🔐 End-User License Agreement (EULA)

1. AGREEMENT SCOPE

1.1 This Agreement governs all access to and use of the MAGNET4WATER Platform, including all sub-platforms (IGW-NET, SwaNET, DataNET, StormNET, ConduitNET), services, interfaces, and associated infrastructure.

1.2 This Agreement applies to all tiers of access, including Free Tier and Premium Tier subscriptions. Tier-specific features, protections, and limitations are described in Section 2 (Definitions) and Section 6 (Privacy, Data Ownership, and Security Architecture).

1.3 Hydrosimulatics reserves the right to update, modify, or discontinue any part of the Platform at its sole discretion, provided that such changes do not retroactively alter the terms of this Agreement without notice.

1.4 Users may be subject to additional terms and conditions if accessing the Platform through an institutional deployment, enterprise license, or third-party integration. Such terms shall be deemed incorporated into this Agreement by reference.

2. DEFINITIONS

2.1 Platform

The MAGNET4WATER software system, including all sub-platforms (IGW-NET, SwaNET, DataNET, StormNET, ConduitNET), services, interfaces, and associated infrastructure.

2.2 Protected Data of the User (PDY)

All files, inputs, outputs, models, configurations, telemetry, metadata, and any other content uploaded, generated, or processed by the User within the Platform. This includes personally identifiable information (PII), modeling artifacts, and simulation outputs. PDY is encrypted at all times and remains inaccessible to Hydrosimulatics under all supported configurations available to Premium Tier users.

2.3 Subscription

A paid license granting time-limited access to the Platform, subject to the terms of this Agreement.

2.4 Free Tier

A limited-access version of the Platform provided without charge, subject to usage restrictions and feature limitations. Free Tier accounts do not include encryption at rest, confidential computing, or user-controlled encryption key management.

2.5 End-to-End Encryption (E2EE)

A security protocol in which user content is encrypted during transmission (TLS 1.3), storage (AES-256), and active processing (confidential computing). E2EE ensures that data remains unintelligible to unauthorized parties—including platform operators and infrastructure providers—throughout its lifecycle. E2EE is available exclusively to Premium Tier users.

Note: Google Cloud defines end-to-end encryption as encryption at rest, in transit, and in use. MAGNET4WATER adopts this lifecycle framing and enforces it through confidential computing and operational inaccessibility.

2.6 Confidential Computing

A security model in which data remains encrypted during active processing in memory, using secure enclave technologies (e.g., Intel SGX, AMD SEV) that prevent access by hypervisors, cloud operators, and privileged system processes. Confidential computing is available exclusively to Premium Tier users.

2.7 Multi-Factor Authentication (MFA)

A mandatory access control mechanism requiring two or more forms of verification before granting access to modeling environments or encrypted content. MFA blocks unauthorized access—even if login credentials are compromised.

2.8 Encryption Key

A cryptographic key used to encrypt and decrypt PDY. MAGNET4WATER supports three modes of key management for Premium Tier users:

• User-Managed Key: A key generated and controlled by the User. Hydrosimulatics does not store, access, or recover this key.
• Third-Party Provisioned Key: A key managed by an enterprise IT provider or cloud service under the User’s control.
• Platform-Generated Key: A key automatically generated and managed by MAGNET4WATER if no other method is selected. Hydrosimulatics enforces strict operational controls to prevent access to content encrypted with this key.

2.9 Secure Enclave

A hardware-isolated execution environment that encrypts data in memory and prevents inspection or extraction by system-level processes.

2.10 Operational Inaccessibility

The architectural guarantee that Hydrosimulatics personnel, infrastructure providers, and third-party services cannot access, inspect, or extract user content under any supported configuration.

2.11 Session Token

A time-bound, encrypted credential used to authenticate user sessions. Session tokens auto-terminate after inactivity and are governed by MFA.

2.12 Metadata

Non-content data such as timestamps, file size, and transmission logs used for performance monitoring and audit. Metadata is stored separately and cannot be used to reconstruct or interpret user work.

2.13 Dissemination Tools

Platform features that allow Users to publish, share, or collaborate on modeling outputs. Dissemination is governed by user-selected visibility settings and access permissions.

2.14 Institutional Deployment

A configuration of MAGNET4WATER operated under the control of an academic, governmental, or enterprise entity, with custom encryption, audit, and compliance policies.

2.15 AI Support

Artificial intelligence tools embedded within the Platform to assist Users with modeling, data interpretation, and navigation. AI modules operate within encrypted containers and do not retain or transmit user content beyond the scope of the session.

2.16 Premium Tier

A paid subscription tier that includes the full security architecture: end-to-end encryption (in transit, at rest, and in memory), confidential computing, multi-factor authentication (MFA), and user-controlled encryption key management. Only Premium Tier accounts benefit from these protections.

3. LICENSE GRANT

3.1 Subject to the terms of this Agreement, Hydrosimulatics grants the User a non-exclusive, non-transferable, revocable license to access and use the Platform during the Subscription term or Free Tier period.

