Terms of Service

Last Revised: October 23, 2025

These Terms of Service (“Terms”) govern your use of our services including Morph Cloud and Infinibranch, our cloud platform (the “Services”).

By using our Services, you agree to these Terms. If you’re using the Services for an organization, you’re agreeing to these Terms on behalf of that organization.

ARBITRATION NOTICE: EXCEPT FOR LIMITED TYPES OF DISPUTES DESCRIBED BELOW, DISPUTES BETWEEN YOU AND MORPH WILL BE RESOLVED BY BINDING, INDIVIDUAL ARBITRATION, AND YOU WAIVE YOUR RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION. YOU CAN OPT OUT OF ARBITRATION AS DESCRIBED IN “ARBITRATION AND CLASS ACTION WAIVER.”

Who may use the services

You must be at least 18 years old and have the legal capacity to enter into these Terms. The Services are not available in countries subject to U.S. trade restrictions. By using the Services, you represent and warrant that you meet these requirements.

Rights we grant you

We grant you a limited right to access and use the Services for lawful business purposes, including:

• Development and testing

• CI / CD workflows

• Data-science workloads

• Production applications

This right is non-exclusive, non-transferable, non-sublicensable, and subject to these Terms and our Acceptable Use Policy (Exhibit A).

You may interact with the Services via our APIs / SDKs / CLI. You may create VM Snapshots and branch new running environments (“Instances”) from them as well as consume related services provided through Morph Cloud.

We may improve or change features. During any committed billing term, we will not materially reduce core functionality without either an equivalent workaround or your right to terminate the affected feature with a pro-rata refund of prepaid, unused fees.

Restrictions on your use of the services

Use the Services responsibly. You agree not to:

• Break the law or violate others’ rights.

• Access accounts/systems you’re not authorized to access; bypass or interfere with security or access controls.

• Upload regulated/sensitive data (for example, PHI, children’s data, cardholder data, export-controlled technical data) without a signed addendum that permits it.

• Spam, phish, or distribute malware.

• Scrape outside documented APIs or exceed rate limits; overload our systems.

• Reverse engineer the Services (except where this restriction is prohibited by law).

• Use Non-Public Information to build a directly competitive snapshot / branching cloud; Morph may seek injunctive relief.

• Publish public benchmarks without our prior written consent (internal testing is fine).

• Misrepresent machine-generated output as “human-generated.”

We may monitor control-plane usage for trust and safety and may suspend or terminate access to protect customers, the platform, or to comply with law. We do not monitor the contents of your Instances.

Ownership and content

• Our platform. We and our licensors own the Services, including the Infinibranch snapshot / branch engine, schedulers, orchestration, and related software and documentation.

• Usage data. We may collect telemetry about use and performance (for example, API calls, resource consumption, errors). We may use and share aggregated / de-identified analytics, but not in a way that identifies you or reveals your trade secrets, and not to compete with your products.

• How we operate the platform. The Services run primarily at the control-plane level. In the ordinary course, we act on orchestration signals and service health metrics and do not inspect the contents of your running environments.

Limited exceptions. We may access or inspect Customer Runtime Data (as defined in Exhibit B) only:

• when you expressly request support and enable a time-bound access path,

• to investigate, mitigate, or confirm a suspected security incident affecting the Services or your Instances, or

• when required by law or valid process.

Any such access is performed by authorized personnel under confidentiality, is logged, limited to the minimum necessary, and does not use persistent access paths. Any artifacts generated for diagnosis (for example, traces or dumps) are encrypted, retained only as long as needed for the stated purpose, and then deleted per our retention schedule.

• Runtime data stays in your environments. Disk, memory, and application payloads within your Instances (“Customer Runtime Data,” defined in Exhibit B) are not accessed or viewed by Morph personnel except (a) when you expressly request help and grant time-bound access, or (b) when required by law. Any such access is logged and limited to the minimum necessary.

Fees and payment

How fees work. Fees are based on your usage as shown in your dashboard or Order. Typical components may include but are not limited to compute, snapshot storage, and egress. Paused instances incur only storage charges. Unless your Order says otherwise, fees are non-refundable.

Price changes. We may update prices with 30 days’ notice by email to Admin Contacts and a dashboard banner. If cumulative increases exceed 15% in a rolling 12-month period, we will give 60 days’ notice. If a change materially affects you, you may terminate impacted Services before it takes effect for a pro-rata refund of prepaid, unused fees. If a third-party provider imposes a surcharge or regulatory fee outside our control, we may adjust affected charges with as much advance notice as practicable.

Admin Contacts (designation). “Admin Contacts” means the notification email(s) designated in your account’s Billing settings. Notices sent to those associated with your Admin Contacts addresses are deemed received.

Taxes. Prices exclude taxes; you are responsible for applicable taxes other than our income taxes.

Data processing and security

Security commitments. We implement and maintain industry-standard administrative, technical, and physical safeguards appropriate to the risk, including: encryption in transit / at rest; multi-factor authentication for production access; least-privilege access; network segmentation and protective monitoring; secrets management; vulnerability management and timely patching; audit logging / monitoring; and incident response. We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with updates as information becomes available. Upon request, we’ll provide available third-party security attestations (e.g., SOC reports) under appropriate confidentiality.

