Skip to content

Subscription Agreement

Last updated 2026-10-13 · Version 1.0

In short: month-to-month subscription, billed per managed device per day. You own your data. You are responsible for telling the people whose devices you manage, and for the commands you send to those devices. Our total liability is capped at the fees you paid in the previous 12 months. Delaware law applies. The contract FAQ explains the main points in plain language; this agreement is what governs.

This Subscription Agreement (the “Agreement”) is between Xavier Device Management LLC, a Delaware limited liability company (“Xavier”, “we”, “us”), and the organization that creates a Xavier account or signs an Order (“Customer”, “you”).

By clicking to accept this Agreement, starting a trial, signing an Order that references it, or using the Service, you agree to it. If you accept on behalf of an organization, you confirm that you have authority to bind it. If you do not have that authority or do not agree, do not use the Service.

1. Definitions

  • “Service” means Xavier’s hosted device management service, including the admin console, APIs, the MCP server, device agents and apps, and related documentation, as we provide them from time to time.
  • “Order” means the online signup flow, an in-product plan selection, or a written order form or quote signed by both parties, that refers to this Agreement.
  • “Tenant” means your organization’s isolated instance of the Service, reached at your organization’s subdomain.
  • “Authorized Users” means your employees and contractors to whom you give a console or API account, MCP token, or other access to your Tenant.
  • “Managed Device” means any computer, phone, tablet, TV, display, or other device enrolled in or reporting to your Tenant by any method (MDM enrollment, device agent, or Android management).
  • “End User” means any person who uses a Managed Device or whose information is in your Tenant, including people imported from your identity provider.
  • “Customer Data” means all data that you, your Authorized Users, or your Managed Devices submit to the Service or that the Service collects from your Managed Devices on your behalf, including personal data about End Users.
  • “Third-Party Platform” means a product or service not provided by Xavier that the Service relies on or connects to, including Apple (Apple Push Notification service, Apple Business Manager, Apple School Manager, Volume Purchase Program), Google (Android, Google Workspace), Microsoft (Windows, Microsoft Entra ID), Samsung Knox, identity providers, package sources, and any AI client or alerting service you connect.
  • “Customer-Hosted Components” means storage, databases, networks, and other infrastructure that you provide and connect to the Service, such as your own S3-compatible or Google Cloud Storage account, or your own MongoDB database (self-hosted or in your own MongoDB Atlas account).
  • “Documentation” means the product documentation at xavier-dm.com/docs.

2. Documents that form this Agreement

This Agreement incorporates the following policies, each as updated under Section 18:

The Privacy Policy and Security Overview are provided for information and are not part of this Agreement, except where the DPA refers to them. If documents conflict, this order applies: (a) a signed Order, only for the specific terms it expressly changes; (b) the DPA, for the processing of personal data; (c) this Agreement; (d) the other incorporated policies.

3. The Service

3.1 Access

Subject to this Agreement and payment of fees, we grant you a non-exclusive, non-transferable right during the subscription term to access and use the Service, and to install our device agents and apps on your Managed Devices, for your internal business purposes.

3.2 Accounts

You are responsible for your Authorized Users and everything done through their accounts and tokens, for keeping credentials confidential, for assigning roles appropriately, and for promptly revoking access that is no longer needed. Tell us promptly if you believe your Tenant has been accessed without authorization.

3.3 Changes to the Service

We continually improve the Service and may add, change, or remove features. During a paid billing period we will not materially reduce the core device management functionality or the overall security of the Service, except as required by law, by a Third-Party Platform (Section 9), or to address a security risk.

3.4 Beta features

Features labeled beta, preview, early access, or similar are provided “as is”, are excluded from the Service Level Agreement, and may be changed or withdrawn at any time.

4. Free trial

We may offer a free trial for the length and with the device and user limits shown at signup. During a trial:

  1. the Service is provided “as is”, without the Service Level Agreement, warranties, or indemnities, and with support on a best-effort basis;
  2. no fees are charged unless you choose a paid plan; and
  3. if you do not choose a paid plan before the trial ends, management is removed from your Managed Devices when the trial ends, and your Tenant and Customer Data are deleted after the grace period shown at signup. Backup copies expire as described in Section 13.3.