3.2 The license granted herein is limited to the User’s internal research, modeling, and educational use. Commercial use, redistribution, or sublicensing is prohibited unless expressly authorized in writing by Hydrosimulatics.

3.3 The license does not grant any rights to inspect, reverse-engineer, or extract the Platform’s source code, algorithms, or internal architecture.

3.4 The license does not include access to encrypted user content by Hydrosimulatics. All Protected Data of the User (PDY) remains inaccessible to Hydrosimulatics under all supported configurations available to Premium Tier users.

4. RESTRICTIONS

• Copy, modify, or create derivative works of the Platform;
• Distribute, sell, lease, or sublicense the Platform to third parties;
• Use the Platform to violate applicable laws, regulations, or third-party rights;
• Attempt to gain unauthorized access to any portion of the Platform or its infrastructure;
• Circumvent or disable any security features, including MFA, encryption boundaries, or access controls.

4.2 Free Tier users shall not attempt to simulate or replicate Premium Tier protections, including encryption at rest, confidential computing, or key management features.

4.3 Hydrosimulatics reserves the right to suspend or terminate access for violations of these restrictions, without refund or liability.

5. FEES AND PAYMENT

5.1 Subscription fees for Premium Tier access shall be paid in accordance with the pricing schedule published by Hydrosimulatics or agreed upon in writing.

5.2 All fees are non-refundable except as required by law or explicitly stated in this Agreement.

5.3 Hydrosimulatics may modify pricing or billing terms with thirty (30) days’ notice. Continued use of the Platform after such notice constitutes acceptance of the new terms.

5.4 Failure to pay applicable fees may result in suspension or termination of access to Premium Tier features, including encryption, confidential computing, and key management.

6. PRIVACY, DATA OWNERSHIP, AND SECURITY ARCHITECTURE

MAGNET4WATER is built on the principle that user work—including hydrosimulatics models, telemetry inputs, and simulation outputs—must remain secure, private, and under the user's control. This section outlines the layered security architecture that protects user content across every stage of the data lifecycle: transmission, storage, computation, access, and sharing.

Hydrosimulatics does not rely on discretionary access policies or trust-based permissions. Instead, it enforces security through cryptographic design, confidential computing, and operational isolation—ensuring that even platform operators cannot access user content under any supported configuration.

Unless otherwise stated, the protections described in this section apply exclusively to Premium Tier accounts. Free Tier accounts are subject to baseline protections and do not include encryption at rest, confidential computing, or customizable key management.

6.1 Security Foundations: What Makes User Work Secure

• End-to-end encryption: Data is encrypted in transit, at rest, and in memory.
• Confidential computing: Data remains encrypted even during active processing.
• Multi-factor authentication (MFA): Unauthorized access is blocked—even if credentials are compromised.
• Encryption key management: Only the user (or their designated provider) can decrypt their data.
• Operational inaccessibility: No personnel—internal or external—can view, modify, or extract user content, even during breach scenarios.

These protections are enforced by architecture—not by policy exceptions or administrative discretion.

6.2 End-to-End Encryption

• In Transit: TLS 1.3 encrypts all data exchanged between user devices and MAGNET4WATER servers.
• At Rest: AES-256 encryption secures stored data, including models, telemetry, and outputs.
• In Memory: Confidential computing environments encrypt data during active processing, ensuring that even runtime content remains inaccessible.

End-to-end encryption is available exclusively to Premium Tier users.

6.3 Confidential Computing and Runtime Protection

All sensitive operations—including model calibration, telemetry parsing, and simulation execution—occur within hardware-isolated environments. These secure enclaves prevent access by hypervisors, infrastructure providers, cloud operators, and privileged system processes.

Runtime data remains encrypted and inaccessible to all service layers under any operational scenario. Confidential computing is available exclusively to Premium Tier users.

6.4 Multi-Factor Authentication (MFA)

• MFA blocks unauthorized access—even if login credentials are compromised.
• Session tokens are encrypted, time-bound, and auto-terminate after inactivity.
• Anomalous login behavior triggers automated containment and alerts.

MFA is enforced across all tiers, but only Premium Tier users benefit from MFA-protected access to encrypted content.

6.5 Encryption Key Management

• User-Managed Keys: Users generate and control their own keys. Hydrosimulatics cannot store, access, or recover these keys.
• Key Loss Disclosure: If the key is lost, access to encrypted content is permanently lost.
• Third-Party Provisioning: Enterprise IT or cloud providers manage keys via secure vaults. Hydrosimulatics does not retain visibility.
• Platform-Generated Keys (Default): MAGNET4WATER generates and manages keys on behalf of the user.
• Access Boundaries: While technically accessible by infrastructure, Hydrosimulatics enforces strict contractual and operational controls that prohibit access. All access is governed by cryptographic enforcement and legal safeguards.

Free Tier accounts do not support encryption key customization or isolation.