Content-agnostic operations. Our standard monitoring uses control-plane and network service telemetry (for example, API success rates and resource saturation). We do not scan your file systems or memory, perform deep packet inspection, or otherwise analyze Customer Runtime Data. Snapshots you create are encrypted at rest and are not browsed by staff.

Support access. If you ask us to assist inside an Instance, we’ll use a break-glass path you enable, time-box access, and record the session. You can revoke access at any time.

Questions about data handling or security? Email support@morph.so.

Term and termination

These Terms start when you first access the Services and continue until ended.

• Convenience (monthly): Either party may end a month-to-month plan effective the next billing cycle.

• Breach: Either party may end these Terms for material breach if not cured within 30 days after notice.

• Insolvency: Either party may end if the other ceases operations or enters insolvency not dismissed within 60 days.

We may suspend or limit access immediately if your use poses a security risk, harms the platform or others, creates legal risk, violates our AUP, is fraudulent, or for non-payment. We will notify you and work to restore access once resolved. If the suspension is not caused by your breach, we will equitably adjust or credit fees for the impacted period.

When the Services end, you must stop using them. Sections that by nature should survive (e.g., fees due, ownership, confidentiality, privacy/security links, disclaimers, limits, dispute resolution) will continue to apply.

Warranty and support

Authority. Each party represents and warrants that it has the authority to enter into these Terms and will comply with applicable law.

Service warranty. When used by Customer in accordance with these Terms and the Documentation, the Services will perform, in all material respects, as described in the Documentation during the Term. Beta/preview features are provided AS IS and are excluded from this warranty.

Exclusive remedy. Customer’s sole and exclusive remedy for any breach of the foregoing warranty (or for any service shortfall) is, at Morph’s option:

• correction or re-performance of the non-conforming portion of the Services within a reasonable time; or

• issuance of a service credit (if credits are specified in Customer’s Order or any applicable SLA).

No other remedies (including refunds or damages) apply to warranty or availability issues.

Disclaimer. EXCEPT FOR THE LIMITED WARRANTY ABOVE, THE SERVICES (AND ANY RELATED MATERIALS OR THIRD-PARTY COMPONENTS) ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. MORPH DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT THEY WILL OPERATE IN COMBINATION WITH NON-MORPH SYSTEMS EXCEPT AS EXPRESSLY DESCRIBED IN THE DOCUMENTATION.

Support. Support levels and response targets (if any) are as set forth in Customer’s Order or the Documentation. If a separate SLA is attached to the Order, that SLA controls with respect to any service-credit mechanics.

Disclaimers, limitations of liability and indemnification

Disclaimers. EXCEPT AS EXPRESSLY STATED IN THESE TERMS OR AN APPLICABLE ORDER OR SLA, THE SERVICES (INCLUDING THIRD-PARTY SERVICES AND OUTPUTS) ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT UNINTERRUPTED OR ERROR-FREE SERVICE OR THE ACCURACY/COMPLETENESS OF MATERIALS/OUTPUTS. WE MAY CHANGE THE SERVICES AT ANY TIME.

Limitations of liability. WE AND YOU WILL NOT BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES (INCLUDING LOST PROFITS, LOST DATA, OR BUSINESS INTERRUPTION), EVEN IF ADVISED. EXCEPT FOR:

• IP indemnity obligations;

• breach of confidentiality or data-security obligations;

• fees you owe; or

• willful misconduct or gross negligence;

EACH PARTY’S TOTAL LIABILITY IS CAPPED AT THE AMOUNTS PAID OR PAYABLE BY YOU TO MORPH IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. THESE LIMITS ARE A FUNDAMENTAL BASIS OF OUR BARGAIN AND APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.

Indemnification.

• By you. You will defend and indemnify us against third-party claims and related losses arising from your breach of these Terms or the AUP, your use of the Services (including your code / data / outputs), your content, your violation of law, or your gross negligence or willful misconduct.

• By us (IP). We will defend and indemnify you against third-party claims that the Services as we provide them infringe a patent, copyright, or trade secret, and will pay final damages and reasonable attorneys’ fees. This does not apply to claims arising from your content/code, combinations / modifications we did not provide, your use contrary to documentation, or Third-Party Models unless your Order expressly passes through a provider’s indemnity. We may procure rights, modify, or replace the impacted functionality; if none is commercially reasonable, we may terminate the affected feature and refund prepaid, unused fees.

• Process. The indemnified party must promptly notify the other, reasonably cooperate, and allow control of the defense and settlement (no settlement imposing non-monetary obligations or admissions without written consent).

Arbitration and class action waiver

Arbitration. Except for small-claims disputes and claims for injunctive relief (for example, misuse of confidential or Non-Public Information), disputes will be resolved by confidential, binding arbitration administered by JAMS in San Francisco, California, before one arbitrator, under its commercial rules. California law governs these Terms, without regard to conflict-of-law rules. Judgment may be entered in any court with jurisdiction.

