Legal

Craton terms of service

Terms for Craton, the risk-analytics platform. They say what the software does, what you may expect of it, what it costs, and what happens to the data you send. Read them with the acceptable-use page, which holds the rules of use these terms refer to.

Status of this page

• In effect from 18 August 2026.
• Updated 23 September 2026, effective the same day (section 4): where your data is stored, where model runs execute, what an address lookup sends, and the sub-processor categories that go with them.
• Updated 7 October 2026, effective the same day (sections 4 and 6): the model exchange, what running a provider's model sends to that provider, and who you deal with for access to it. Providers who list a model agree to the terms for model providers.
• Updated 8 October 2026, effective the same day (section 4): model runs now execute in the United States. Your data is still stored in the European Union.
• Billing is not switched on yet, and no account has ever been charged. These terms take effect for fees only from the date real billing is switched on (section 3).
• "We" and "us" mean the contracting entity named in section 12.

1. What Craton is

Craton is software: an API-first, self-service platform for risk analytics and structuring, built around a canonical machine-readable risk object, and a registry of versioned models and data feeds. Everything it does, it does as software you call.

Craton outputs technical prices, never quotes; it drafts terms, never offers; it cannot bind, issue, endorse, claim or settle.

Craton is not a carrier, a broker or an MGA. It never sells cover, never touches paper, and is not a party to any contract of insurance or reinsurance. The paper, the counterparties and the decision are yours.

What the software serves, stated plainly so these terms are read against the real thing:

• Live today: ingest, analyse, price, structure, backtest, monitor and package, plus the model registry, its composition primitives and the no-code model builder.
• Analyse is live on every route the specification names for it: the point hazard lookup GET /hazard answers from a pinned public snapshot, the public event catalog and event footprints are served from the same pinned record, POST /objects/{id}/analyse runs both readings over an object and records the artifacts on its provenance, and POST /accumulation totals the exposure already stored on a set of your own objects: at portfolio level, per peril, per declared region and by concentration, never a schedule served back.
• Monitor is live on its first slice: you can record a structure as in force (which is your assertion about a transaction executed entirely outside Craton, and nothing Craton arranged, witnessed or is party to) and read the index against the newest pinned snapshot. Craton reports the measurement and never what follows from it: it decides nothing about anybody's obligations under any contract, is not the calculation agent of record for anything, notifies nobody and moves no money. Webhooks have no address on Craton.
• Package is live on its first slice: a submission pack assembled from the runs an object already carries, every document in it watermarked as a draft produced by analytics software. The draft slip is not one of its documents yet, and nothing in a pack is signed, accepted or executed here.
• The specification names seven verbs; Craton now has an address for each of them, on the slices named above and no wider.

2. Accounts and keys

Accounts are self-service: one unauthenticated call signs you up and returns your first key. No invitation, no approval queue, no payment details.

• You are responsible for what happens under your keys. Keep the secret safe: anybody holding it can call the API as you, and a secret this platform has handed out once is never shown again.
• One account per person or organization, and keys are not for sharing outside it.
• Tell us promptly if you think a key has leaked, so it can be retired.

3. Fees and billing

• Pricing is metered usage (per risk object and per model run), and it is self-service. There are no seat licenses and no negotiated contracts.
• A free sandbox tier exists and is meant to be enough to integrate against and to finish a real job on.
• Billing runs through an established payment processor. Craton never holds or moves money. Premium, losses and collateral never pass through this platform; fees for software usage are the only money flow it has.
• Today billing is in test mode. Usage is metered and readable back through the API, and no charge is possible until real billing is switched on, which is done by hand. These terms take effect for fees only from the date real billing is switched on.
• Tax. All prices are exclusive of taxes: sales, use, VAT or similar. Where such a tax applies to your use of the platform, it is yours to pay.
• Currency, invoicing and payment. Fees are billed in USD. Usage is invoiced monthly in arrears and charged automatically through the payment processor; invoices are due on receipt. The short invoice cycle you may see in test mode is a setting, not a term of this agreement.

4. Your data

• You keep your data. You grant Craton only the license it needs to run the verbs you call, to store the objects and results in your account, and to keep backups of them.
• We use your inputs to serve your requests and to run the platform: metering, debugging, security and abuse handling. We do not sell them.
• Do not send individual-level personal records. The platform is built for exposure and event data, not for data about identified people; the acceptable-use page states this as a rule.
• Published data feeds are aggregate only: triangles, tables and indices at portfolio level, never individual-level records.
• Roles. We are controller for account and billing data, processor for uploaded exposure data. For that data we act on your instructions, which are the verbs you call.
• Storage region. Your data is stored in the European Union (Finland): your account, your stored objects and your results. The email list on oncraton.com is kept separately, in the United States.
• Where model runs execute. A model run executes on a machine that a compute provider runs for Craton in the United States. The run's inputs go to that machine for that run only, and its inputs and working files are deleted from the machine when the run ends; the result is stored with your data, in the European Union.
• Address lookups. When you ask for an address lookup, only the text you typed is sent to a geocoding service: the US Census Bureau for US addresses, the OpenStreetMap Foundation's Nominatim service for the rest. The geocoding page has the details.
• Exposure coding. When you ask Craton to code or check rows of a schedule (the SOV coder or the multi-building row detector on oncraton.com, or POST /exposure-codes or POST /multi-building-flags), only the text of those rows is sent, for that request only, to an AI provider: Vercel's AI Gateway, which passes it to the service running TypeSafe's Jev model. That processing may take place outside the European Union, including in the United States, and the provider may keep the text for a time under its own terms; it does not train on it. Craton does not store the rows. Do not include personal data in them. The exposure coding page has the details.
• Models on the model exchange. A model on the exchange is run by its provider, on the provider's own platform, not by Craton. When you run one, the places and values you send for that run go to that provider, and nothing else from your account does. You are told so before every run. The provider handles them under its own terms and under the terms for model providers, under which it may use them only to run the model for you and must then delete them. Craton asks the provider's platform to delete its copy when the run ends, but does not control the provider's systems. An exchange provider is not a sub-processor of Craton's: you choose to send it your data. Do not run a provider's model on data you may not share with that provider.
• Sub-processors. A hosting provider, a network provider that carries traffic to the service, the payment processor, an on-demand compute provider for model runs, an AI provider (for AI-assist features, only while enabled), and geocoding services (only for address lookups you request). Those categories, and no others; the current named list is available from the contact address in section 13.
• Retention. Objects and results live as long as your account, plus the backup window. Deletion is by request today, to the contact address in section 13: there is no self-service route yet that erases an account. When an account is closed, its data is deleted 30 days after account closure.

