Last updated: 25 September 2026
These Terms of Service ("Terms") govern your use of the Nabto platforms and related services (the "Service") provided by Nabto ApS, a company registered in Denmark under CVR number 30708059, with its registered office at Åbogade 15, 8200 Aarhus N, Denmark ("Nabto", "we", "us", "our"), whether you sign up for the Service online or contract with us under an Order Form.
You ("Customer", "you") agree to these Terms by creating an Account, clicking "I accept" or otherwise accessing or using the Service or by signing an Order Form that references these Terms. If you accept on behalf of a company or other legal entity, you represent that you have authority to bind that entity and "you" refers to that entity.
These Terms apply to all use of the Service, including any free, trial, evaluation or paid use. Where fees are payable for the Service, whether for a Subscription bought in the console or under an Order Form, the Payment Terms also apply and govern all commercial and billing matters.
If you do not agree to these Terms, do not register, sign an Order Form or use the Service.
2.1 We provide a software-as-a-service platform enabling connectivity, communication and management of IoT Devices, including hosted basestations, relay, hosting, signaling and peer-to-peer/WebRTC connectivity.
2.2 We may offer free, trial or evaluation access. Such access may be subject to usage limits and may be modified, limited or withdrawn at any time. Trial or evaluation use is provided "as is" without any commitments.
2.3 We may modify, enhance or discontinue features from time to time. For generally available APIs, protocols and hosted services we give the notice stated in the Service Level Policy before a backwards-incompatible change or a discontinuation that affects your use.
2.4 The Service is intended for business and professional use. It is not designed or warranted for safety-critical, life-support, medical, emergency or other applications where failure could lead to death, personal injury or severe physical or environmental damage. You assume all risk for any such use.
3.1 You must provide accurate, complete registration or order information and keep it current.
3.2 You are responsible for safeguarding your credentials and API keys and for all activity under your Account. Notify us promptly of any suspected unauthorized use.
3.3 You must be at least 18 years old and able to form a binding contract.
3.4 One person or entity may not maintain more than one free Account to circumvent usage limits.
3.5 Security notifications. If you become aware of a vulnerability in the Service, including in SDKs or other Nabto software you have integrated into your products, or of a security incident affecting the Service, notify us without undue delay by email to vulnerabilities@nabto.com, as described at https://www.nabto.com/security-vulnerability-reporting. If you have reliable evidence that a vulnerability is being actively exploited, aim to notify us within 24 hours of becoming aware, marking the report "ACTIVELY EXPLOITED" in the subject line. Timely reports enable us to meet our own obligations under Regulation (EU) 2024/2847 (the EU Cyber Resilience Act) and to protect you and other customers.
3.6 Security contact. We send security notices, including notifications of vulnerabilities in the Service that affect you and of corrective measures and mitigations, to your Account email address and to the security contact you have designated in an Order Form or a Security Notification Addendum. An Order Form must name a security contact; until it does, we send security notices to the contact named in the Order Form for notices. We recommend a monitored role-based address. Keep those addresses current and monitored and ensure such notices reach the people responsible for security in your organization. You are responsible for acting on such notices and for passing relevant information on to your End Users where required.
3.7 Coordinated disclosure. Do not publicly disclose details of an unremedied vulnerability in the Service before a fix or mitigation is available and we have coordinated the disclosure. This restriction ends when a fix or mitigation is available and the disclosure has been coordinated. In any case it ends no later than 90 days from the date we became aware of the vulnerability, unless the parties agree in writing on an extension for a stated reason such as a fix that requires a longer rollout across installed Devices. Either party may at any time inform the authorities, its own users and affected customers where the law requires, including under the Cyber Resilience Act. Either party may also report the vulnerability to a national CSIRT or to another coordinating body.
3.8 Security Notification Addendum. If you have signed a Security Notification Addendum with us, it prevails over Sections 3.5 to 3.7 on security notifications.