5. Fees and payment

5.1 Fees

Fees are charged per Managed Device per month at the rate shown at signup or in your Order. Unless an Order says otherwise, the same rate applies to every platform.

5.2 How usage is measured

Once each day we record the number of billable Managed Devices in your Tenant. A Managed Device is billable on a day if it is enrolled or reporting to the Service and has checked in within the previous 30 days. Device records synchronized from Apple Business Manager or Apple School Manager that have not enrolled are not billable. Each month’s fee is the sum, across the days of the month, of that day’s billable device count multiplied by one day’s share of the monthly rate (the monthly rate divided by the number of days in the month). If a daily count is unavailable because of a fault on our side, we may use the previous day’s count for up to three consecutive days; days beyond that are not charged. Removing a device from your Tenant stops it being billed from the next day.

5.3 Invoices and payment

We invoice monthly in arrears, in US dollars, on or shortly after the first day of each month. If you pay by card, you authorize us (through our payment processor) to charge the card on file for each invoice when it is issued, and to retry failed charges. Otherwise, invoices are due within 30 days of the invoice date. Fees for usage already incurred are non-cancellable and non-refundable.

5.4 Taxes

Fees exclude taxes. You are responsible for all sales, use, value-added, withholding, and similar taxes on your purchases, other than taxes on Xavier’s net income. If we are required to collect a tax, we will add it to your invoice.

5.5 Late payment

If an undisputed amount is more than 15 days overdue, we may, after giving you at least 7 days’ written notice, suspend the Service until it is paid. Days on which your Tenant is suspended are not billed. If you dispute an invoice in good faith, tell us before the due date and pay the undisputed portion; we will work with you to resolve it.

5.6 Price changes

We may change our rates by giving at least 30 days’ notice. A change applies from the first full billing month after the notice period ends. If you do not accept the change, you may cancel under Section 13.1 before it takes effect. Rates fixed in a signed Order do not change during the term stated in that Order.

6. Customer Data

6.1 Ownership

As between the parties, you own Customer Data. You grant Xavier a worldwide, limited license to host, copy, transmit, and process Customer Data only as needed to provide, secure, and support the Service, to prevent or address technical or security problems, and as otherwise permitted by this Agreement and the DPA.

6.2 Personal data

The DPA governs our processing of personal data in Customer Data. We act as your processor (or service provider) for that data.

6.3 Usage data

We may collect and use information about how the Service operates and is used (such as performance metrics, error information, and feature usage) to provide, secure, and improve the Service. We may use and share such information only in aggregated or de-identified form that does not identify you, any End User, or any individual.

6.4 Your responsibility for Customer Data

You are responsible for the accuracy and lawfulness of Customer Data and for having all rights, notices, and consents needed for Xavier to process it under this Agreement.

6.5 Where Customer Data is stored

The Service is operated from the United States. Unless you keep your Tenant’s data in your own database (Section 10.2), Xavier stores it, and its backups, in the United States or, if your Order specifies another storage region that Xavier offers, in that region. Wherever your Tenant’s data is stored, Xavier processes it in the United States to provide the Service. The records Xavier keeps to run your account, such as your organization’s name, the account holder and billing contact, billing and usage records, and records of your acceptance of this Agreement, are stored in the United States. You may ask us to move your Tenant’s data to another storage region we offer; we will agree the timing with you, and a move is scheduled maintenance under the Service Level Agreement.