Opt-out right. You may opt out of arbitration by emailing ops@morph.so within 30 days of first using the Services. Include your name, the email for your account, and a clear statement that you opt out of arbitration. Opting out does not affect your ability to use the Services.

Class action waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, YOU AND MORPH AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. CLASS ARBITRATIONS AND CLASS ACTIONS ARE NOT ALLOWED.

General provisions

Confidentiality. Each party may receive confidential information of the other. The receiving party will protect it using at least the same degree of care it uses for its own similar information (not less than reasonable care), use it only to provide or receive the Services, and disclose it only to personnel/contractors under confidentiality and with a need to know. Exceptions apply for information that is already known without obligation, independently developed, lawfully received from a third party, or public through no fault. On request, return or delete confidential information (standard backup/legal-hold exceptions apply). Unauthorized use of Non-Public Information or Customer Runtime Data for competing services may cause irreparable harm; Morph may seek injunctive relief.

Publicity. Customer hereby authorizes Morph Labs, Inc. (“Morph”) to identify Customer as a Morph customer and to use Customer’s name, mark, and / or logo on Morph’s website and in Morph’s marketing materials in connection with such identification. In addition, Customer agrees to participate in reasonable publicity activities, such as a case study, customer quote, and joint press release, as further described in the applicable Order or Service Description.

Acceptable Use. See Exhibit A.

Technical Terms. Definitions (for example, Non-Public Information, Customer Runtime Data), Snapshot / Instance specs, per-second billing detail, and API limits are in Exhibit B.

Changes to these Terms. We may update these Terms. We will update the “Last Revised” date and provide reasonable notice of material changes—email to your Admin Contacts and a dashboard banner at least 15 days before the effective date (not including urgent security or legal fixes). If a change materially harms you, you may terminate impacted Services within 30 days for a pro-rata refund of prepaid, unused fees.

Assignment. You may not assign these Terms without our consent, except to an affiliate or as part of a merger, acquisition, or sale of substantially all assets; assignments to a direct competitor of the non-assigning party require prior written consent not unreasonably withheld.

Relationship; entire agreement; severability; waiver. We are independent contractors. These Terms (plus any Order and Exhibits) are the entire agreement and supersede prior discussions. If a provision is unenforceable, we will modify it to achieve its intent as much as the law allows; the rest remains in effect. Waivers must be in writing.

Trade controls (AI-specific). You will comply with export, re-export, and sanctions laws (for example, OFAC, EAR). You will not export / re-export the Services, Snapshots, Instance artifacts, encryption keys, or technical documentation to prohibited destinations, end-users, or end-uses (including military end-use restrictions) without authorization, and you will not use the Services for prohibited AI end-uses (for example, development of WMDs or unlawful mass surveillance targeting protected classes). You represent you are not a restricted party and not 50%+ owned/controlled by such party.

California residents. Under California Civil Code § 1789.3, you may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N-112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

How to contact us

Questions about these Terms or the Services?
Email: Ops@morph.so
Address: Morph Labs, Inc., 2565 3rd Street, San Francisco, CA 94107, USA

Exhibit A — Acceptable Use Policy (AUP)

• Don’t use the Services for illegal purposes or to violate others’ rights.

• Don’t upload regulated/sensitive data without a signed addendum.

• Don’t spam, phish, or distribute malware.

• Don’t scrape outside documented APIs or exceed rate limits; don’t overload our systems.

• Don’t reverse engineer the Services (except where this restriction is prohibited by law).

• Don’t use Non-Public Information to build a directly competitive ; we may seek injunctive relief.

• Don’t publish public benchmarks without our prior written consent (internal testing is fine).

• Don’t send us secrets in support tickets unless strictly necessary; redact where possible.

• Don’t grant persistent administrative access; when support access is needed, use the time-bound path we provide and revoke when done.

We may investigate suspected violations and may suspend or terminate access for AUP breaches.

Exhibit B — Technical Terms

Non-Public Information. Confidential and other non-public performance, architectural, scheduler, or snapshot / instance lineage metadata, API traces, or implementation details of the Services not generally known outside Morph.

Customer Runtime Data. Data at rest or in memory within your running Instances (including file systems, process memory, and application payloads), as distinct from control-plane metadata and service telemetry.

Snapshot / Instance specs.

• Snapshot: full-state VM checkpoint (RAM / CPU / FS / kernel).

• Instance: running environment derived from a Snapshot; near-instant resume under documented conditions.

• Snapshots you create are encrypted and stored without Morph staff browsing of contents. Instance operations rely on lineage metadata; routine operations don’t require viewing in-VM data.

Billing detail.

• Per-second compute; per-operation Snapshot / Instance charges; snapshot / lineage storage (GB-hour); egress. Paused instances incur only snapshot / storage charges. Pass-through costs may apply if third-party surcharges or regulatory fees are imposed.

API limits.

• Auth, rate limits, concurrency, and region availability per documentation. Abuse or overages may trigger throttling or suspension.