4.1 You are solely responsible for your Devices, applications, End Users and Customer Data.
4.2 You must not and must not permit any End User to:
4.3 Device security. You are responsible for securing your Devices, including credential management, firmware integrity and timely updates. We are not responsible for vulnerabilities or compromises originating from your Devices.
4.4 Fair use. Where access is described as "unlimited" or "fair use", we may apply reasonable limits to protect infrastructure integrity and prevent abuse, with notice where practicable.
5.1 We and our licensors retain all rights, title and interest in the Service, including all software, APIs, SDKs, documentation and trademarks. You receive only the limited right to use the Service under these Terms.
5.2 You retain all rights to your Customer Data, Devices and applications. You grant us a limited license to process Customer Data solely as necessary to provide and support the Service.
5.3 If you provide feedback or suggestions, we may use them without restriction or obligation to you.
5.4 SDKs and End User access. For the term of the Agreement we grant you a non-exclusive right to integrate the SDKs we publish for use with the hosted Service into your Devices and applications, to reproduce and distribute them in compiled form as part of those Devices and applications and to let your End Users use the Service through them. You may not distribute an SDK on its own or in source form. Where license terms accompany an SDK, they govern the software itself and prevail over this Section for that software. Software whose documentation requires a separate commercial license, such as the Nabto Edge embedded SDK, is not covered by this Section until that license is in place. Third-party and open-source components remain subject to their own licenses. On termination your right to use the hosted Service ends. Software already distributed in your products may continue to be used in those products under the terms that applied when it was distributed.
6.1 Our handling of personal data is described in our Privacy Policy at https://downloads.nabto.com/assets/legal/platform-privacy-policy.html.
6.2 Where we process personal data on your behalf in connection with the Service, we act as data processor and you act as data controller under the EU General Data Protection Regulation (GDPR). In that case, our Data Processing Agreement at https://downloads.nabto.com/assets/legal/data-processing-agreement.html applies and forms part of the Agreement.
6.3 You are responsible for having a lawful basis to collect and transmit any personal data of your End Users through the Service and for providing them required notices.
Each party may receive confidential information of the other. The receiving party will use it only to perform under these Terms and protect it with reasonable care, except for information that is public, independently developed or required to be disclosed by law.
8.1 Availability and support. For paid use of the hosted services, the Service Level Policy states our availability commitment and the service credits you can claim if we fall short of it. Those credits are your sole and exclusive remedy for an availability shortfall and our only liability for it. The support first-response times stated in the Service Level Policy are targets, except the Enterprise plan's P1 and P2 first-response times, which are guaranteed with the support credit stated there as your sole and exclusive remedy for a missed response. Free, trial and evaluation use is provided without availability commitments. An Order Form may set different service levels.
8.2 Disclaimer. Except as expressly stated and to the maximum extent permitted by law, the Service is provided "as is" and "as available" without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement.
8.3 Limitation of liability. To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, special, consequential or punitive damages or loss of profits, revenue, data or goodwill; and (b) our total aggregate liability for all claims arising out of or in connection with the Agreement, including the DPA, shall not exceed the fees paid or payable by you for the Service in the 12 months preceding the first event giving rise to the claim. For a prepaid reserved term and other prepaid fees, the amount taken into account is the prepaid amount allocated pro rata to those 12 months. All claims arising from the same event or from a series of related events count as one claim. For free, trial or evaluation use our liability is excluded to the maximum extent permitted by law. The cap in (b) does not apply to either party's liability under Section 8.5 or Section 8.6 arising from that party's wilful misconduct.
8.4 Nothing in these Terms excludes or limits liability that cannot be excluded under mandatory Danish law, including for gross negligence, intentional misconduct or personal injury caused by negligence.
8.5 Indemnity by you. You will defend us against any claim by a third party arising from your Devices, your applications, your End Users, Customer Data or your breach of the Agreement and pay the damages and costs finally awarded or agreed in settlement. This indemnity does not cover any part of a claim caused by our breach of the Agreement or our negligence. Section 8.7 applies to this indemnity.