7. Device management responsibilities

The Service gives you powerful control over devices and visibility into how they are used. You acknowledge and agree that:

  1. Authority over devices. You will enroll and manage only devices that you own or are otherwise legally authorized to manage.
  2. Notice and consent. Before enabling a feature that collects information about End Users, you will give them all notices and obtain all consents and approvals required by applicable law, including employee-monitoring notice laws and any obligations to consult works councils or employee representatives. This applies in particular to location collection, application usage, network and security logs, removable storage events, and AI tool inventory, including the optional scanning of configuration files.
  3. Personal devices. If you allow Managed Devices that End Users own personally, you will maintain and communicate a written policy describing what the Service collects from those devices, what actions you may take on them (including erasing them), and how End Users may remove management.
  4. Commands are yours. You are solely responsible for every command, script, configuration, profile, app deployment or removal, and restriction issued from your Tenant, whether by an Authorized User, an automation, or an API client. Some commands cannot be undone: an erase command permanently deletes the data on a device, and a lost-mode, lock, or passcode command can make a device unusable until it is unlocked. Xavier cannot reverse these actions or recover data erased from a device.
  5. Escrowed secrets. Recovery keys, bypass codes, and passwords escrowed in the Service are protected as described in the Security Overview, but you remain responsible for keeping your own records of anything you need to recover a device.

8. Restricted data

The Service is not designed to store protected health information under HIPAA, payment card data under PCI DSS, or special categories of personal data under Article 9 of the GDPR. You will not upload such data to the Service, including in device names, notes, custom attributes, scripts, script output you choose to collect, or uploaded files. Xavier does not sign business associate agreements and makes no HIPAA or PCI DSS compliance commitments. Xavier has no liability for restricted data submitted in breach of this Section.

9. Third-Party Platforms

  1. Device management depends on Third-Party Platforms. For example, Apple devices are managed through Apple’s push notification service, and automated enrollment uses Apple Business Manager or Apple School Manager. You are responsible for your own accounts with Third-Party Platforms and for complying with their terms, including the Apple Business Manager and Apple Push Notification service terms.
  2. Third-Party Platforms are not provided by Xavier, and Xavier is not responsible for their availability, accuracy, security, or changes. If a Third-Party Platform changes or withdraws an interface the Service relies on, we may change or remove the affected functionality, and we will tell you if we do.
  3. When you connect a Third-Party Platform (for example an identity provider, alerting webhook, package source, or AI client), you direct Xavier to exchange Customer Data with it. That provider’s handling of data is governed by your agreement with it.

10. Customer-Hosted Components

If you connect Customer-Hosted Components, you are responsible for their availability, capacity, security, configuration, and backups, and for the data stored in them.

10.1 Your storage

Files you upload to the Service (such as installers, packages, media, and collected diagnostics) are stored in your own storage account, not by Xavier.

10.2 Your own database

You may choose to keep your Tenant’s data in a MongoDB database that you provide, either one you host yourself or one in your own MongoDB Atlas account, instead of in Xavier’s database. If you do:

  1. your Customer Data is stored in that database, in the location you choose, and Xavier accesses it over the network to provide the Service;
  2. you are solely responsible for the database’s availability, performance, capacity, security, access controls, and backups, and for any loss or corruption of data in it. Xavier does not back up your database;
  3. the Service is unavailable to your Tenant whenever Xavier cannot reach your database, and that unavailability is not covered by the Service Level Agreement; and
  4. when your subscription ends, you control the data in your database and its deletion (see Section 13.3).

11. AI features

  1. MCP server. The Service includes a read-only Model Context Protocol server. If you create an MCP token and connect an AI assistant or client, you direct Xavier to provide Customer Data to that client. Your choice of AI provider and its processing of Customer Data are governed by your agreement with that provider, and Xavier is not responsible for them. Xavier itself does not send Customer Data to any AI model provider.
  2. AI tool governance. Features that discover, report on, or block AI tools, AI browser extensions, or connections to AI services rely on detection rules that cannot identify every tool or prevent every use, and may produce false positives that block legitimate software. These features help you apply your policies; they do not guarantee that your policies are followed.
  3. Configuration scanning. If you enable scanning of AI tool configuration files, the Service may read files in user home directories and may report credentials or secrets found in them. You decide whether to enable it and are responsible for the notice and consent obligations in Section 7.

12. Security, suspension, and acceptable use

12.1 Our security

We maintain the technical and organizational measures described in the DPA. We may update them, provided the overall level of protection is not materially reduced.

12.2 No security guarantee

The Service provides tools to help you manage and secure devices. We do not warrant that the Service will detect, prevent, or remediate any vulnerability, malware, attack, data loss, policy violation, or misuse of AI tools, or that use of the Service will make you compliant with any law, regulation, standard, or certification. You remain responsible for your overall security program and compliance.

