These API Terms of Service ("Terms") govern your access to and programmatic use of the APIs, SDKs, developer sandboxes, software binaries, and screening endpoints provided by GAMPERLAB™ // Agentic Commerce Laboratory ("GAMPERLAB", "we", "us", or "our"), including all API access tokens or keys prefix-formatted as gl_live_... or gl_live_sandbox_....

By issuing API calls, downloading our SDKs, or generating an API key via our developer onboarding flow, you acknowledge that you have read, understood, and agree to be strictly bound by these Terms on behalf of yourself and the organization you represent. If you do not agree, you must not access or use our APIs.

---

1. Commercial Entity & Eligibility (Strict B2B Only)

The APIs, SDKs, and sandbox developer environments are made available strictly for business, commercial, and institutional developers (B2B), including banks, payment service providers (PSPs), acquirers, and enterprise technology platforms. Consumer access is explicitly excluded. You represent and warrant that you possess full corporate authority to bind your organization to these Terms.

2. Evaluation License & Permitted Use

Subject to continuous compliance with these Terms, GAMPERLAB grants you a revocable, non-exclusive, non-transferable, non-sublicensable, royalty-free license to access the APIs solely for:

• Evaluation & Technical Integration: Performing latency profiling, benchmarking, and architectural sandbox testing of Sanction Sieve™, Pattern Sieve™ and Silicon Sieve™ within your development and staging environments.
• In-Flight Pipeline Testing: Validating low-latency in-flight sidecar integration (< 40 µs), real-time sanctions screening (< 0.26 ms), Scheme penalty prevention (Visa VAMP / Mastercard TPE), and core banking mule transit canary holds (< 50 µs).

Commercial production traffic, live merchant clearing, or automated inter-bank transactions require a separate executed Master Services Agreement (MSA) or commercial contract.

3. Strict Prohibition of Reverse-Engineering & Algorithmic Integrity

You strictly agree that you shall NOT, directly or indirectly:

1. Decompile, disassemble, reverse-engineer, or attempt to reconstruct the underlying source code, binary trie layouts, sidecar modules, or cryptographic state machines of GAMPERLAB software.
2. Conduct model-inversion attacks, statistical probing, timing oracle attacks, or fuzzing aimed at extracting binary trie layouts, RAM-indexed fuzzy hash matrices, or in-flight correlation models.
3. Use the API outputs to train, benchmark, distill, or validate a competing transaction monitoring, Scheme compliance, sanctions screening, or core banking defense product without prior written consent.
4. Distribute, sublicense, lease, proxy, or sell API credentials or wrap the APIs in any third-party "white-label" interface.

3a. Strict Purpose Limitation: Exclusivity of Fraud Prevention & Absolute Ban on Ad Tracking

You explicitly covenant, represent, and warrant that you shall NOT, directly or indirectly:

• No Commercial Ad Tracking or User Profiling: Use screening results or transaction telemetry for commercial advertising, user tracking, behavioral profiling, ad targeting, retargeting, or advertising attribution.
• No Cross-Site or Cross-App Linking: Attempt to correlate, aggregate, or bridge risk signals across unrelated domains, merchants, or external applications to construct global commercial behavioral graphs.
• No Data Brokering or Ad-Tech Syndication: Resell, syndicate, stream, or disclose telemetry or screening receipts to advertising networks, data brokers, or marketing platforms.
• Strict Adherence to Regulatory Policies: Ensure all integrations strictly adhere to data minimization and privacy standards. Services may only be invoked within the authorized categories of transaction monitoring, fraud defense, AML/CFT compliance, Scheme penalty prevention, and core banking transit defense.

Remedies for Breach: Any violation of this Section 3a constitutes an irremediable material breach, resulting in immediate termination of API access, forfeiture of any remaining quotas, and immediate legal action for injunctive relief and damages.

4. Rate Limits, Quotas & Fair Use

Each developer sandbox key (gl_live_sandbox_...) is subject to strict quota enforcement:

• Volume Quota: Standard sandbox allowance is capped at 10,000 API calls per rolling calendar month.
• Burst Limit: Rate limits apply at a maximum of 50 requests per second unless higher concurrency has been provisioned. Exceeding limits results in immediate HTTP 429 (Too Many Requests) responses.
• Multi-Account Evasion Ban: Generating multiple accounts or spinning up temporary email domains to circumvent monthly sandbox thresholds constitutes material breach and leads to permanent IP blacklisting.

5. Regulatory & Sanctions Disclaimer (No Legal Advice)

Sanction Sieve™ operates as a high-velocity, in-memory compliance co-processor (< 0.26 ms), Pattern Sieve™ operates as an in-flight sidecar (< 40 µs), and Silicon Sieve™ operates as a core banking transit sentinel (< 50 µs). However:

• Sandbox Evaluation Disclaimer: Results delivered via sandbox or trial endpoints are provided for testing purposes only. Sandbox data is not guaranteed to mirror real-time OFAC, EU, UN, or UK-HMT sanctions gazette updates or active Scheme penalty thresholds.
• No Legal or Regulatory Warranty: GAMPERLAB does not provide legal or regulatory compliance advice. You remain solely responsible for your institution's statutory AML, CFT, BaFin, FMA, FCA, FinCEN, Visa, and Mastercard obligations. A screening verdict (e.g. SANCTION_CLEAR or CARD_TESTING_ALERT) does not constitute a legal release or formal audit clearance.

6. Credential Security & Client-Side Exposure

You are exclusively responsible for safeguarding your API keys:

• API keys must be stored in secure environment variables or vault managers (e.g., HashiCorp Vault, AWS Secrets Manager).
• Never expose secret API keys in public client-side JavaScript, mobile APKs, frontend GitHub repositories, or client web browsers. Client-side probes must use ephemeral session challenge tokens generated by your backend server.

7. Suspension & Immediate Termination

GAMPERLAB reserves the absolute right to suspend, throttle, or permanently revoke any API key without prior notice if:

• Our telemetry engine detects adversarial probing, botnet behavior, headless scraping, or denial-of-service patterns.
• You violate any intellectual property restriction or rate limit under these Terms.
• Required by judicial order or European financial regulatory directives.

8. Disclaimer of Warranties & Limitation of Liability

THE APIS AND SANDBOX SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• GAMPERLAB DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
• GAMPERLAB SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, DATA, REVENUE, OR BUSINESS OPPORTUNITY.
• FOR FREE DEVELOPER SANDBOX ACCOUNTS, GAMPERLAB'S AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS SHALL BE STRICTLY CAPPED AT ONE HUNDRED EUROS (€100.00).

9. Governing Law & Jurisdiction

These Terms shall be governed by and construed in accordance with the substantive laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG). For all disputes arising out of or related to these Terms, the courts of Augsburg, Germany shall have exclusive jurisdiction.