Lattice beta terms

1. What this is

Lattice is a read-only knowledge graph of public cybersecurity information, offered to software and AI agents through an interface called the Model Context Protocol (MCP) and through a web API. It is operated by NamiQ LLC, a Texas limited liability company ("NamiQ", "we", "us").

These terms are the agreement between NamiQ and the person or organisation requesting access ("you"). They apply to the Lattice private beta, including the server, any API key we give you, and everything the service returns (the "Service").

2. It is a beta

The Service is a pre-release test. It can change, break, return different answers from one day to the next, or be withdrawn, at any time and for any reason.

We have made no promise to release a final version, to keep any feature, to offer it free of charge, or to offer it at all after the beta. If we launch a commercial version it will come with its own terms, which you will need to accept separately. Nothing in these terms gives you a right to a commercial plan, a price, or a particular price.

3. Accepting these terms

By requesting a trial key, or by using one, you agree to these terms. You do not have to tick a box to start a trial. To raise the limits you will be asked to verify your account and accept these terms explicitly; we record the version, the date and time, and the details you give.

You confirm that you are at least 18, that you are acting for a business or in a professional capacity, and that you have the authority to accept these terms for the organisation you name. These terms are not intended for consumers.

4. Access and API keys

Trial keys are issued automatically to the email address you give, with no review. A trial key is a trial: it expires on the date we state, and issuing one is not a promise of any later access. We may refuse a request or stop issuing keys at any time, without giving a reason.

A trial key has usage limits. When you reach them you can verify your account (your name, position, company and what you will use the Service for) and accept these terms to raise them. For unlimited or commercial use, contact [email protected].

A key is for you and your organisation only. Keep it secret, do not share it or sell access to it, and tell us at once if it leaks. You are responsible for everything done with your key, including by software or AI agents you connect it to.

We may apply rate limits, change them, suspend a key, or revoke a key at any time, with or without notice, and without liability to you.

5. What you may and may not do

You may use the Service for your own internal security work, research and product development, and you may quote individual results in your own work, provided you keep the attribution notices the Service returns.

You may not: copy, mirror or rebuild the graph or a substantial part of it; retrieve it in bulk by automated enumeration, including by walking identifiers or following links systematically; resell, sublicense or republish the data in bulk; get around rate limits, retrieval limits or access controls, including by holding several keys for one organisation; probe, overload or attack the Service; use it to harm anyone, or to break any law; use it to build a competing dataset or service; or use its output to train, fine-tune or evaluate a model or system that you offer to others, or to build a dataset. Using answers as context for your own agent is allowed.

We apply limits on how much you can ask for per hour and per day, and on how much of the graph one organisation can retrieve. We may change them at any time and we enforce them automatically. The Service is for answering questions, not for extracting data.

Do not send us personal data, secrets or confidential information in your queries. The Service only needs public identifiers such as a CVE number or an ATT&CK technique id.

6. Third-party content

The graph is compiled from public sources owned by other people, including MITRE (ATT&CK and CWE), the U.S. National Vulnerability Database, and open detection-rule projects. Each source has its own licence and attribution requirements. We return the notices that apply to each answer, and you must follow them when you reuse the content.

We do not own third-party content and we do not promise that we are entitled to pass it on in every jurisdiction or for every use. If a source owner or a court asks us to remove content, we may do so immediately.

Links the graph labels as inferred are our own derived guesses, not statements by the source. Any confidence figure attached to them is a ranking aid. It is not a probability, and it has not been validated against real outcomes.

7. No professional advice and no reliance

The Service is information, not advice. It can be incomplete, wrong or out of date. It does not find vulnerabilities, incidents or attackers in your systems, and it does not tell you that you are safe.

You must not rely on the Service as the only basis for any security, safety, legal, compliance, financial or business decision, and you must not use it in any system where a wrong answer could injure a person or cause serious loss. You are solely responsible for your own systems, your own decisions, and what you tell your own customers.

Treat everything the Service returns as untrusted text. It comes from third parties and may contain instructions or claims that are false. If you connect an AI agent, you are responsible for how that agent uses it.

8. No warranty

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITH ALL FAULTS. TO THE FULLEST EXTENT THE LAW ALLOWS, NAMIQ DISCLAIMS ALL WARRANTIES OF ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF ACCURACY, COMPLETENESS, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND THAT THE SERVICE WILL BE SECURE, UNINTERRUPTED OR ERROR-FREE.

