Terms of Use

1.The agreement

These terms form a contract between you and 에스에이치랩솔루션즈 covering your use of the SC4SAP console, its backend, its skills, its documentation and everything else we make available at the same place (together, the Service). Creating an account, connecting an SAP system, or running a single Session means you accept them.

If you are accepting on behalf of an employer or a client, you confirm that you are authorised to bind that organisation. From that point, you in these terms means that organisation, and the person who clicked accept is one of its users.

Documents that form part of this agreement

The privacy notice, the plan and pricing page you subscribed under, and any written order form or data processing agreement we sign with you are part of this agreement. Where they conflict, the more specific document wins: a signed order form first, then a data processing agreement, then these terms, then everything else.

What is not part of it

Your agreements with SAP and with any other third party stand on their own. We are not a party to them, they do not change these terms, and nothing here relieves you of an obligation you owe under them.

2.Definitions

• Connected System — an SAP system you register with the Service through a connection profile, including its ABAP repository, its data dictionary, its runtime and its transport organiser.
• Connection Profile — the stored host, client, credentials and tier that let the Service reach a Connected System.
• Tier — the label a profile carries (development, quality assurance, production, or an equivalent of your own) that decides which classes of tool a Session may use against it.
• Skill — a named workflow the Service runs against a Connected System: analysing a program, tracing a symptom, inventorying a package, producing a specification, creating a repository object, releasing a transport, and the rest of the catalogue.
• Session — one conversation with the assistant, including its prompts, its tool calls, the approvals you granted or refused, and the transcript that results.
• Your Content — everything you supply, and everything the Service reads on your instruction: prompts, uploaded files and reference notes, ABAP source, dictionary metadata, configuration values, transport contents, and the artefacts a Session generates.
• Output — the part of Your Content the model produced: answers, specifications, analyses, generated code.
• Model Provider — Anthropic, whose API the Service calls to run a Session.
• Guardrail — any of the controls in section 8 that withhold, block or gate a tool call.

3.Eligibility

You may use the Service if you are at least 14 years old and are not barred from doing so under any applicable law, sanctions regime or export control. If you are a minor (under 19), you need the consent of your legal representative to subscribe to a paid plan, as separately determined.

An account may be created only with a valid invitation code issued by us. We decide whom to invite, and we may limit the number of invitations or stop issuing them.

If you use the Service on behalf of an organisation, you must be authorised to bind it, as set out in section 1.

We may refuse to open an account, or close one, where we reasonably believe this section is not satisfied.

4.Accounts

One account, one person

An account belongs to a single named person. Do not share credentials, and do not let anyone else act under your account. Every action the Service records against it — every prompt, every Skill run, and above all every approval granted at a permission prompt — is treated as yours and is attributed to you in the audit record.

Accurate details

Keep the name, email address and billing details on the account current. Notices we send to the address on file count as delivered even if you have stopped reading it.

Credentials

Keep your password and your SAP credentials confidential. Choose a password that meets the rule the sign-up form enforces, and do not reuse it elsewhere. If you believe either has been exposed, tell us at sc4sap.dev@gmail.com without delay and rotate it at its source. An SAP password is rotated in the system itself.

You remain responsible for activity under your account until you have told us, and we are not liable for loss arising before that notice reaches us, except loss caused by our intent or negligence.

5.Connected Systems and your authority to connect them

You must be authorised

You may register a Connected System only if its owner has authorised you to access it in the way the Service will: reading repository objects, reading dictionary contents and, on a tier that permits it, creating and changing objects and recording them onto transports. Registering a system you have no authority over is a breach of these terms and, in most places, of the law.

The SAP user is yours

The Service acts as the SAP user your profile authenticates as, and can do exactly what SAP has already granted that user — no more. Provisioning that user, scoping its authorisations, and reviewing them over time is your responsibility. Use a dedicated technical user limited to what your work actually needs rather than a personal administrator account.

