Website Terms of Use

1. Acceptance of Terms & Scope of Agreement

These Website Terms of Use ("Terms") form a legally binding agreement between you ("User", "Tenant", or "you") and Natrium Technologies Inc. ("Natrium", "we", "our", or "us"). These Terms govern your access to and use of natrium.sh, our encrypted email application, direct-MX mail transfer agent (MTA) relays, inbound webhook gateways, autonomous agent discovery endpoints, and associated software APIs (collectively, the "Services").

By accessing or using the Services, creating a mailbox, sending or receiving emails, configuring custom domains, or interacting with our network, you acknowledge that you have read, understood, and agree to be bound by these Terms and our accompanying Privacy Policy, Trust & Safety Policy, Cookie Policy, and Law Enforcement Guidelines. If you do not agree to these Terms in their entirety, you must immediately cease all use of the Services.

2. Eligibility, Anonymous Registration & Plan Quotas

You must be at least 18 years of age (or the legal age of majority in your jurisdiction) to use the Services. If you are registering an account on behalf of a company, organization, or educational institution, you represent and warrant that you have legal authority to bind that entity to these Terms.

Anonymous Signup: Natrium values individual sovereignty and privacy. Account creation does not require providing a mobile phone number, SMS verification code, secondary recovery email address, physical residential address, or government identity card. You are solely responsible for safeguarding your credentials, recovery questions, and hardware authentication keys.

Account Plans & Resource Limits: The Services are provisioned according to defined account tiers:

3. Zero-Knowledge Architecture & Client Key Custody

Natrium is engineered from the ground up under zero-knowledge cryptographic principles. Your message bodies, drafts, personal notes, and attachment payloads are encrypted with authenticated AES-256-GCM ciphers using per-user Data Encryption Keys (sealed key envelopes) and keys derived from your account password via memory-hard scrypt (N=32768, r=8, p=1) combined with a server-side HMAC-SHA256 cryptographic pepper and encrypted unique salts.

Sole Custody & Account Recovery Methods: Natrium servers never store your plaintext account password. If you forget your account password, you can recover access using any of the recovery methods configured on your account: your two-question security recovery envelope (which re-keys your cryptographic key envelope via verified challenge answers), enrolled FIDO2 / WebAuthn hardware passkeys, single-use 8-character 2FA backup recovery codes, verified recovery email codes, or recognized trusted device reset authorization. If you lose your account password and have not configured any recovery method or trusted device, Natrium cannot bypass your encryption envelope or manually decrypt your mailbox. You maintain sole responsibility for preserving your credentials, TOTP backup codes, and recovery parameters.

4. Acceptable Use Policy (AUP) & Prohibited Conduct

You agree not to use the Services for any of the following prohibited purposes:

• Spam & Bulk Unsolicited Dispatch: Sending unsolicited bulk marketing, commercial advertisements, snowshoe spam, or deceptive cold outreach in violation of the CAN-SPAM Act (15 U.S.C. § 7701 et seq.), the GDPR, or EU Directive 2002/58/EC.
• Phishing, BEC & Social Engineering: Impersonating financial organizations, businesses, government bodies, or individuals to harvest passwords, session tokens, cryptographic keys, or funds.
• Malware & Exploit Dissemination: Transmitting trojans, ransomware, infostealers, malicious Office macros, zero-day exploit payloads, or command-and-control (C2) beacons.
• Perimeter & Network Abuse: Executing Distributed Denial of Service (DDoS) attacks, brute-force password attacks, automated credential stuffing, SQL/command injection attempts, or unauthorized vulnerability scanning against our network.
• Mail Protocol & Header Forgery: Forging RFC 5322 headers, DKIM cryptographic signatures, SPF records, or envelope sender addresses to deceive recipients or evade mail reputation filters.
• Harassment, Doxxing & Threats of Violence: Using a Natrium mailbox to transmit credible threats of physical harm, extortion, blackmail, swatting, or non-consensual intimate imagery.

5. Automated Scraping, AI Model Training & Crawler Restrictions

Standard web search engines and compliant AI discovery crawlers may index public documentation pages solely in strict accordance with our published /robots.txt, /llms.txt, and /AGENTS.md manifests. All unauthorized automated harvesting, scraping, spidering, or extracting of user directories, mailboxes, or authenticated email routes is strictly prohibited and automatically blocked by our perimeter firewall.

Commercial AI Model Training Prohibition: You are strictly forbidden from scraping, collecting, or ingesting user communications, metadata, or platform assets from Natrium to train, fine-tune, distill, or benchmark any commercial machine learning model or large language model (LLM) without express written authorization from Natrium Technologies Inc. Authorized access by a user's own autonomous AI agent via our authenticated Model Context Protocol (MCP) or WebMCP tools on behalf of that authenticated user is explicitly permitted.

6. Intellectual Property & DMCA Compliance

All brand assets, the Natrium wordmark and emblem, software source code, user interface designs, cryptographic envelope implementations, and design tokens are the exclusive proprietary intellectual property of Natrium Technologies Inc. If you believe your copyrighted work has been infringed by content transmitted through our systems, please submit a written DMCA notice satisfying all requirements of 17 U.S.C. § 512(c)(3) to our designated copyright agent at dmca@natrium.sh or legal@natrium.sh.