9. No service level, support or continuity

We make no commitment about availability, speed, response times, support, backups, data retention, compatibility between versions, or how long the Service or your access will last. We may modify, suspend or end the Service, or any part of it, at any time, with or without notice. We have no duty to keep your key, your request history, or any data.

Do not build anything you cannot afford to lose on top of the Service during the beta.

10. Limit of liability

TO THE FULLEST EXTENT THE LAW ALLOWS, NAMIQ AND ITS MEMBERS, OFFICERS, EMPLOYEES, CONTRACTORS AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, BUSINESS, CUSTOMERS OR GOODWILL, OR FOR ANY SECURITY INCIDENT, BREACH, MISSED OR FALSE FINDING, OR INTERRUPTION AFFECTING YOUR SYSTEMS OR YOUR BUSINESS, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF WE HAVE BEEN TOLD IT MAY HAPPEN.

THIS LIMIT APPLIES EVEN WHERE THE LOSS IS CAUSED BY OUR OWN NEGLIGENCE. OUR TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100).

Nothing in these terms limits liability for fraud, gross negligence or wilful misconduct. Where a law does not allow a limit, that limit applies only as far as the law permits, and nothing here limits liability that cannot be limited by law.

11. Your business is your responsibility

NamiQ has no responsibility for your business, your customers, your products, your contracts or the claims you make to others. Using the Service does not make NamiQ your supplier, partner, adviser or agent, and you must not say or imply that NamiQ endorses you, your product or your results.

12. Your indemnity

YOU WILL DEFEND AND INDEMNIFY NAMIQ AGAINST ANY THIRD-PARTY CLAIM, AND THE LOSSES AND REASONABLE COSTS THAT COME WITH IT, TO THE EXTENT IT ARISES FROM YOUR BREACH OF THESE TERMS OR OF THE LAW, OR FROM YOUR BUSINESS OR PRODUCTS.

13. Ownership and feedback

We keep all rights in the Service, in our own selection and arrangement of the data, and in anything we derive. During the beta you get a limited, revocable, non-exclusive, non-transferable right to use the Service under these terms.

If you give us feedback or ideas, we may use them for any purpose without payment or credit. You are not required to give any.

14. What we log

To run the Service, keep it secure and understand how it is used, we log each request: which tool or endpoint, the public identifiers asked about, the time taken and the result size, the name and version your client reports, your key identifier, and a salted one-way hash of your network address. We do not store your raw address in these logs. We use the logs for operations, abuse prevention and analytics. We keep request logs for 60 days and then delete them. We keep the record of a key, including the terms you accepted and the details you gave to verify your account, for six months after the key expires or is withdrawn, and then delete it. If you ask us to delete your details, we also revoke your Lattice key and delete its records. The privacy page describes how we handle the details you give us on the request form.

15. Laws and sanctions

You will comply with all laws that apply to your use, including export control and sanctions rules. You confirm that you are not located in, or ordinarily resident in, a country or region under comprehensive U.S. sanctions, and are not on a U.S. restricted-party list.

16. Ending these terms

Either of us may end these terms at any time. We may end or suspend your access immediately if we believe you have broken them. When they end, you must stop using the Service and delete your key. Sections 5 to 15, 16 and 18 continue after they end.

17. Changes to these terms

We may change these terms. We will post the new version on this page with a new version number and date, and we may email the address you gave us. If you keep using the Service after a change you accept the new version. If you do not agree, stop using it.

18. Governing law, disputes and the rest

These terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. Before starting a claim, each of us will try in good faith for 30 days to resolve it informally by writing to the other. Any claim that cannot be resolved that way must be brought in the state or federal courts located in Travis County, Texas, and each of us accepts those courts.

These terms are the whole agreement about the Service and replace anything said before. If a part is unenforceable, the rest still applies. A failure to enforce a right is not a waiver of it. You may not transfer your rights under these terms without our written consent; we may transfer ours. Neither of us is liable for delay caused by events beyond our reasonable control. Nothing here creates a partnership, joint venture, agency or employment relationship.

19. Contact

Questions about these terms, takedown requests, security reports, and unlimited or commercial use: [email protected].