Tiers are your declaration

You tell us which tier a profile is. The Service withholds tools on that basis, so a production system registered as development will be treated as development, with the write tier available against it. Label your systems accurately; we cannot detect a mislabelled one, and the consequences of a wrong label are yours.

Reachability and network access

Getting the Service to a system that is not on the public internet — tunnels, allowlists, VPNs, gateway configuration — is your side of the line. Do not open a network path that your own security policy forbids in order to make a Skill run.

Licensing

You confirm that connecting the system breaches neither your agreements with SAP nor anyone else’s rights, and that you hold whatever licences your use of that system requires, including for programmatic access. We do not provide SAP licences, we do not advise on them, and we are not a party to yours.

6.Model usage and third-party services

Model usage runs on our account

The Service runs Sessions on our own Model Provider account. You do not register an API key, and you pay the Model Provider nothing directly. Model usage is deducted from your plan’s included usage and Credits as separately determined. The Model Provider’s acceptable use policy applies to that traffic in addition to these terms, and a change on their side can change what the Service can do.

Usage depends on the size of the work

Token cost tracks how much source and metadata a Session has to read. A broad question against a large package can use many times what a narrow one uses, and a Skill that inventories a whole package uses a lot by design. When included usage and Credits run out, new work cannot be started.

Cost figures in the console

Costs shown per Session are our own accounting of what that Session reported, at the Model Provider’s standard rates. Included usage and Credits are deducted on the basis of that accounting.

Model choice

We choose which model a Skill runs on and may change that choice — for quality, cost, availability, or because a model is retired. Output can change as a result. Where a change materially alters what you can expect from a Skill, we will say so in the release notes.

7.What leaves your network

Assume what a Skill reads is transmitted

To answer a question, the Service reads from the Connected System and sends what it read to the Model Provider. In practice that means ABAP source, dictionary definitions, table and field metadata, configuration values, transport contents, the reference notes a Session searched and read, and every word you type. If a Skill has to look at something to do its job, that thing leaves your network.

Do not point the Service at data you are not permitted to send outside your network. The Guardrails in section 8 reduce the risk of bulk personal or financial data leaving a system, but they are a safety net, not a compliance programme. They cannot classify your data for you, they do not know which of your custom tables hold personal data, and they are no substitute for your own review.

What we store

We store your account details, your Connection Profiles, and your Sessions with their transcripts, so that you can reopen work and so that an audit record of approvals exists. Secrets in a profile are encrypted at rest and are never rendered back to the browser after they are saved.

Retention and deletion

You can delete a Session or a profile at any time, and deleting an account removes both on the schedule set out in the privacy notice, except for records we are required to keep. Backups age out on their own cycle, so deletion is not instantaneous everywhere.

Personal data

Where we handle personal data on your behalf we do so as your processor, on your instructions, as described in the privacy notice and any data processing agreement between us. Deciding whether a Session may lawfully touch personal data at all is your call as the controller, not ours.

8.Guardrails and approvals

The Service constrains what a Session can do in three layers, which fail in different directions on purpose.

Layer one — tools withheld by tier

Tools that mutate a Connected System are removed entirely from Sessions running against a tier that is not authorised to write. The model cannot call what it cannot see, so this layer cannot be talked around by a cleverly worded prompt.

Layer two — the blocklist

Extraction of table rows is blocked outright for tables on a standing blocklist, which covers banking, payroll and comparable data. This layer runs before a request ever reaches you: when it fires there is nothing to approve, and no approval granted anywhere else can override it.

Layer three — human approval

Sensitive calls that survive the first two layers stop and ask you. Nothing runs until you answer. A request left unanswered is denied automatically after a timeout, and closing the browser denies rather than approves.

An approval is an instruction

When you allow a call you are directing the Service to make it against your system, with your credentials, and you accept the result. Read the call before you allow it — the request shows you the tool and its exact input for that reason. An approval cannot be undone once the call has run.

