Terms of Service

1. Acceptance

By creating an account on RunKey.ai ("RunKey", "we") or using any part of the service, you agree to these terms. If you do not agree, do not use the service. If you are using RunKey on behalf of an organisation, you confirm you may bind that organisation to these terms.

2. What RunKey provides

RunKey rents GPU compute, metered by the second. You choose a GPU model and the node it runs on, we start an instance for you, and you get root access to it over SSH for as long as you keep it running.

The capacity is sourced from third-party GPU marketplaces and operated by independent node operators, not by us. We select the nodes, hold the price and run the console; the underlying hardware belongs to someone else. This has two consequences worth stating plainly: a specific node is never guaranteed, and an instance can be lost if the node it runs on goes away.

Every instance boots the same image — Ubuntu with the NVIDIA CUDA stack and an SSH server — and installs a management panel reachable through a tunnel. Anything else on the instance is installed by you.

3. Your account

You must give an accurate email address, be at least 18 or the legal age where you live, and keep your credentials and SSH keys to yourself. Activity under your account, and anything running on instances deployed from it, is your responsibility.

One account is one customer. You may not share an account to work around per-account limits, and you may not create accounts to evade a suspension.

4. Credits and pricing

RunKey is prepaid. You buy credits in packs; instances spend them. There is no subscription and no invoice at the end of the month.

• Each GPU model has a fixed credit rate, published in the console and on the pricing page. It does not float with market supply.
• Metering runs by the second, from the moment an instance reports running until it is terminated. There is no minimum billable period and no rounding up to the hour.
• An instance that never reaches the running state costs nothing. A terminated instance stops costing immediately.
• Credits do not expire, and unused credits stay on the account until they are spent.
• A deploy requires at least one hour of that instance's rate on your balance. When a balance reaches zero, running instances are terminated automatically. Keeping enough balance for the work you have running is your responsibility, and everything on an instance terminated this way is lost with it.

We may change pack prices, GPU rates and the catalogue at any time. A change takes effect from when it is published; credits already bought keep the number of credits they bought.

5. Payments and refunds

Payments are taken by third-party payment providers. You are handed to the provider's own page to pay, and RunKey never receives or stores your card details. The provider holds the price for the pack; we tell it which pack you chose, not what to charge.

How many credits a payment is worth is decided by RunKey from the pack recorded when the purchase started, not from anything the provider sends back. Credits are added once the payment is confirmed.

Credit purchases are otherwise non-refundable, and unused credits are not exchangeable for money. Two exceptions, because they are our doing and not yours:

• If the same purchase is paid twice — most often by starting a payment with one method and completing it with another — only one lot of credits is delivered and the duplicate charge is refunded.
• If a payment is taken and the credits cannot be placed on an account, we refund it rather than keep it.

If a payment is disputed or reversed with the provider, we may remove the corresponding credits and suspend the account while it is sorted out.

6. Your instance, your data

You get root on the instance. What you install, what you run and what you put on the disk is yours to manage and yours to be responsible for, including under any licence attached to models, datasets or software you bring.

There are no backups and no snapshots. When an instance is terminated — by you, by the automatic zero-balance termination, by us, or by the node failing — its disk is destroyed and the data is gone. Anything you need has to be copied off before then.

An instance runs on real hardware on the public internet, operated by a third party. Do not put data on it that you could not accept a node operator having access to, and do not expose services on it without authentication.

7. Prohibited use

This section says what RunKey is not for. It is a list of prohibitions, not a list of permissions: nothing here should be read as approval of anything merely absent from it, and a use that is plainly abusive is prohibited whether or not it is named below.

It covers everything done from your account — by you, by anyone you hand credentials or SSH keys to, and by the users of any service you build on an instance. If you run something for other people, their conduct is yours to answer for here.

7.1 Unlawful use

You may not use RunKey for anything unlawful where you are, where we are, or where the node is — and the node may sit in a country you did not choose. You also may not use it in breach of export control or sanctions law, from a sanctioned jurisdiction, on behalf of a sanctioned or listed party, or to work toward weapons of any kind, including chemical, biological, radiological, nuclear and autonomous weapons, or to build material uplift toward them.

7.2 Attacks and network abuse

An instance may not be pointed at anyone who did not ask for it. No:

• Port scanning, vulnerability scanning, fuzzing or enumeration of hosts, networks, applications or accounts that are not yours.
• Denial of service in any form — packet floods, amplification and reflection, application-layer exhaustion, or lending the instance to a "stresser" or "booter" service that does it for others.
• Intrusion and exploitation: breaking into systems, escalating privilege on them, brute force and credential stuffing against logins, SSH, RDP, VPNs, APIs or wallets, and offline cracking of hashes, keys or seed phrases that are not yours to crack.
• Command-and-control servers, botnet infrastructure, ransomware operations, stealer panels, exploit kits and malware staging or delivery.
• Spoofed source addresses, route or DNS tampering, traffic interception, and running services that can be reflected off — open DNS resolvers, NTP, memcached and the like.
• Open proxies, anonymising relays, exit nodes and VPN endpoints operated for other people, or anything else whose purpose is to launder where someone else's traffic came from.
• Scraping or automated access that ignores a site's terms, its robots controls or its rate limits, or that is heavy enough to be a denial of service under another name.

