when a Subscription Term ends without renewal:

1. the license in section 2 ends (on expiry, after the grace period in section 4.4) and Customer stops using the Software;
2. within 7 days (on expiry, 7 days after the grace period ends), Customer’s operator runs the full-deletion procedure (mithrandir offboard-tenant) for every tenant on the Deployment, destroys the backup copies of the Deployment’s database that the procedure lists and any others it holds (except backups the law requires Customer to keep, which stay protected and are destroyed when that duty ends), and removes the Software and the License File. The procedure refuses while a legal hold is in place, and releasing a hold needs a License File in force: if a hold blocks the deletion, Customer tells Mithrandir, Mithrandir issues a short-term License File for that purpose, and the 7 days run from its issue. Mithrandir gives guidance on request. The procedure works without a License File in force. It deletes the Software’s copy of Customer Data (the graph, the encrypted connector credentials, the working clones of repositories); it does not touch the source systems Customer connected, which remain Customer’s. What remains on Customer’s infrastructure is an anonymised usage aggregate (counts and timestamps, with identity and free-text fields removed), a marker that stops the tenant from being re-ingested, and the Software’s license bookkeeping. If the procedure reports a step it could not finish, the operator re-runs it until it completes. Customer confirms completion to Mithrandir in writing within the same 7 days, with the procedure’s recorded output;
3. Mithrandir deletes Telemetry as section 9.3 states, and any Customer Data it received during support within 30 days. Each party returns or destroys the other’s Confidential Information on request, except copies the law requires it to keep, which stay confidential; and
4. fees paid are non-refundable, except under section 12.2 and, where Customer terminates under section 15.1 for Mithrandir’s breach, Mithrandir refunds the prepaid fees for the rest of the Subscription Term, pro rata. Fees for the period up to termination remain payable.

15.5 Late payment under an Order Form. Invoiced amounts that are overdue bear default interest from the due date at the statutory default interest rate for commercial transactions (in Türkiye, Law No. 3095 art. 2/2). If an invoice remains unpaid after its due date and a written reminder, Mithrandir may decline to issue a renewal License File, or one for added Seats, until it is paid. Non-payment continuing 30 days after that reminder is a material breach. A License File already issued stays in force until its end date and grace period; that does not extend the license in section 2 after termination.

15.6 Sections 3, 7, 8, 9.3, 11.1 to 11.3, 12.4, 13, 14, 15.4 and 16, and the payment obligations for amounts due, survive the end of the Agreement.

16.1 These License Terms are governed by the laws of the State of Delaware, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

16.2 Before starting arbitration, the parties try in good faith for 30 days to settle the dispute between their founders or executives.

16.3 Any dispute arising out of or relating to these License Terms is finally resolved by arbitration administered by the Istanbul Arbitration Centre (ISTAC) under its Arbitration Rules. The seat of arbitration is Istanbul, the language is English, and there is one arbitrator. Judgment on the award may be entered in any court of competent jurisdiction.

16.4 Either party may seek interim or injunctive relief from any competent court, without waiving arbitration.

Notices, assignment, force majeure, publicity, changes and the other general terms are in the Terms of Service (sections 18 to 20) and apply to these License Terms.