12.3 Acceptable use

You will comply, and ensure your Authorized Users comply, with the AUP.

12.4 Suspension

We may suspend access to all or part of the Service, limited to what is reasonably necessary, if (a) your use poses a security risk to the Service or others, (b) you or your Authorized Users materially breach the AUP, (c) Section 5.5 applies, or (d) suspension is required by law. Where practicable we will give notice first and let you fix the issue, and we will restore access promptly once the cause is resolved.

13. Term and termination

13.1 Term

Unless an Order states a fixed term, your subscription is month to month and continues until cancelled. You may cancel at any time by notice to us; cancellation takes effect at the end of the calendar month in which we receive it, and you will be invoiced for usage up to that date. We may cancel a month-to-month subscription on at least 30 days’ notice.

13.2 Termination for cause

Either party may terminate this Agreement if the other materially breaches it and does not cure the breach within 30 days of written notice. Either party may terminate immediately if the other becomes insolvent or subject to bankruptcy or similar proceedings. If you terminate for our uncured breach, termination takes effect immediately and you owe fees only for usage up to the date of termination.

13.3 Your data when the subscription ends

  1. Export. For 30 days after termination of a paid subscription, we will provide an export of your Customer Data in a commonly used, machine-readable format if you ask for it through our contact form. Files in your own storage account and data in your own database remain under your control and are not affected.
  2. Deletion. We will delete your Customer Data from the production Service no later than 90 days after termination, unless the law requires us to keep it. If your Tenant uses your own database, we will disconnect it and delete the connection details and any Customer Data we hold outside it; the data in your database remains yours to keep or delete.
  3. Backups. Our database backups cover all tenants together, so your data cannot be removed from them selectively. Copies in backups are deleted as the backups expire on their normal schedule, which is no later than 12 months after the backup was made. Until then, backups remain protected by the security measures in the DPA and are not used to restore your data except at your request.
  4. For trials, Section 4 applies instead.

13.4 Effect of termination

On termination, your right to use the Service ends, and you must remove our agents and apps from your devices. Management profiles and agents may stop functioning. Sections 5 (for amounts owed), 6.3, 7, 8, 13.3, 13.4, and 14 through 20 survive termination.

14. Warranties and disclaimers

14.1 Mutual

Each party warrants that it has the authority to enter into this Agreement.

14.2 Service warranty

For paid subscriptions, Xavier warrants that the Service will perform materially as described in the Documentation. If it does not, and you tell us within 30 days of first noticing the problem, we will use commercially reasonable efforts to correct it. If we cannot do so within a reasonable time, either party may terminate the affected subscription with immediate effect, and you owe fees only for usage up to the date of termination. This is your exclusive remedy for breach of this warranty. Service availability is governed exclusively by the Service Level Agreement.

14.3 Disclaimer

Except as expressly stated in this Agreement, the Service is provided “as is” and “as available”, and Xavier disclaims all other warranties, express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, and that the Service will be uninterrupted or error-free, that any data will be preserved without loss, or that any command will reach or take effect on any device.

15. Limitation of liability

15.1 Excluded damages

Neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, or anticipated savings, or loss or corruption of data (including data on a device that is erased, locked, or otherwise affected by a command issued from your Tenant), however caused and on any theory of liability, even if advised of the possibility.

15.2 Cap

Each party’s total liability arising out of or relating to this Agreement will not exceed the total fees paid and payable by you to Xavier under this Agreement in the 12 months before the event giving rise to the liability. For a trial, Xavier’s total liability will not exceed US$100.

15.3 Exceptions

Sections 15.1 and 15.2 do not limit: (a) your obligation to pay fees; (b) a party’s indemnification obligations under Section 16; (c) liability for gross negligence, willful misconduct, or fraud; (d) your liability for breach of Sections 7, 8, or the AUP; or (e) liability that cannot be limited by law.