Security work is allowed only against targets you own or are authorised in writing to test.Cracking your own hashes, scanning your own range, training a model for defensive research — all fine. If a complaint arrives about traffic from your instance, we will ask you for that authorisation, and a pentest that cannot produce one is handled as the attack it looks like from the other end.

7.3 Cryptocurrency mining and proof-of-work

Mining is prohibited outright — every GPU model, every scale, every disguise. That includes:

• Mining any coin or token on the GPU, the CPU or in memory, solo or in a pool, in the foreground or "only while the box is idle".
• Proof-of-work of any kind, plotting and farming (Chia and similar), hashing for a rewards network, and renting, pooling or reselling hash power.
• Running pool software, stratum proxies or mining relays, and paid-per-unit-of-compute validator, sequencer or proving workloads — a zk-proving farm counts as mining for this purpose.
• Hiding any of the above inside something else: a renamed binary, a mining thread in a training container, a "benchmark" that happens to pay out, or a dependency you installed and did not read.

This is not a matter of taste. The price is fixed per GPU model because the hardware is expected to do compute; the upstream marketplace and the node operators ban mining in their own terms; and one mining workload gets a node pulled out from under every tenant on it. Mining means immediate termination without notice, closure of the account, and no refund of the credits on it — and concealing it is treated as fraud rather than as a rule broken by accident.

7.4 Spam, phishing and malicious software

• Bulk unsolicited email, SMS or messaging of any kind, mailer and relay software sending it, and the harvesting, scraping or validation of address lists to send it to.
• Phishing in all its forms: fake login and checkout pages, brand impersonation, smishing and vishing kits, and the hosting of pages, domains or redirectors that support them.
• Writing, building, hosting, distributing or mass-testing malware — ransomware, keyloggers, stealers, remote access trojans, stalkerware, droppers, cryptors and packers built to evade detection.
• Click fraud, ad fraud, install fraud and synthetic traffic; mass account registration, CAPTCHA-solving farms, engagement and follower farms, scalping bots, and fake review or rating operations.
• SEO spam, doorway pages and link farms.

Outbound mail from an instance is a poor idea in general: the address belongs to a node operator, carries a reputation you did not build, and a spam complaint against it lands on someone else. Use a mail provider.

7.5 Copyright, licences and content you have no right to

You must hold the rights to everything you bring to an instance and everything you do with it — code, datasets, model weights, media, fonts and whatever you produce from them. In particular, no:

• Hosting, distributing, seeding or streaming infringing material — films, television, music, books, games, courses or software — and no trackers, seedboxes, mirrors or release infrastructure serving it, whatever the box is called.
• Cracked, pirated or unlicensed software, including commercial software run outside what its licence allows, and no circumventing DRM, licence checks, activation or copy protection. No stream-ripping services.
• Use of model weights or datasets outside their licence. Research-only, non-commercial, no-derivatives, named-user and no-redistribution terms bind you here as they do anywhere else, and putting a weight behind a public endpoint can itself be a redistribution.
• Training, fine-tuning or evaluating on material you have no right to use that way, including paywalled corpora, leaked datasets, and data scraped in breach of the terms that covered it.
• Stripping watermarks, attribution, provenance signals or licence notices from anything.
• Trademark infringement, counterfeit storefronts, or passing your output off as another company's.

Rights-holders can send a notice to support@runkey.ai identifying the material, where it is being served from, and their authority to act. We act on notices at the level we have — the instance is terminated rather than its disk edited — and repeat infringement closes the account. If you think a notice against you is mistaken, reply to it and say why.

7.6 Adult and NSFW content

Adult or NSFW content of any kind is prohibited. No pornographic, sexually explicit, nude or otherwise not-safe-for-work material — generating it, training or fine-tuning on it, storing it, processing it, or serving it to anyone else. This applies to real and synthetic subjects alike, to drawn and animated work, and to anything built to produce such material even when the instance itself is only being used to develop or host it. Child sexual abuse material and non-consensual intimate imagery are additionally criminal, reported to the authorities, and grounds for immediate closure.

7.7 Impersonation, deepfakes and synthetic media

No deepfakes, face swaps, voice cloning or synthetic likenesses of a real person made to deceive, defraud, harass or sexualise them; no synthetic voice or video used for fraud calls, romance scams or "the CEO asked for a transfer"; no defeating identity verification, liveness or biometric checks; no forged identity documents, credentials or records; and no coordinated inauthentic accounts or manufactured personas for political, commercial or reputational manipulation. Consented, labelled synthetic media — your own voice, an actor who agreed, a client who commissioned it — is not what this is about.

