1. Parties and agreement
The supplier is Marco Lorenzo Qureshi Grima, a sole trader trading as LimitBreakIT, Malta, providing clm.mt. Contact marco@limitbreakit.com. Supplied correspondence address: 8 Pepprina Court, Flat 6, Triq it-Trejqet ir-Rummien, Hal Ghaxaq GXQ 1210, Malta. No limited company or company-registration number is asserted.
The intended customer is a business or organisation identified in an accepted order or pilot agreement. Its representative must have authority to bind it and authorise certificate operations. These published pilot terms alone create no customer contract. Before access, both parties must agree the order, this version of the terms and, where relevant, the DPA. A website visit is not acceptance. Consumer use is outside this proposed offering and needs separate legal review; mandatory rights cannot be excluded by calling a person a business customer.
The signed order states scope, dates, fees if any, support arrangements, approved destinations and any special conditions. The DPA governs personal-data processing conflicts. Other signed variations prevail only within their stated scope. The privacy notice describes controller processing; it is not a blanket consent or a waiver of the customer's DPA protections.
2. Service and pilot boundaries
clm.mt provides a hosted certificate-management control plane with customer-installed agents connecting outbound. It can discover certificates, request/reissue them via configured issuers, deploy to supported destinations and check served certificates. Each integration has its own tested boundary. Availability of a connector does not certify every vendor/version or grant rights to a CA account. Customer self-hosted control-plane distribution is deferred.
The present offering is a limited, pre-release pilot. Public signup is closed. The native EC2/SQLite pilot runs one control-plane writer. There is no promised automatic horizontal scaling, high-availability SLA, compliance certification or universal outage prevention. The published Docker agent is a qualified pre-release; it is not an unattended stable-fleet rollout commitment. Supported platforms, maintenance and any pilot restrictions must be attached to the order.
3. Authority, accounts and safe automation
The customer must own or be authorised to manage every domain, CA subscription, DNS zone, target system and network it configures. Do not use discovery to probe unapproved networks. Keep accounts individual, apply least privilege, protect enrolment tokens/agent state and remove departing users and agents. Organisation administrators are responsible for approved members, roles, destinations and instructions. The customer must inform its workforce and other affected people and establish the authority needed for its personal-data processing.
Use isolated tests and reviewed maintenance windows before production deployment. Keep independent expiry monitoring, recovery copies and an accountable operator. An agent can execute configured deployment operations and hooks within its service permissions. Protect the host and avoid giving it broader access than necessary. The customer's administrators decide whether hosted runners are appropriate for their key-custody requirements.
4. Issuance, credentials and third parties
CA/DNS/target providers impose their own terms, eligibility checks, limits and fees. Enabling automation authorises the operations within the agreed customer configuration, including renewals/reissues, challenge records and deployment. Paid orders or retries may incur external fees. clm.mt does not establish that the customer has purchased the necessary subscription or validation entitlement.
Public issuance can disclose certificate names in CT logs permanently; deleting the service record does not retract public certificates, revocation records or third-party disclosures. The customer chooses suitable public names and notification recipients. Provider unavailability, validation failures, expiry policy changes and destination-specific rollback limitations can prevent successful renewal or deployment. The supplier must use the agreed care and incident process; these dependencies do not excuse its own breach of obligations.
5. Data, confidentiality and security
The customer retains rights to its data. It grants only the rights reasonably needed to provide the agreed service and carry out documented instructions. Neither party may use the other's confidential information outside the agreement, except as lawfully required. Limit access to people with a need to know and appropriate confidentiality duties. Public information, independently developed information and lawfully received nonconfidential material are excluded.
The DPA specifies processing safeguards, assistance, incident handling and exit. The service does not promise that agent-held secrets can be recovered if the customer loses its agent state. Hosted keys and stored credentials are usable by authorised service execution; encryption at rest is not end-to-end key isolation. Security reports should go to the business contact with a safe summary, not a private key or live password. Do not perform disruptive testing without approval.
6. Changes, updates and support
The supplier will describe material pilot changes and planned maintenance through the contact agreed in the order. Urgent security containment may require prompt action. Signed agent worker updates depend on configured channels, rollout and trust pins. A service supervisor or external container image may require separate operator maintenance; “signed updates” does not mean every component updates itself. No support hours, response-time warranty, service credit or numerical uptime promise is included unless the order specifies one.
7. Fees and commercial decisions
No prices, auto-renewing subscription, trial conversion or payment schedule are created by this register. Any fees, VAT treatment, billing period, renewal mechanism, payment due date and cancellation/refund rules must be agreed explicitly in the order before charging. The customer remains responsible for separately contracted CA, DNS and target-provider charges. A paid service must not launch with these commercial decisions unresolved.
8. Suspension, termination and exit
Proposed pilot position for approval: either party may end a pilot on 14 days' written notice, or sooner by agreement. Serious security risk, unlawful use or material breach may justify proportionate suspension; give notice and a chance to remedy when safe and appropriate. Restore access when the cause is resolved. Do not use suspension to evade data-protection assistance or a justified exit.
The proposed exit plan provides a 30-day agreed export window, then removal of active customer data within a further 30 days, subject to a justified legal hold. These are proposed obligations and have not been operationally qualified. The approved order/DPA must resolve the timings and backup handling before onboarding. Available inventory CSV/API exports do not constitute a complete migration/export of all keys, configurations, history or audit evidence. Returning sensitive data requires a secure, scoped process. Uninstall/revoke agents and rotate customer credentials deliberately; uninstalling an agent does not revoke its certificates. Do not stop monitoring expiry merely because the subscription has ended.
9. Liability and governing terms
No contractual liability cap, exclusion of loss, indemnity or service-credit scheme is selected in this pilot register. These are settled in the separately accepted order, with advice appropriate to scope, insurance and any fees. Nothing may exclude liability or statutory data protection remedies that cannot lawfully be excluded. Do not replace this section with an unsupported “as is” disclaimer for an operational certificate service.
Proposed governing law is Malta, with disputes in its competent courts, subject to mandatory law, data-protection rights and jurisdiction rules. The parties should first attempt resolution through their named contacts without restricting urgent relief or a supervisory complaint. The signed agreement must confirm the applicable governing terms. Any effective version and material amendment require recorded notice and the agreed acceptance process; editing a web page alone does not record assent.