Terms of Service

VaultMail is an encrypted email and file sharing service operated by Spriggan AI, Inc. (“Spriggan AI”, “we”, “us”). By creating an account, installing the VaultMail browser extension, or otherwise using the service (the “Service”), you agree to these Terms of Service. If you use the Service on behalf of an organization, you represent that you have authority to bind that organization, and “you” refers to it.

VaultMail encrypts messages and files with AES-256-GCM using a unique per-object data-encryption key, stores only the encrypted content, and delivers it to recipients through secure links with server-side access control, expiration, revocation, and audit logging. Encryption and key management are performed by VaultMail’s servers on HIPAA-eligible infrastructure under a signed Google Cloud BAA; VaultMail is not a zero-knowledge service. The Service includes the VaultMail web application, the browser extension for Gmail and Outlook, and associated APIs.

VaultMail is not an email provider. Your email itself is transmitted by your email service (e.g., Gmail or Outlook), whose own terms and security practices apply and are outside our control.

Encryption in VaultMail is controlled by you. You are responsible for choosing when to apply it, and your most recent Auto-encrypt on/off choice persists across messages until you change it. In particular:

• Auto-encrypt toggle. The extension lets you turn encryption off for a message. Mail sent with encryption off is ordinary, unencrypted email delivered by your email provider — it never reaches VaultMail, is not protected by the Service, and is not covered by any Business Associate Agreement with us.
• Attachments-only mode. When you choose to encrypt only attachments, your written message (including any images pasted into it) is sent as normal, readable email. Only the attached files are encrypted and protected.
• Subject lines are never encrypted. Subjects are standard email metadata handled by your email provider and are never received by VaultMail. Do not put Protected Health Information (PHI) or other sensitive information in subject lines. (Recipient email addresses, by contrast, are submitted to VaultMail for access control and audit logging.)

We surface these limits in the product, but the decision of what to encrypt is yours, and we are not responsible for content you choose to send outside the Service’s encryption.

If you are a covered entity or business associate under HIPAA, you must have an executed Business Associate Agreement (“BAA”) with Spriggan AI before transmitting PHI through the Service. Transmitting PHI without an executed BAA violates these terms. Our BAA is available at vaultmailapp.com/baa; self-serve signing is available on eligible plans. The BAA applies only to PHI actually submitted to the Service for encryption — see Section 3 for what falls outside it.

You must provide accurate account information and keep your authentication credentials secure. You are responsible for all activity under your account. Notify us promptly at support@spriggan.ai if you suspect unauthorized access.

You agree not to use the Service to:

• send unlawful content, malware, or content that infringes others’ rights;
• send spam or bulk unsolicited email;
• harass, defraud, or impersonate others, or misrepresent the sender of a message;
• probe, disable, or circumvent the Service’s security or access controls, or attempt to access another user’s encrypted content;
• resell or white-label the Service without our written permission.

We may suspend or terminate accounts that violate this section.

You retain all rights to the content you encrypt through the Service. You grant us the limited license needed to store, transmit, and process your content solely to provide the Service. Content is encrypted at rest under keys we manage on your behalf. We do not access the plaintext of your content except as necessary to provide the Service or as required by law, and access to encrypted objects is recorded in the audit log.

Encrypted content is cryptographically destroyed thirty (30) days after creation, or sooner if you set a shorter expiration or delete it manually. On the Vault Ledger plan, audit-log records are retained for a minimum of six (6) years to support HIPAA’s accounting of disclosures; on all other plans, audit and metadata records are purged together with the content at thirty (30) days. The Service is a transport and access-control tool, not a system of record — you are responsible for retaining any records you are legally required to keep.

The Service offers free and paid plans; current pricing is published on our site. Paid subscriptions renew automatically until canceled. We may change pricing with at least thirty (30) days’ notice, effective at your next renewal. Fees are non-refundable except where required by law.

The Service interoperates with third-party platforms (Gmail, Outlook, Google Cloud, identity providers). Their availability and conduct are outside our control, and your use of them is governed by their own terms. Interface changes by these platforms may temporarily affect extension functionality.

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE.” WE MAKE NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE. YOU ARE RESPONSIBLE FOR DETERMINING WHETHER THE SERVICE MEETS YOUR REGULATORY AND COMPLIANCE REQUIREMENTS.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SPRIGGAN AI SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES. CONSISTENT WITH THE MASTER SERVICES AGREEMENT, OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THE SERVICE SHALL NOT EXCEED ONE THOUSAND U.S. DOLLARS (USD $1,000) IN THE AGGREGATE. IF YOU HAVE EXECUTED A BAA WITH US, THE BAA’S LIABILITY TERMS GOVERN CLAIMS WITHIN ITS SCOPE.

You agree to indemnify and hold harmless Spriggan AI from claims arising out of your breach of these terms, your violation of applicable law (including HIPAA), or content you transmit outside the Service’s encryption as described in Section 3. Nothing in this Section limits any indemnification obligation we owe you under an executed Business Associate Agreement.

You may stop using the Service and delete your account at any time. We may suspend or terminate the Service for material breach of these terms. Upon termination, Sections 7, 8, and 11–18 survive, and encrypted content follows the deletion schedule in Section 8. We do not provide a post-termination export; retain your own copies as described in Section 8.

We may update these terms by posting a revised version at this page. Material changes will be announced by email or in-product notice at least thirty (30) days before taking effect. Continued use after the effective date constitutes acceptance.

These terms supplement the VaultMail Master Services Agreement accepted at signup, our Privacy Policy, and, where executed, the Business Associate Agreement. In the event of a conflict, the following order of precedence applies: (1) an executed Business Associate Agreement, as to PHI within its scope; (2) the Master Services Agreement; (3) these Terms of Service; (4) the Privacy Policy.

Severability. If any provision of these terms is found invalid or unenforceable, the remaining provisions continue in full force and effect. Assignment. You may not assign these terms without our written consent; we may assign them in connection with a merger, acquisition, or sale of assets. No waiver. A failure to enforce a provision is not a waiver of it. Our IP. The Service, including its software, design, and branding, is owned by Spriggan AI and protected by intellectual-property law; these terms grant you no rights in it beyond use of the Service. Feedback. If you send us feedback, we may use it without obligation. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control.

These terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws principles. Questions and security incidents: support@spriggan.ai.