7. User Content & External File Responsibility

You retain full ownership and intellectual property rights in the emails, drafts, notes, and attachments you compose or store in your mailbox. While Natrium automatically screens inbound attachments against 70+ threat intelligence engines via the VirusTotal API and Falcon Sandbox heuristics prior to download, and provides one-click phishing reporting and sender blocklists, you acknowledge that you remain responsible for exercising caution when downloading or opening files from unknown external senders.

8. Service Availability, Mailbox Quotas & Modifications to Terms

We operate sovereign, dedicated infrastructure with zero-downtime process supervision and direct-MX delivery, but we do not warrant that the Services will be uninterrupted or error-free under all network conditions. Accounts that exceed their provisioned storage quota (10 GB on Free, 25 GB on Pro, or 50 GB on Enterprise) or per-message attachment size limit may experience rejected inbound deliveries or paused outbound dispatch until storage is cleared or the plan is upgraded.

Modifications to Terms: Natrium reserves the right to modify these Terms to reflect changes in our services, security infrastructure, or applicable statutory requirements. For material amendments, we will provide at least thirty (30) calendar days prior notice via an authenticated in-app announcement banner or notification message to your primary mailbox. Continued use of the Services following the effective date of updated Terms constitutes your binding acceptance of the revisions.

9. Disclaimer of Warranties

THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, OR FREEDOM FROM PROGRAM ERRORS OR SERVICE INTERRUPTIONS.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL NATRIUM TECHNOLOGIES INC., ITS OFFICERS, DIRECTORS, EMPLOYEES, OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF PROFITS, DATA LOSS, LOSS OF GOODWILL, OR SYSTEM DOWNTIME) ARISING OUT OF OR IN CONNECTION WITH THE SERVICES. OUR TOTAL AGGREGATE LIABILITY ARISING FROM ALL CLAIMS UNDER THESE TERMS SHALL NOT EXCEED ONE HUNDRED DOLLARS ($100.00 USD) OR THE AMOUNT PAID BY YOU FOR THE SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, WHICHEVER IS GREATER.

11. Indemnification Obligations

You agree to defend, indemnify, and hold harmless Natrium Technologies Inc., its officers, directors, employees, and agents from and against any third-party claims, liabilities, damages, losses, costs, or expenses (including reasonable attorneys' fees) arising out of or related to your misuse of the Services, your violation of these Terms, or your violation of applicable laws or third-party rights.

12. Immediate CSAM Termination & Non-Appealable Policy

Natrium maintains strict zero tolerance for Child Sexual Abuse Material (CSAM), Child Sexual Exploitation and Abuse (CSAE), child grooming, or severe violent attacks. Pursuant to federal statute (18 U.S.C. § 2258A), accounts detected transmitting or attempting to transmit prohibited exploitation content are terminated immediately, with active sessions destroyed, connecting IPs and persistent device binding tokens added to the perimeter firewall blocklist, and forensic evidence reported to the National Center for Missing & Exploited Children (NCMEC).

Non-Appealable Determinations: Terminations resulting from verified zero-tolerance safety violations or unauthorized database exfiltration attempts are final and strictly non-appealable.

13. Mandatory Binding Individual Arbitration & Class Action Waiver

Any dispute, claim, or controversy arising out of or relating to these Terms or the Services shall be settled through binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules for individual users (or Commercial Arbitration Rules for enterprise entities). Arbitration hearings shall take place remotely via videoconference or in a mutually agreed jurisdiction. Each party shall bear its own standard filing and legal fees in accordance with AAA rules.

30-Day Arbitration Opt-Out: You have the right to opt out of binding arbitration by sending written notice to legal@natrium.sh within thirty (30) days of first registering your account, specifying your username and primary mailbox address. If you opt out, disputes will be resolved in courts of competent jurisdiction.

Class Action Waiver: YOU AND NATRIUM AGREE THAT DISPUTES SHALL BE RESOLVED SOLELY ON AN INDIVIDUAL BASIS AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING.

14. Governing Law & Dispute Jurisdiction

These Terms and any related claims shall be governed by and construed in accordance with applicable federal United States law and commercial contracts doctrine, without regard to conflict-of-law principles. For any claims where arbitration has been lawfully opted out or is otherwise not enforced, both parties consent to personal and exclusive jurisdiction in competent state or federal courts.

15. Legal Notices & Formal Inquiries

Formal legal notices, statutory inquiries, or subpoenas must be submitted electronically to legal@natrium.sh. For general customer support and account inquiries, contact support@natrium.sh.

16. Reserved Official Handles & Anti-Spoofing Rules

To protect users and external recipients from authority impersonation and phishing, Natrium cryptographically reserves all official administrative, security, and legal local-parts on the @natrium.sh domain: including but not limited to admin, security, legal, abuse, privacy, support, safety, dmca, emergency, dpo, compliance, postmaster, hostmaster, and webmaster.

No general registrant may register, alias, or spoof these reserved addresses. Any attempt to impersonate Natrium staff, forge system verification badges, or mislead users into believing an account is an official Natrium administrative desk will result in immediate account termination.

