Terms

The terms are https://cyberstrategyinstitute.com/terms/. Cyber Strategy Institute Inc. published them, updated October 14, 2026. This page is not a second terms document.

Hosted MCP commitments are in Schedule B: Hosted MCP Services.

The sentences below are this service's own commitment:

• Agency Check never contacts anyone or acts for you.
• It never gives a score and never calls anything "safe".
• No Decision Card state means an action is safe, approved, or recommended.

What this service does with what you send:

• Content you send is processed in memory only and is never stored. It is never written to storage, logs, or analytics. Retention of that content is 0 days.
• Receipts hold hashes and the outcome only. They are kept up to 90 days.
• Operational logs and security metadata are kept up to 90 days.
• Analytics Engine keeps per-event usage, security and billing records under a monthly-rotating pseudonym for about 3 months, then they are deleted. Each record has the event type, plane, tool category, outcome, card state, module, error code, reason, key whitespace, ruleset version, service version, and a duration band. It has no content.
• D1 keeps the user row until the account is deleted. That row is a pseudonymous id, which sign-in produced it, the plan, the terms and privacy versions accepted, the creation time, and the last day seen.
• D1 keeps connections until the account is deleted.
• D1 keeps consents until the account is deleted.
• D1 keeps the entitlement until the account is deleted. That row holds the same pseudonymous id, the plan, the product, the status, the billing interval, the current period end, whether cancellation is at the period end, the Stripe customer id, the Stripe subscription id, disputed Stripe subscription ids, and the time the row last changed.
• Revoked agent IDs are kept while the account exists and are deleted with the account.
• The session generation counter is kept with no expiry, including after account deletion, so a cookie from before deletion does not match.
• The intro marker is kept with no expiry, including after account deletion, so a later subscription is not treated as a first Pro subscription. It records the first Pro subscription id and the end of the first calendar month of that subscription, or that this account does not get an intro.
• D1 keeps a salted hash of the network bucket for a new account until that signup window ends, and never longer than 90 days. The network address is not stored.
• D1 keeps an internal note when new accounts or checks jump above a trailing baseline. The note is the day, the count, the baseline, and the time it was written. It is kept up to 90 days and stays on this service.
• Cyber Strategy Institute Inc. does not sell your content or your personal information.
• Your content is not used to train models.

Billing

You can cancel anytime. Access continues until the end of the paid period. A first purchase, monthly or yearly, can be refunded in full within 14 days of that purchase. After those 14 days, there is no partial refund.

Independence (Schedule B7): Agency Check works with Meta's Muse and with other agents as a connector. It is not made by, affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. Muse is a trademark of Meta. The same applies to any MCP client you use with AI SAFE2 MCP.

Legal requests go to policy@cyberstrategyinstitute.com.

Cyber Strategy Institute Inc.
1207 Delaware Ave #3397
Wilmington, DE 19806