8.6 Indemnity by Nabto. We will defend you against any claim by a third party that the hosted services or SDKs, as provided by us and used in accordance with the documentation, infringe a patent, copyright or registered trademark valid in the EU or the United States and pay the damages and costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, your Devices or applications, a combination of the Service with products not supplied by us, a modification not made by us, use contrary to the documentation or the Agreement, use continued after we have notified you to stop, free, trial or evaluation use or open-source components under their own licenses. The combination and modification exclusions apply only where the claim would not have arisen without the combination or the modification. Integrating the SDKs with your Devices and applications as described in the documentation is not a combination for this purpose. If a claim is made or we consider one likely, we may at our option procure the right for you to continue using the Service, modify or replace it so that it no longer infringes or, if neither is commercially reasonable, terminate the affected Service and refund prepaid fees as stated in Section 9.6. Section 8.7 applies to this indemnity. This Section is your sole and exclusive remedy for infringement claims and our liability under it is subject to Section 8.3.
8.7 Indemnity procedure. This Section applies to the indemnities in Sections 8.5 and 8.6. The indemnified party must notify the indemnifying party promptly in writing of the claim. The indemnifying party controls the defense and settlement of the claim. The indemnified party cooperates at the indemnifying party's expense and may participate in the defense with its own counsel at its own cost. The indemnifying party may not agree to a settlement that imposes an admission of fault or a non-monetary obligation on the indemnified party without that party's consent. Both indemnities are subject to the cap in Section 8.3, except for liability arising from wilful misconduct.
9.1 These Terms apply for as long as you have an Account, have an Order Form in force or use the Service.
9.2 You may close your Account at any time via Account settings or by contacting support@nabto.com. Where an Order Form states a term or notice period, that term and notice period apply to the services ordered under it. Termination of paid services is governed by the Payment Terms and any Order Form.
9.3 Suspension and termination for breach. We may suspend your Account, or the affected part of the Service, with immediate effect if you materially breach these Terms or use the Service in a manner posing a security or legal risk. We may close a free or trial Account for inactivity. We give notice of a suspension where practicable and lawful and lift it when the cause is resolved. Suspension for non-payment is governed by Section 10 of the Payment Terms. Either party may terminate the Agreement or the affected Service if the other party materially breaches it and does not cure the breach within 30 days of written notice. Where the breach cannot be cured, or where continued provision would be unlawful, that termination takes effect immediately on notice.
9.4 Effect of termination. Your right to use the hosted Service ends and Device connectivity ceases. Software already distributed in your Devices and applications remains subject to Section 5.4. For 30 days after termination (the "retrieval period") you may export your Customer Data through the console and the APIs; after that period we delete it, unless retention is legally required. If you ask us in writing to delete your Customer Data earlier, we delete it in the live systems without undue delay and the retrieval period ends with the deletion; backup copies expire within 35 days of that deletion as stated in Section 12 of the DPA and in the Privacy Policy. If you terminate in order to switch provider, the sequence in Section 9.7 applies and the retrieval period starts when the transition period ends.
9.5 Provisions that by their nature should survive (including intellectual property, confidentiality, liability and governing law) will survive termination.
9.6 Refunds where Nabto causes the exit. This Section applies if you terminate for our uncured material breach, if we discontinue a Hosted Service or a material function of it under the Service Level Policy before a prepaid term ends, if we terminate an infringing Service under Section 8.6, if you terminate for a material change under Section 10.3 or if you terminate the affected Service after an unresolved sub-processor objection under the DPA. In those cases we refund the unused prepaid fees pro rata, including the prepaid fees for a reserved term, the unused balance of a prepaid relay pool and support plan fees for the period after termination. We also release you from your future commitments for that Service. Ordinary voluntary cancellation, including cancellation or non-renewal for your own convenience, does not entitle you to a refund.