17. Account Recovery, Session Revocation & Security Lockdown

Users have full access to multiple self-service and zero-trust recovery mechanisms to restore account access and re-key their encryption vault:

• Two-Question Security Recovery Challenge: Users may configure confidential security recovery questions and answers within their account settings. Recovery answers are treated as sensitive credentials, masked in user interface inputs with dot-concealment like passwords, and hashed via memory-hard scrypt with a server-side HMAC-SHA256 cryptographic pepper to re-wrap your personal data key envelope upon verification without ever exposing plaintext answers.
• FIDO2 / WebAuthn Hardware Passkeys & Biometric Step-Up: Enrolled resident hardware keys (YubiKey, Apple Touch ID / Face ID, Windows Hello) can verify identity and authorize password resets.
• Single-Use 8-Character 2FA Backup Codes & TOTP: Pre-generated emergency 8-character backup recovery codes (scrypt-protected) and RFC 6238 TOTP authenticator codes provide immediate offline-capable recovery.
• Optional Recovery Email Verification: If you voluntarily configure an external recovery email address, a time-bound 6-digit SHA-256 verification code can be dispatched to verify ownership.
• Recognized Trusted Device Reset Flow: Password reset requests can be completed from a previously recognized IP address or cryptographic device authorization token associated with the account.

You may inspect and revoke active login sessions across devices at any time from your Security Settings panel, or trigger a global sign-out across all devices. If our automated defense systems detect credential stuffing, session hijacking, or unauthorized access attempts associated with an account, Natrium reserves the right to automatically revoke active session tokens and place the account into protective lockdown pending multi-factor verification.

18. Multi-Account Switching, Scheduled Dispatch & Rich Presence

Natrium permits linking multiple sovereign mailboxes within a single client session (up to 2 linked accounts on Free, 4 on Pro, and unlimited on Enterprise) using HMAC-verified account link tokens. Each mailbox retains independent encryption keys and isolated storage quotas.

When using scheduled email dispatch, custom email signatures, or opt-in rich music presence (Spotify, Last.fm, Apple Music, or YouTube Music status badges), you remain responsible for the content of your status metadata and scheduled messages. Scheduled messages remain encrypted in your vault until the designated dispatch timestamp.

19. Automated Vacation Responder & Out-of-Office Standards

Users may configure automated vacation and out-of-office autoreplies within their mailbox preferences. Natrium enforces standard email protocol hygiene and RFC 3834 compliance:

• RFC 3834 Compliance: Automated replies include standard machine-dispatch suppression headers (Auto-Submitted: auto-replied and Precedence: bulk) to identify the message as automated.
• Anti-Loop & Rate-Limiting Protections: To prevent infinite reply loops and mail storms, Natrium enforces a 24-hour rate-limiting window per unique recipient address. Automated replies are never dispatched in response to mailing lists (List-Id, List-Unsubscribe), automated notification services, spam quarantined messages, or Non-Delivery Reports (NDR/bounces).
• Configurable Scheduling Windows: Vacation responder messages are strictly active within user-specified start date and end date timestamps, and deactivate automatically upon window expiration.

20. Payment Processing, Subscriptions & Refund Policy

PCI-DSS Certified Payment Processing: Paid subscription upgrades (Pro and Enterprise tiers) are securely processed via certified third-party payment gateways (including PayPal). Natrium never receives, processes, or stores raw payment card numbers, bank account details, or CVV security codes on its servers.

Subscription Billing & Auto-Renewal: Subscriptions are billed in advance on a recurring monthly or annual basis as selected during upgrade checkout. Unless cancelled prior to renewal, subscriptions automatically renew at the prevailing published rate.

Cancellation & Immediate Downgrades: You may cancel or downgrade your subscription at any time directly from your account Settings view. Upon cancellation, your paid tier perks remain active through the end of your current paid billing period, after which your account transitions to the Free plan quota without data loss (provided total storage is within Free tier limits).

14-Day Refund Policy: If you are dissatisfied with a paid subscription for any reason within fourteen (14) days of your initial payment or annual renewal, you may request a full refund by contacting support@natrium.sh. Refunds are credited back to the original payment method.

21. Term, Inactivity Policy & Data Export Portability

Term: These Terms remain in full effect while you access the Services or maintain an active Natrium mailbox.

Inactivity Policy: Free tier accounts that demonstrate zero login activity, session refreshes, or mailbox interactions for a continuous period of twelve (12) consecutive months may be flagged as inactive. Prior to any quota recycling or dormant account deactivation, Natrium will dispatch automated notification emails to the primary mailbox at 30 days and 7 days prior to action, providing ample opportunity to maintain active status. Paid subscription accounts remain active indefinitely regardless of login frequency while billing is in good standing.

User-Controlled Termination & Data Portability: You may terminate your account at any time directly from your account Settings view. Natrium guarantees full data portability: prior to account closure, you may export your email archives and contacts in standard format. Upon completing account deletion, cryptographic shredding irreversibly destroys your encryption key envelope and stored ciphertext in full compliance with GDPR Article 17.