Do not defeat them

You will not attempt to work around any Guardrail, including by:

• rewording a prompt, or splitting a request into fragments, to get around the blocklist;
• widening the SAP user’s authorisations to reach data the tier withholds;
• mislabelling a profile’s tier to unlock the write tools;
• reaching the Connected System through a path that bypasses the Service’s tooling.

What the Guardrails do not promise

They constrain tools; they do not audit your data. They cannot guarantee that no sensitive value ever appears in a program you asked the Service to read, because a value sitting in source code is part of the source code. Treat them as one control among yours, not as the whole of your controls.

9.Changes, transports and non-production first

These are real changes

Skills on the write tier create and modify repository objects, activate them, and can record them onto transports. Nothing about that is a simulation. Once a change is written it exists in your system, with your technical user as its author, and undoing it is an ordinary SAP task rather than something the Service can reverse for you.

Your change management governs

Review, approval, testing and release remain yours. The Service has no view of your process, does not know your release calendar, and does not decide what is fit to move. Nothing it produces is a substitute for the sign-off your organisation requires.

Non-production first

Run generated work against a development or sandbox system, review the diff, and test it before it moves onward. Take a backup or a snapshot where the change is not trivially reversible. You decide what is released and when, and we are not responsible for what a change you release does downstream, except where that result is caused by our intent or negligence.

10.Output is a draft, not advice

It can be wrong

The Service is built on a language model, and its Output can be wrong, incomplete, or confidently mistaken — including about your own code. It can cite a table that does not exist on your system, describe behaviour a program does not have, or generate ABAP that compiles and still does the wrong thing. Specifications, analyses, symptom traces and generated code are drafts for a competent reviewer, not deliverables.

It is not professional advice

Nothing the Service produces is legal, tax, audit, security, accounting or other professional advice, and no advisory relationship arises from your use of it. Keep a qualified human accountable for anything that reaches a system that matters.

It is not unique to you

Similar prompts produce similar Output for different customers. We make no claim that Output is original or unique to you, and you should not assume it is when you decide how to use it.

Third-party rights in Output

Output can resemble material owned by someone else, and it can reproduce patterns from the source it was shown. Before you ship generated code, satisfy yourself that using it does not infringe anyone’s rights and does not breach a licence you are bound by — including SAP’s, where the Output touches standard objects.

11.Acceptable use

You will not use the Service to:

• access any system you are not authorised to access, or exceed the access its owner granted you;
• extract personal, payroll, banking, health or similarly regulated data in bulk, or assemble such a set out of repeated narrow queries;
• circumvent, disable, degrade or probe a Guardrail, the approval flow, or any rate or quota limit;
• break any law, or infringe anyone’s intellectual property, privacy or confidentiality rights;
• develop, test or deploy malicious code, or use the Service to attack, scan or disrupt any system;
• resell, sublicense, or expose the Service to third parties as though it were your own service, or use it to build or train a competing product;
• scrape, mirror or systematically extract the Service’s interface, prompts or skill definitions;
• interfere with the Service’s operation or with other customers’ use of it, including by automating traffic at a volume the Service is not offered at;
• misrepresent Output as reviewed, verified or human-authored where that matters to whoever receives it.

We may investigate suspected breaches and may take the steps in section 17. Where we can, we will tell you first.

12.Your operational responsibilities

Alongside the specific obligations above, you agree to:

• supervise Sessions that run against systems that matter, rather than approving requests without reading them;
• grant the SAP user the least access the work needs, and review that access periodically;
• keep your own backups — the Service is not a backup of your SAP system and stores no copy of it;
• make sure the people you let use your account know these terms and follow them, and remain responsible for what they do;
• tell us at sc4sap.dev@gmail.com if you find a vulnerability in the Service, give us reasonable time to fix it, and not exploit it beyond what proving it requires.

13.Ownership

Your Content stays yours

You keep all rights in Your Content. You grant us a worldwide, non-exclusive, royalty-free licence to host, store, process and transmit it strictly as needed to operate the Service for you — including sending it to the Model Provider to run a Session, and keeping the transcript so you can reopen it — and for no other purpose. That licence ends when the content is deleted, except for copies in backups until they age out.

