End User License Agreement

This End User License Agreement (“EULA”) is between you and GreyArm, LLC (“GreyArm”, “we”) and governs the GreyArm desktop sensor for Windows, macOS and Linux, the GreyArm mobile apps for iOS, iPadOS and Android, their updates, and related documentation (the “Software”). It supplements our Terms of Service, which also apply, including the arbitration agreement, disclaimers and limitation of liability. If this EULA and the Terms conflict about the Software, this EULA controls.

By downloading, installing, opening or using the Software, or by clicking to accept, you agree to this EULA. If you do not agree, do not install or use the Software, and uninstall any copy you have.

Subject to this EULA and any plan limits, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to install and use the Software on devices that you own or control, solely for your personal or internal business use. The number of devices you may link to an account depends on your plan.

The Software is licensed, not sold. We and our licensors keep all rights not expressly granted, including all intellectual-property rights in the Software and in the detection catalog and rules it uses.

• Do not copy, modify, translate or create derivative works of the Software, except as the law expressly permits despite this restriction.
• Do not reverse engineer, decompile or disassemble the Software, or attempt to extract its detection catalog or rules, except to the extent applicable law expressly permits.
• Do not rent, lease, sell, sublicense, distribute or provide the Software to third parties as a service.
• Do not remove proprietary notices, or circumvent license checks, plan limits or security features.
• Do not install or use the Software on any device or network you do not own or are not authorized to monitor, or in violation of our Acceptable Use Policy.

To find AI activity, the desktop sensor periodically reads, using standard operating-system tools:

• the list of running processes, including their names, executable paths, full command lines, parent processes, and resource use;
• active and listening network connections and the addresses they connect to;
• the DNS client cache (Windows) and the device’s network neighbor (ARP) table and default gateway;
• for programs identified as AI software, a SHA-256 fingerprint of the program file and its code-signing publisher.

It does not read the contents of your documents, messages, prompts or AI conversations; your clipboard; your keystrokes; your screen; or your browsing history. What is stored and shared is explained in our Privacy Policy.

The optional DNS shield, which is off by default, runs a DNS forwarding service on the device. It changes nothing on your network unless you point devices or your router at it; when it is in use, network devices depend on the computer running it to resolve internet names, and turning it off or shutting that computer down can interrupt their internet access until you change their DNS settings back.

Depending on your platform, containment may:

• End a program and its child processes. Unsaved work in those programs will be lost. Ending a program cannot be undone, although you can start it again.
• Block DNS lookups for that program’s AI services through the DNS shield, until you undo it or the sensor restarts.
• On Windows, add an outbound firewall rule (in a rule group named “GreyArm”) that blocks the program from the network, until you undo it.
• On Windows, register a launch block under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<program>.exe so that the program cannot start again, until you undo it. GreyArm marks the entries it creates with a GreyArmContained value.
• On Windows, isolate the computer by blocking all outbound network traffic except GreyArm and DNS, until you undo it or release isolation from the GreyArm tray menu.

Undoing containment

In the desktop app, Settings → Containment lists every containment change still in place on that computer. Undo reverses a single action’s firewall rule, launch block, DNS shield block and isolation. Remove all reverses every GreyArm firewall rule, launch block, DNS shield block and isolation on the computer, including any created by earlier versions. You can also choose Undo all containment changes from the GreyArm tray menu. Undoing on Windows asks for administrator approval. When an agent has no containment left, its status returns to unverified.

Undo works only on the computer that made the change; containment queued from the web console or mobile app is undone in the desktop app on that computer. If GreyArm can no longer run there, you can remove the changes manually: delete the rules in the “GreyArm” and “GreyArm isolation” groups in Windows Defender Firewall, set the outbound default back to Allow if the computer was isolated, and delete the Debugger and GreyArmContained values from the program’s Image File Execution Options key.

Contained programs — including programs GreyArm misidentified — may stop working, and other software that depends on them may fail. Before containing anything important, make sure you understand what it is and have a current backup. If you need help reversing a change, contact support@greyarm.com.

Software that inspects processes and changes system and network settings carries inherent risk. Your device configuration, other security software, operating-system updates, and the programs you run can interact with the Software in ways we cannot predict or test. You are responsible for deciding whether to install the Software, for keeping backups, for the settings and permissions you grant, and for any action you direct the Software to take.

We may provide updates to the Software and its detection catalog, and may require you to install them to keep using the Software or certain features. Updates are covered by this EULA unless they come with different terms. Updates can change how the Software detects, labels and responds to activity.

The mobile apps display information from your GreyArm account and let you send commands to your linked computers. They ask permission to send notifications; if you allow it, we use Apple’s and Google’s push services (through Expo) to deliver alerts. The mobile apps do not scan the phone or tablet they are installed on and do not offer in-app purchases. Like the desktop sensor, they send anonymous product-usage analytics as described in the Privacy Policy.

You can delete your account from the mobile app, the web console or by email; see Account & Data Deletion.

If you obtained the Software from the Apple App Store or Google Play (each an “App Store”):

• This EULA is between you and GreyArm, LLC only, not the App Store operator. GreyArm, LLC, not the operator, is solely responsible for the Software and its content.
• Your license is limited to use on Apple-branded or Android devices that you own or control, as permitted by the applicable App Store’s usage rules, including Apple’s Usage Rules in its Media Services Terms and Conditions.
• The App Store operator has no obligation to provide maintenance or support for the Software. Contact support@greyarm.com for support.
• If the Software fails to conform to an applicable warranty, you may notify Apple, and Apple will refund the purchase price, if any, for the app. To the maximum extent permitted by law, Apple has no other warranty obligation with respect to the Software, and any other claims, losses, liabilities, damages, costs or expenses attributable to a failure to conform to a warranty are GreyArm, LLC’s responsibility, subject to the disclaimers and limits in this EULA and the Terms.
• GreyArm, LLC, not the App Store operator, is responsible for addressing any claims relating to the Software or your use of it, including product-liability claims, claims that the Software fails to meet legal or regulatory requirements, and claims under consumer-protection, privacy or similar laws.
• If a third party claims that the Software or your use of it infringes their intellectual property, GreyArm, LLC, not the App Store operator, is responsible for the investigation, defense, settlement and discharge of that claim.
• You represent that you are not located in a country subject to a U.S. Government embargo or designated as a “terrorist supporting” country, and that you are not listed on any U.S. Government list of prohibited or restricted parties.
• You must comply with applicable third-party terms (for example, your wireless data agreement) when using the Software.
• Apple and its subsidiaries, and Google, are third-party beneficiaries of this EULA as it applies to Software obtained through their App Stores, and on your acceptance of this EULA they will have the right to enforce it against you as a third-party beneficiary.

This EULA lasts until terminated. Your rights end automatically if you breach it. When it ends, stop using the Software and uninstall it. Uninstalling removes the Software but does not remove containment changes, so choose Remove all under Settings → Containment before you uninstall, or remove them manually as described above. Sections that by their nature should survive termination do so.

Some jurisdictions do not allow these exclusions or limits; in those places they apply only to the extent permitted, and you may have additional rights.

The Software is subject to U.S. export-control and sanctions laws; you will not export, re-export or use it in violation of them. The Software is “commercial computer software” and “commercial computer software documentation” under applicable U.S. federal acquisition regulations, licensed to government users only with the rights in this EULA.

Disputes about this EULA are resolved under the dispute-resolution and governing-law sections of the Terms of Service. Questions: support@greyarm.com.