5. What the outputs are, and what they are not

• Every technical price carries its assumption set (model versions, data vintages, event set, loadings, currency basis) on the face of the response. A number without its assumptions is not a Craton output.
• Terms the platform drafts are drafts, and are marked as drafts.
• Every result is labeled with the model and the version that produced it.
• The platform never ranks, recommends or endorses a model. Registry measurements are measurements; model cards carry authorship, assumptions and limitations.

Craton output is never a quote, never an offer, and never a binding commitment of any kind.

Not advice. Craton's outputs are analysis and drafts. They are not legal, regulatory, actuarial, tax or financial advice, they are not a substitute for your own judgment or your own advisers, and no output creates any duty on Craton's part towards you or towards anybody you show it to. What you do with a number this platform computes is your decision.

6. The registry

• Models you create are private by default.
• A published model version is immutable: a change is a new version, so a result anybody recorded can always be re-run against the exact thing that produced it.
• Publishing a model grants other users of the platform the right to run it and to read its card, under the license you declare on the card. You keep authorship.
• Models are deterministic against pinned data snapshots and make no network calls. That is enforced, not requested.
• A published version that breaches the acceptable-use page may be withdrawn from the public registry.

The model exchange. Providers list catastrophe models there that run on their own platforms.

• Craton checks each listing and its model card before it appears. It does not check or validate the model itself, and it never ranks the models listed.
• A model listed as free can be run by any account. For a model listed by grant, access, and any payment for it, are between you and its provider. Craton takes no payment for a provider's model and passes none on.
• Every result is labeled with the model, its provider and its version, and section 5 applies to it as to any other output. The provider's card states its assumptions and limitations.
• A provider can withdraw its model at any time, and Craton can withdraw a listing that breaches the acceptable-use page or the terms for model providers. Results you already have stay in your account.

7. The open schema

The canonical risk-object schema is open source, versioned, and usable with no account at all, under the license carried in the schema itself. The engine, the normalization that turns ugly files into canonical objects, and the hosted verbs are the paid part.

8. Availability and change

• There is no service-level commitment yet. One will be published on this page before it applies.
• Until then, environments may be reset and data on them cleared. Keep your own copy of anything you care about.
• The platform changes continuously. Where a change removes something you could rely on, it is announced in these docs before it lands, and the schema version tells you what you are speaking to.
• Notice. Once a service-level commitment is published, you get 30 days before a change that removes a documented capability takes effect. Until then, changes land as they are built, and this page says so rather than promising otherwise.

9. As-is, and liability

The platform is provided as it stands, without warranties of any kind, to the extent the law where you are allows that. Risk analytics is a modeling exercise: results depend on the data and assumptions declared with them, and neither this platform nor its outputs promise anything about what will actually happen.

The cap. Craton's total liability to you, on any theory and taken together, is capped at the fees paid in the 12 months preceding the claim.

Excluded. Indirect, consequential and special damages are excluded, however they arise.

Carve-outs. Neither the cap nor the exclusion applies to fraud, willful misconduct, anything the law does not allow to be excluded.

10. Suspension, and ending your use

• You may stop using Craton at any time. Metered usage already incurred stays payable once real billing is on.
• Access may be suspended or ended for a breach of the acceptable-use page, for a security reason, or where the law requires it. Where it is not urgent, you are told why first and given a chance to put it right.
• Sections 4, 5 and 9 survive the end of your use.

11. Changes to these terms

These terms are versioned, so every edit has a date. A material change is announced on this page with the date it takes effect; using the platform after that date is acceptance of the version then published.

12. Law, and disputes

The contracting entity ("we") is the operator of Craton. Its legal name and registered address are available from the contact address in section 13.

Governing law: the law of the State of Delaware. Venue: the state and federal courts sitting in Delaware, and you and the contracting entity each agree to that venue.

13. Contact

The address for legal and privacy notices, and for a request about your own data, is [email protected]. Abuse and security reports go to the same address. The acceptable-use page says so too, so a reader who lands on either page has it.

In effect from 18 August 2026; section 4 updated 23 September 2026; sections 4 and 6 updated 7 October 2026; section 4 updated 8 October 2026. Companion page: acceptable use.