We do not use Your Content to train models, and we do not sell it or share it with anyone beyond the providers needed to run the Service.

Output

As between you and us, and to the extent it is capable of ownership, Output generated for you in a Session is yours, and we claim no rights in it. Whether Output is protectable at all is a question of the law where you are, not something either of us can settle by contract.

The Service stays ours

The Service itself — its software, its skills and prompts, its interface, its documentation and our marks — remains ours and our licensors’. These terms grant you a non-exclusive, non-transferable, revocable right to use it while your account is in good standing, and nothing more. You will not copy, decompile, reverse engineer or create derivative works of it except where the law says you may despite this clause.

Feedback

If you send us feedback, ideas or bug reports, we may use them without restriction and without owing you anything. Keep confidential material out of feedback.

14.Confidentiality

Each of us may learn the other’s confidential information through this agreement. Each will protect it with at least reasonable care, use it only to perform this agreement, and disclose it only to people and providers who need it and are bound to equivalent obligations.

This does not cover information that is public through no fault of the receiver, was already known to it without an obligation of confidence, is received from a third party free to disclose it, or is independently developed without reference to the other’s material.

Either of us may disclose where the law or a court compels it, giving the other notice first where that is lawful and practical, and disclosing only what is required.

15.Fees, taxes and renewal

Fees for the Service are those of the plan you subscribe to, as shown on the billing screen. They are stated in Korean won and include value-added tax.

Payment, automatic renewal, cancellation, withdrawal and refunds are as separately determined.

As set out in section 6, model usage runs on our account. On the “Usage included” plan, model usage up to the monthly allowance is included in the fee.

16.Availability, support and change

The Service is offered as it is available. We may change, add or remove features, and we may take it down for maintenance. Where a change materially reduces functionality you rely on, we will give reasonable notice unless a security or legal reason makes that impossible.

Unless a plan or an order form says otherwise, we make no uptime commitment and offer support on a reasonable-efforts basis through the channels listed in the console.

Beta and preview features are labelled as such. They may change or be withdrawn at any time, may be less reliable than the rest of the Service, and carry no availability or support commitment of any kind. Do not depend on one for production work.

Parts of the Service depend on third parties — the Model Provider above all. An outage, a change or a restriction on their side can stop the Service from working, and that is outside our control.

17.Suspension and termination

By you

You may stop using the Service and close your account at any time. Whether fees already paid for the current period are refunded is as separately determined.

By us

We may suspend or terminate an account that breaches these terms, that creates a security, legal or operational risk, or that we are required to stop. We will act immediately where the risk is immediate; otherwise we will give notice and a reasonable chance to put it right. We may also discontinue the Service as a whole on reasonable notice, refunding the unused part of any fee you have prepaid as separately determined.

What happens next

On termination your right to use the Service ends and live Sessions stop. Export what you need before closing the account. Afterwards we delete or anonymise Your Content on the schedule in the privacy notice, except what we must keep by law.

Termination does not touch a Connected System. Objects created, changes written and transports recorded through the Service stay exactly where they are, and remain yours to manage.

Survival

Clauses that by their nature should outlive this agreement do: ownership, confidentiality, fees already due, disclaimers, limitation of liability, indemnity, governing law, and this sentence.

18.Disclaimers

To the fullest extent the law allows, the Service is provided as is and as available, without warranty of any kind — express, implied or statutory — including merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from a course of dealing or trade usage.

In particular, we do not warrant that the Service will be uninterrupted, timely or error-free, that a Guardrail will catch every case it was built for, that a Session will reach any given result, or that Output will be accurate, complete, current, non-infringing or suitable for your purposes.

Nothing in this section excludes a warranty or a right that cannot lawfully be excluded, and where the law gives you a right we cannot contract out of, that right stands.