9.7 Switching. You may end the Agreement or an affected hosted Service in order to switch to another provider or to your own infrastructure by giving us notice of at most two months. This Section applies to every hosted Service, whether or not the EU Data Act applies to it. The sequence is: (a) a transition period of 30 days from the end of your notice period, during which the Service, your Account and the applicable fees continue on the existing terms; on your request made before it ends we extend the transition period once, for the period you state as appropriate for your migration; where completing the export within the transition period is technically not feasible, we may extend it once ourselves by at most seven months, by notice to you within 14 working days of your switching request stating the reasons and the new end date; (b) we notify you when the export of your data is complete; termination takes effect when you confirm to us that your switch is complete or, at the latest, when the transition period as extended ends; the hosted Service then stops serving your Devices; (c) the retrieval period of 30 days under Section 9.4 runs from that termination and you may still export during it; (d) after the retrieval period we delete your Customer Data as stated in Section 9.4 and the DPA, unless you instruct us in writing to delete it earlier. The data you can export is your product and Device records including identifiers and fingerprints, your configuration, the list of your Account users and API key identifiers and your usage records, in the JSON formats of the Cloud API as documented and as downloads from the console where the console offers them; secrets such as private keys and API key secrets are never exported. Export and switching are free of charge and we give you reasonable assistance and information about the formats. Re-provisioning your Devices to another service is your responsibility, because the Nabto software on your Devices is under your control. Prepaid fees for an unexpired reserved term are not refunded on a voluntary switch; Section 9.6 states the cases in which prepaid fees are refunded.
10.1 We may update these Terms, the Payment Terms and the Service Level Policy from time to time, posting the updated version with a revised "Last updated" date and, for material changes, giving notice by email to the Account email address or in the console.
10.2 Continued use after changes take effect constitutes acceptance. If you do not agree, you must stop using the Service and may close your Account.
10.3 Paid use. For customers with a paid Subscription, a reserved term or an Order Form, a change that materially reduces your rights or increases your obligations takes effect no earlier than 30 days after our notice. If you object, you may terminate the affected Service by notice to us before the change takes effect and we refund any prepaid fees for the period after termination pro rata. Changes required by law, and changes that do not reduce your rights, may take effect on shorter notice.
10.4 Order Forms. The versions of these Terms, the Payment Terms, the Service Level Policy and the DPA identified in a signed Order Form apply to that Order Form for its current term. Updated versions apply from the next renewal or extension of the Order Form unless the Order Form states otherwise. Changes required by law apply to all customers on reasonable notice.
Neither party is liable for failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including network failures, acts of third-party providers, natural disasters or governmental action.
You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition or sale of assets.
13.1 The Agreement (any Order Form, any signed Security Notification Addendum, the DPA, the Payment Terms, the Service Level Policy and these Terms) constitutes the entire agreement between you and Nabto regarding the Service. The Privacy Policy describes how we handle personal data and is not part of the Agreement.
13.2 If the documents conflict, the following order of precedence applies: (a) an Order Form, for the price, currency, billing cycle, payment method, term, service levels and other commercial particulars it states and for any other provision of the other documents it expressly identifies and varies; (b) the DPA, on the processing of personal data; an Order Form never reduces the protection required by Article 28 of the GDPR; (c) the Payment Terms, on commercial and billing matters; (d) the Service Level Policy, on availability, support and service credits; (e) these Terms. A signed Security Notification Addendum prevails over Sections 3.5 to 3.7 on security notifications.
13.3 Terms contained in your purchase orders, vendor portals or similar documents do not apply unless Nabto has signed them.
13.4 If any provision is held invalid, the remaining provisions remain in effect.
14.1 These Terms are governed by the laws of Denmark, excluding conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).
14.2 The courts of Denmark have exclusive jurisdiction over any dispute, with the City Court of Aarhus as the court of first instance, except where Danish law assigns the case to the Maritime and Commercial High Court (Sø- og Handelsretten) or the parties agree to bring it there, and subject to any mandatory consumer protection rules that may apply.
Nabto ApS
Åbogade 15, 8200 Aarhus N, Denmark
Email: legal@nabto.com
CVR: 30708059