Terms of Service

1. These Terms and who you are contracting with

These Terms of Service ("Terms") form a binding agreement between you and the provider identified below ("Assurly", "we", "us", "our"). They govern your use of the Assurly website, hosted dashboard, command-line scanner, MCP server, GitHub integration, public badge and trust pages, and verdict API (together, the "Service").

• Tibor Kútik
• Address: Hlavná 454, 941 33 Kolta, Slovak Republic
• VAT identification number: not registered for VAT
• Contact: our contact form (select Terms of Service)

By creating an account, installing the CLI or the GitHub App, calling our API, or otherwise using the Service, you accept these Terms. If you do not accept them, do not use the Service.

If you use the Service on behalf of a company or other organisation, you confirm that you are authorised to bind that organisation, and "you" means that organisation.

1.1 Consumers and business customers

A consumer is a natural person acting wholly or mainly outside their trade, business, craft, or profession. Everyone else is a business customer. Some sections below apply only to one group and say so. Nothing in these Terms limits or excludes mandatory rights you have as a consumer under the law of your country of residence.

1.2 Documents that form part of this agreement

Our Privacy Policy explains how we process personal data and forms part of these Terms. If you are an OEM or platform customer with a signed order form or separate agreement, that document prevails over these Terms where the two conflict.

2. Eligibility, accounts, and API keys

You must be at least 18 years old to enter into these Terms and to purchase a paid plan. Assurly is a professional developer tool and is not directed at children.

You sign in with GitHub. You are responsible for keeping your GitHub account secure, for everything done under your Assurly account, and for the acts and omissions of the members you add to your workspace. Tell us promptly if you believe your account or a workspace has been accessed without authorisation.

API keys are shown to you once, at creation. We store only an irreversible hash of the key, never the key itself, so we cannot recover it for you. You are responsible for keeping keys secret and for all usage made with them. Revoke a key immediately if you suspect it has been exposed.

3. What the Service does

Assurly checks an application before you deploy it. It runs in several ways:

• CLI scanner: runs entirely on your machine or in your own CI/CD runner.
• Manual web checker: pasted snippets, selected folders, and ZIP files are analysed in your browser.
• GitHub scans: public, connected, and webhook-triggered scans of repositories you authorise.
• Live URL probes: requests made to a target URL whose ownership you have verified through the Service.
• MCP server and verdict API: programmatic access to scans and verdicts for your own tooling and AI agents.

Our GitHub web integrations transmit repository content through Assurly's servers transiently, as described in our Privacy Policy. We store scan metadata and findings — including file paths, line numbers, and messages — but we do not retain complete repository source files.

A scan produces findings, a verdict, and a Ship Score. Depending on your plan it may also produce AI-assisted explanations, proposed fix pull requests, regression alerts, a public badge, and a trust page.

5. Plans

Prices are also shown in US dollars ($19 / month, $149 / year). The currency and amount you will be charged are displayed before you confirm. OEM and platform access is agreed separately and is not purchasable from the pricing page.

Plan features may change as the Service develops; section 14 explains how we handle changes.

6. Fees, free trial, billing, and renewal

6.1 The price you pay

The amount displayed at checkout is the total amount payable for the billing period. Any tax we are required to charge is shown separately before you confirm. Payments are processed by Stripe; we never receive or store your full card number.

6.2 Free trial

Pro includes a 3-day free trial. You provide a payment method at checkout, but no payment is taken during the trial. Unless you cancel before the trial ends, the subscription converts automatically into a paid subscription and we charge the plan price to your payment method. One trial per customer and payment method. We may withdraw or shorten a trial where it is being abused.

6.3 Automatic renewal

Paid subscriptions renew automatically at the end of each billing period — monthly or annual, matching the plan you chose — for a further period of the same length, at the then-current price for your plan, until you cancel. We charge the payment method on file on each renewal date. You can cancel at any time under section 7.

6.4 Price changes

We may change our prices. If a change affects your existing subscription, we will notify you by email at least 30 days before it takes effect. The new price applies from your next renewal, never to a period you have already paid for, and you may cancel before it takes effect.

6.5 Failed payments

If a payment fails, Stripe retries it according to its standard schedule. If the subscription lapses, your workspace returns to the Free plan. We do not delete your scan history solely because a payment failed.