16. Indemnification

16.1 By Xavier

Xavier will defend you against any third-party claim alleging that the Service, as provided by Xavier, infringes that third party’s patent, copyright, or trademark, or misappropriates its trade secret, and will pay damages finally awarded or agreed in settlement. Xavier has no obligation for claims arising from Customer Data, Third-Party Platforms, Customer-Hosted Components, combination of the Service with anything not provided by Xavier, modification not made by Xavier, or use in breach of this Agreement. If the Service is or may become subject to such a claim, Xavier may obtain the right for you to continue using it, modify it to be non-infringing, or terminate the affected subscription with immediate effect, in which case you owe fees only for usage up to the date of termination. This Section states Xavier’s entire liability for infringement claims.

16.2 By you

You will defend Xavier against any third-party claim (including a claim by an End User or a regulator) arising from Customer Data, from your management of Managed Devices (including commands issued from your Tenant and your compliance with Section 7), or from your breach of Section 8 or the AUP, and will pay damages finally awarded or agreed in settlement.

16.3 Process

The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement (except that a settlement may not impose obligations on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s expense.

17. Confidentiality

“Confidential Information” means non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data and the non-public parts of the Service. The receiving party will use the disclosing party’s Confidential Information only to perform under this Agreement, will protect it with at least reasonable care, and will disclose it only to employees, contractors, and advisers who need to know it and are bound by confidentiality obligations at least as protective. These obligations do not apply to information that is or becomes public through no fault of the receiving party, was known to it without restriction, is independently developed, or is rightfully received from a third party without restriction. A party may disclose Confidential Information when required by law, after giving reasonable notice where legally permitted.

18. Changes to this Agreement

We may update this Agreement and the incorporated policies. We will give at least 30 days’ notice of a material change by email to your account holder or by notice in the Service, and post the updated version with its effective date. Changes required by law or that address a security risk may take effect sooner. If a change materially reduces your rights or our obligations, you may cancel by notice with immediate effect before the change takes effect, and you owe fees only for usage up to the date of cancellation. Otherwise, continued use of the Service after the effective date constitutes acceptance. A signed Order may only be changed by a written amendment signed by both parties.

19. Governing law and disputes

This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The state and federal courts located in the State of Delaware have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each party consents to their jurisdiction and venue. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information. EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT. Before starting proceedings (other than for injunctive relief), a party will give the other written notice of the dispute and the parties will try in good faith to resolve it for 30 days.

20. General

  1. Notices. We may give notices by email to your account holder’s address or in the Service. You may give notices, including notices of breach or termination, through our contact form or by email to legal@xavier-dm.com. Notices given by email or through the contact form are written notices.
  2. Intellectual property. Xavier and its licensors own the Service and all related intellectual property. No rights are granted except as expressly stated. You will not (and will not allow anyone to) copy, modify, or create derivative works of the Service, reverse engineer it except as permitted by law, resell or sublicense it except under a separate partner agreement, or use it to build a competing product.
  3. Feedback. If you give us suggestions or feedback, we may use them without obligation to you.
  4. Publicity. Neither party will use the other’s name or logo in marketing without its prior written consent.
  5. Export and sanctions. Each party will comply with applicable export control and sanctions laws. You will not use or allow access to the Service in or from a sanctioned country or by a sanctioned person.
  6. Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, including failures of Third-Party Platforms, cloud or network providers, utilities, natural disasters, war, terrorism, labor disputes, or government action. This does not excuse payment obligations.
  7. Assignment. Neither party may assign this Agreement without the other’s consent, except to a successor in a merger, acquisition, or sale of all or substantially all of its relevant business or assets, with notice to the other party.
  8. Independent contractors. The parties are independent contractors. There are no third-party beneficiaries.
  9. Entire agreement. This Agreement, with the documents in Section 2 and any Order, is the entire agreement between the parties about its subject and supersedes all prior agreements and understandings. Terms in any purchase order or other document you provide do not apply.
  10. Severability and waiver. If any provision is unenforceable, it will be modified to the minimum extent necessary and the rest remains in effect. Failure to enforce a provision is not a waiver.
  11. Language. This Agreement is written in English. Any translation is for convenience only, and the English version governs.