Terms of Service

1. Nature of the Service

A remote asset management plane

WingGate provides a remote asset management service: the WingGate service handles authentication, authorization and audit, while the wing-connector reaches managed assets inside your network. The software is delivered as deployable components and every component can be self-hosted.

Self-hosted deployment

The wing-connector is deployed inside your own network and connects outbound to WingGate; the service can also be self-hosted. Data residency, backup strategy and patch cadence are decided by, and the responsibility of, the deploying party.

Not a fully managed SaaS

WingGate is not a fully managed SaaS. Unless explicitly stated otherwise, the software carries no availability commitment: the actual availability, performance and continuity of any service depend on the deployment operator, not on the software provider.

2. Account Responsibilities

Credential custody

You are responsible for safeguarding your login credentials, including your password, MFA factors (TOTP authenticator or passkey) and one-time recovery codes or the TOTP key, and the private keys matching any SSH public keys you register. WingGate never holds your SSH private keys; the risk of losing or leaking them is yours.

MFA enrollment

After registration or external-identity completion you must finish MFA enrollment (TOTP or passkey) and keep the matching recovery material: the key shown at TOTP enrollment (it can re-enroll an authenticator), or the one-time recovery codes issued at passkey enrollment. Store them safely; if you lose your authenticator or passkey and have no recovery material, account recovery depends on the deployment operator's process and is not guaranteed to be self-service.

Activity under your account

Activity performed under your account is attributed to you. If you discover credential compromise or abnormal usage, immediately revoke the affected credentials and grants in the console and notify your deployment operator.

3. Acceptable Use

Lawful authorization required

You may use WingGate only for target assets you are lawfully authorized to access. Before onboarding any asset you must confirm you have authorization from its owner or administrator.

Prohibited conduct

You must not use WingGate to perform or facilitate unauthorized access, probing or control of others' systems; must not bypass or undermine authentication, authorization or audit mechanisms; and must not use the software for activities that violate applicable law.

Enforcement

The deployment operator may suspend or terminate accounts and grants upon discovering violations. Authorization and audit records at the software level may serve as the basis for such action.

4. Asset and Security Responsibility Boundaries

Components inside your network

The wing-connector deployed inside your network, its host machine and the surrounding network environment are your responsibility. The connector-to-service channel uses mTLS, but the security of the connector host itself (hardening, patching, access control) falls within your scope.

Target assets and their credentials

Target assets and the credentials used to access them are your responsibility. Asset credentials are stored in Connection Profiles as write-only on normal read paths and never enter logs, audit entries or error responses; selecting, rotating and revoking them remains your job.

Host key confirmation

Confirming an asset's SSH host key on first connection is your judgment call. Verify fingerprints out-of-band; for any unexplained host key mismatch, do not override. You bear the consequences of an incorrect confirmation or override.

Deployment operators

If you use a WingGate instance operated by someone else, that operator is responsible for the instance's availability, data retention and access policies; your agreement with the operator takes precedence.

5. Service Changes, Suspension and Version Compatibility

Software updates

WingGate evolves continuously. Features may be added, changed or removed; upgrades are performed by the deploying party. Public pages and documentation describe the current implementation and do not promise future functionality.

Compatibility boundaries

Compatibility boundaries for public protocols and cross-component contracts are defined by the deployed software and described by the compatibility page and the API and protocol reference article. For cross-version upgrades, follow the upgrade and rollback boundaries described in the connector deployment article.

Maintenance and suspension

The software carries no maintenance-window or uptime commitment (no SLA). Maintenance, suspension and termination of any instance are decided by its deployment operator; assess the impact on your own business continuity and keep your own backups.

6. Limitation of Liability

Scope

To the maximum extent permitted by applicable law, the software is provided “as is”, without warranties of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose and non-infringement.

Indirect damages

To the maximum extent permitted by applicable law, the software provider is not liable for any indirect, incidental, special or consequential damages, including loss of data, business interruption or loss of profits, even if advised of the possibility of such damages.

Self-hosting risk

The security, compliance and availability of a self-hosted deployment are evaluated and borne independently by the deploying party. You are fully responsible for how you use the software, which assets you connect and which regulations you must comply with.

7. Amendments and Contact

Changes to these terms

Changes to these terms are published on this site. Continued use of the software after a change constitutes acceptance of the updated terms; material changes will be called out clearly when they are published.

Contact

Questions about these terms can be raised with the operator of the deployment you use. For issue reports, use the contact page.