19.Limitation of liability

We are not liable for loss that arises without intent or negligence on our part. Of loss caused by our slight negligence, loss arising from special circumstances is compensated only where we knew or could have known of those circumstances.

Our total liability for loss caused by our slight negligence is capped at the fees you paid us for the Service in the twelve months before the event giving rise to the claim.

The “fees you paid us” on which that cap is based do not include what you spend repairing, reverting or reworking a change made to a Connected System through your account.

These limits do not apply to:

• loss caused by the intent or gross negligence of us, our agents or our employees;
• harm to a person’s life or body;
• liability for damages set by statute, including the Personal Information Protection Act;
• any other liability that cannot be limited or excluded under the law of the Republic of Korea.

20.Indemnity

You will defend and indemnify us against third-party claims, and against the damages, losses and reasonable legal costs finally awarded or agreed in settlement, arising from:

• your use of the Service in breach of these terms;
• Your Content, or the use we make of it on your instruction;
• a change made to a Connected System through your account, including a claim that you were not authorised to connect that system;
• your use of Output, including a claim that it infringes someone’s rights.

We will notify you of the claim promptly, let you control the defence with counsel of your choice, and give you reasonable cooperation at your expense. You will not settle a claim in a way that admits fault on our part, or imposes an obligation on us, without our consent.

21.General

Assignment

You may not assign this agreement without our written consent. We may assign it to an affiliate or in connection with a merger, acquisition or sale of substantially all our assets, on notice to you.

Entire agreement, severability, waiver

This agreement, with the documents named in section 1, is the whole agreement between us about the Service and replaces anything said before it. If a clause is held unenforceable, it is narrowed to what is enforceable and the rest stands. Not enforcing a right once does not waive it.

Notices

Notices to you go to the email on your account or into the console. Notices to us go to sc4sap.dev@gmail.com, and are effective when we acknowledge them or on the next business day after delivery, whichever is earlier.

No third-party beneficiaries, no partnership

Only you and we may enforce this agreement. Nothing in it creates a partnership, joint venture, agency or employment relationship, and neither of us may bind the other.

Force majeure

Neither of us is liable for a delay or failure caused by something outside its reasonable control, including a failure of a network, a cloud provider or the Model Provider. Payment obligations already due are not excused.

Export and sanctions

You will comply with export control and sanctions laws that apply to your use of the Service, and you confirm you are not located in, or acting for anyone in, a territory those laws prohibit us from serving.

Language

These terms and the Privacy Policy are written in Korean. The English and Japanese translations are provided to help you understand them; where a translation differs from the Korean text, the Korean text governs. Where Korean consumer-protection law gives you something more favourable, that law applies.

22.Governing law and disputes

This agreement is governed by the laws of the Republic of Korea, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before filing anything, tell us what the dispute is at sc4sap.dev@gmail.com and give us thirty days to resolve it. If you are a consumer, you may also apply for damage relief or dispute mediation to a dispute mediation body such as the Korea Consumer Agency (한국소비자원).

Lawsuits are filed with the court having jurisdiction under the Civil Procedure Act (민사소송법). If you are a consumer, the court for the place where you are domiciled also has jurisdiction.

Nothing in this section removes a right you have as a consumer to bring proceedings where you live, and either of us may seek injunctive relief in any competent court to protect its intellectual property or confidential information.

23.Changes to these terms

We may update these terms as the Service changes. For a material change we will give notice — in the console or by email — at least thirty days before it takes effect, and the effective date and version at the top of this page will change with it.

Continuing to use the Service after the new terms take effect means you accept them. If you do not, close your account before that date; where you paid in advance, we will refund the unused part of the period as separately determined.

Minor changes — fixing a typo, clarifying wording that does not alter an obligation, or naming a new contact address — take effect when posted.

24.Contact

Questions about these terms, and any notice they require you to give us, go to sc4sap.dev@gmail.com.

Suspected vulnerabilities, exposed credentials and anything else that cannot wait go to sc4sap.dev@gmail.com.