7.8 Harm to people

Nothing on RunKey may be used for harassment, threats, doxxing, stalking or stalkerware; hate against people for who they are; terrorist or violent extremist material and recruitment; incitement to violence or self-harm; human trafficking or exploitation; unlicensed gambling; drug or weapons marketplaces; or anything at all that sexualises, endangers or targets minors.

7.9 Fraud and financial abuse

No carding, BIN testing or bulk validation of stolen payment details; no money laundering or its infrastructure; no forged documents, invoices, statements or KYC bypass; no Ponzi, pyramid or investment-scam operations; no market manipulation, pump-and-dump or wash-trading bots; no account-takeover tooling; and no trading in stolen credentials, breach dumps or scraped personal data.

7.10 The platform, the node and other tenants

Your instance is yours, and it stops where the next tenant begins. You may not:

• Interfere with our systems, the console, the API, the management panel, its tunnel, the startup script or the metering — including forging or replaying panel tickets, or tampering with what an instance reports about itself.
• Reach for another customer's instance, another tenant's processes on the same node, the node's own host tooling, or anything outside what your instance was given.
• Work around automatic zero-balance termination, keep a workload alive after the instance it belongs to has been terminated, or otherwise attempt to obtain compute you have not paid for.
• Run something whose resource use destabilises the node or degrades its other tenants, or expose an unauthenticated public service on an instance.
• Hold more than one account to get around per-account limits, evade a suspension, or claim promotional credit more than once; and no chargeback abuse — disputing a payment for compute you actually used.
• Resell or sublet RunKey capacity as your own product without a written agreement with us. Where we do agree to it, the conduct of everyone you sell to is still measured against this section.

7.11 Data you should not put on an instance

An instance is a rented box on someone else's hardware, on the public internet, with no backups and with a node operator who has physical access. RunKey is not certified for regulated data and does not sign the agreements that go with it: no protected health information under HIPAA, no cardholder data under PCI DSS, no classified or export-controlled technical data, and no special-category personal data unless you have a lawful basis for it and can actually implement the controls it needs on hardware you rented by the hour. Where you do process other people's personal data, you are the controller for what sits on your instance and we are not your processor for it.

7.12 Rules that are not ours

The upstream marketplace and the node operator have their own acceptable-use rules, and they apply to your instance in addition to these. They are sometimes stricter than ours and we do not control them. A workload that gets a node suspended upstream is stopped here too, whether or not this page named it.

7.13 Reporting, enforcement and consequences

Report abuse to support@runkey.ai with the address involved, the timestamps and time zone, and enough log detail to identify the traffic. We do not monitor what runs on an instance — we see billing, metering and what reaches us from upstream — so enforcement follows reports, upstream signals and legal process rather than inspection.

The response is scaled to what was found: a question, a warning, termination of the instances involved, suspension of the account, or closure of it under section 9. Where there is real harm or a live risk — child sexual abuse material, an attack in progress, mining, a demand from upstream, an order from law enforcement — we act first and explain afterwards. Credits on an account closed for breaking this section are not refunded, and we may keep and disclose records where the law requires it. Anything a third party claims against us because of what you ran is yours to cover.

8. Availability

We do not offer an uptime guarantee or an SLA. Capacity depends on an upstream marketplace, hosts appear and disappear, and an instance can fail for reasons outside our control. RunKey is suitable for development, training and batch work; it is not sold as fault-tolerant production hosting.

You are not charged for an instance that never ran, and metering stops when an instance stops. Beyond that, lost time on an instance is not compensated.

9. Suspension and termination

We may suspend an account, terminate running instances, or close an account if these terms are broken, if a payment is reversed, or if a workload puts the platform, a node or another customer at risk. Where the situation allows it, we will say what happened and why.

You can stop using RunKey at any time; terminating your instances is what stops the spending. Closing the account is yours to do, in Settings, once nothing is running on it — and credits left on a closed account are forfeited, as with any other refund. Records we have to keep for accounting and fraud purposes are kept, as described in the privacy policy.

10. Intellectual property

Everything you bring to an instance, and everything it produces, is yours. We claim no rights over it and do not use it for anything but running the service. RunKey's own software, branding and documentation remain ours.

11. Limitation of liability

The service is provided as-is. To the maximum extent the law allows, RunKey is not liable for indirect, incidental, special or consequential damages, including lost profits, lost work, or data destroyed with a terminated instance. Our total liability for any claim is limited to what you paid us in the twelve months before it arose.

12. Changes to these terms

We may update these terms. The current version always lives on this page with the date it was last changed at the top, and continuing to use RunKey after a change means accepting it. For a change that materially affects what you have already paid for, we will make sure it is visible before it takes effect.

13. Contact

Questions about these terms go to support@runkey.ai, or through the contact page.