6.6 Operational Inaccessibility

User content cannot be viewed, modified, or extracted under any supported configuration. Infrastructure providers cannot inspect or access data within secure enclaves or encrypted containers. Encrypted content remains unintelligible and unrecoverable without the corresponding key.

No backdoor access exists. All access is governed by cryptographic enforcement and explicit user consent. These protections are available exclusively to Premium Tier accounts.

6.7 Breach Response Protocols

• Continuous monitoring detects unauthorized access attempts and anomalies.
• Affected containers are immediately isolated upon breach confirmation.
• Users are notified within 24 hours and provided with:
  • A summary of the incident
  • A detailed incident report
  • Recommended remediation steps

For Premium Tier users, encrypted data remains inaccessible even during breach scenarios. Free Tier users may be subject to different containment boundaries.

6.8 Metadata Handling and Isolation

• Metadata is stored separately and never linked to decrypted content.
• Hydrosimulatics does not use metadata for behavioral profiling or inference.
• Metadata cannot be used to reconstruct or interpret user work.

6.9 AI Privacy and Model Isolation

• AI modules do not store, replicate, or learn from user work.
• All AI-assisted computation respects encryption boundaries.
• Hydrosimulatics does not use user content to train external models or third-party systems.

Encrypted container protections apply exclusively to Premium Tier users.

6.10 Legal Compliance and Governance

• GDPR, CCPA, CPRA, and other U.S. state and international privacy laws
• Jurisdiction-specific frameworks required by institutional contracts
• Internal audit and external review upon request

Governance is overseen by Hydrosimulatics’ Data Stewardship Board.

6.11 Audit Logging and Transparency

• Logs include access attempts, session events, and key management actions.
• Users may request audit summaries for their own accounts.
• Hydrosimulatics does not retain logs that expose decrypted content.

6.12 Termination and Data Retention

• Encrypted content is retained for a limited period unless deletion is requested.
• Hydrosimulatics cannot decrypt or access retained content without the user’s key.
• Users may request immediate deletion of all encrypted content and metadata.

6.13 Institutional Contracts and Sovereignty

• Institutions control key management, access policies, and audit protocols.
• Hydrosimulatics enforces contractual controls that prohibit inspection or export of institutional data.

6.14 Security Architecture Summary

• All user content is encrypted in transit, at rest, and in memory
• No service provider or infrastructure layer can access user work under any supported configuration
• Encryption keys are never stored or accessible unless explicitly provisioned by the user
• Confidential computing preserves encryption during runtime—even from privileged system processes
• Multi-factor authentication (MFA) blocks unauthorized access—even if credentials are compromised
• Metadata is isolated and cannot be used to reconstruct user content
• No backdoor access exists. All access is governed by cryptographic enforcement and explicit user consent

These protections apply exclusively to Premium Tier accounts. Free Tier users are subject to baseline protections but do not benefit from encrypted storage, confidential computing, or key customization.

7. TERMINATION

7.1 This Agreement shall remain in effect until terminated by either party.

7.2 The User may terminate this Agreement at any time by ceasing use of the Platform and, if applicable, requesting deletion of their account and associated Protected Data.

7.3 Hydrosimulatics may terminate this Agreement or suspend access to the Platform immediately, without prior notice, if:

• The User breaches any provision of this Agreement;
• Required fees are unpaid or disputed;
• Continued access poses a security, legal, or operational risk.

7.4 Upon termination:

• All licenses granted under this Agreement shall immediately cease;
• Encrypted content associated with Premium Tier accounts shall remain inaccessible without the user’s encryption key;
• The User may request deletion of all retained data, subject to applicable retention policies and legal obligations.

8. DISCLAIMERS

• The Platform is provided “as is” and “as available,” without warranties of any kind, express or implied.
• Hydrosimulatics does not warrant that:
• The Platform will be uninterrupted, error-free, or free of harmful components;
• Modeling outputs or simulations will be accurate, complete, or suitable for any specific purpose;
• Encryption or security features will prevent all forms of unauthorized access or data loss.
• Hydrosimulatics disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement.

9. LIMITATIONS OF LIABILITY

• To the maximum extent permitted by law, Hydrosimulatics shall not be liable for:
• Indirect, incidental, special, consequential, or punitive damages;
• Loss of data, revenue, profits, or business opportunities;
• Damages arising from unauthorized access, use, or disclosure of Protected Data.
• Hydrosimulatics’ total liability under this Agreement shall not exceed the amount paid by the User for the Subscription during the twelve (12) months preceding the claim.
• The User acknowledges that:
• Encryption key loss may result in permanent data inaccessibility;
• Free Tier accounts do not include full security protections;
• Use of the Platform is at the User’s own risk.

10. GOVERNING LAW AND JURISDICTION

10.1 This Agreement shall be governed by and construed in accordance with the laws of the State of Michigan, without regard to its conflict of law principles.

10.2 Any disputes arising under or in connection with this Agreement shall be resolved exclusively in the state or federal courts located in Michigan, and the parties consent to personal jurisdiction therein.

10.3 The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Agreement.