7. Cancelling your subscription

You can cancel at any time from Manage billing in the dashboard, which opens the Stripe billing portal. No reason is required and no cancellation fee applies. If you cancel during the free trial, no payment is taken and the workspace returns to the Free plan immediately.

Cancelling stops future renewals. Your Pro access continues until the end of the period you have already paid for, after which the workspace returns to the Free plan. On the Free plan your existing data is retained, but Pro-only features stop and you cannot add guarded apps beyond the Free limit.

Outside the statutory withdrawal right in section 8, fees already paid for the current period are not refunded on cancellation, except where applicable law requires it or where these Terms say otherwise.

To delete your account entirely, contact us through our contact form. Deletion removes your workspace records, except those we must keep for legal reasons such as invoices — see the retention table in our Privacy Policy.

9. Your code and your data

You retain all rights in your source code, configurations, and content ("Your Content"). We claim no ownership of it.

You grant us a limited, worldwide, non-exclusive, royalty-free licence to host, copy, transmit, parse, analyse, and display Your Content solely to the extent needed to operate the Service for you, and only for as long as needed. We do not use Your Content to train machine-learning models, and we do not sell it.

Auto-fix pull requests: where you enable them, we open pull requests against your repository containing proposed changes. We never merge them. You are responsible for reviewing, testing, and deciding whether to merge any proposed change.

Public badges, trust pages, and share links: if you enable one, you authorise us to publish the associated verdict, Ship Score, and finding summary for that target. A share link is accessible to anyone holding it until you revoke it. You can revoke or disable these at any time.

You confirm that you have the right to submit Your Content to the Service and to authorise the scanning and probing you request. Please do not deliberately submit live production secrets or credentials.

Feedback: if you send us suggestions, we may use them freely to improve the Service without obligation to you.

10. Our intellectual property and open-source components

The hosted Service, the dashboard, our detection rules and scoring logic, and the Assurly name, logo, and visual identity are our property or that of our licensors, and are protected by intellectual property law. These Terms grant you a limited, revocable, non-exclusive, non-transferable right to use the Service for your own internal, business, or educational purposes — nothing more.

Our published npm packages — assurly, @assurly/scanner-core, and @assurly/mcp-server — are distributed under the MIT License. That licence governs your use of those packages, and nothing in these Terms restricts the rights it grants you. It does not grant rights in our name, logo, or trademarks, or in the hosted Service.

The Service includes third-party open-source components licensed under their own terms.

Except where mandatory law permits it or the MIT License allows it, you may not copy, modify, reverse engineer, or create derivative works of the hosted Service, or remove proprietary notices.

12. Third-party services

The Service depends on GitHub (sign-in and repository access), Stripe (payments), Anthropic (AI features), Supabase (authentication and database), Vercel (hosting), and Resend (email). Your use of those providers' own products is governed by their terms, and we are not responsible for their availability or for changes they make.

You can revoke our access at any time by uninstalling the GitHub App or revoking the OAuth authorisation in your GitHub settings. Doing so will disable the features that depend on it.

13. AI features

AI deep review and generated remediation prompts are optional features powered by Anthropic's Claude models. When you use them, you are interacting with an AI system. Section 6 of our Privacy Policy sets out exactly what is sent and what is not.

AI output is generated automatically, is advisory, and may be inaccurate, incomplete, or outdated. It must not be your sole basis for a security decision — apply your own review before acting on it. AI output does not make decisions producing legal or similarly significant effects concerning you.

We may apply fair-use limits to AI features to keep the Service available for everyone.

14. Availability and changes to the Service

We work to keep the Service available, but the Free and Pro plans come with no uptime commitment or service level agreement. Access may be interrupted by maintenance, third-party outages, or events outside our control. OEM and platform customers may agree separate service levels in writing.

We may modify the Service — for example to add or adapt features, respond to security issues, keep pace with the platforms we integrate with, or comply with the law. Where a modification goes beyond what is needed to keep the Service in conformity and negatively affects your access or use in more than a minor way, we will:

• make the modification at no additional cost to you;
• inform you at least 30 days in advance, on a durable medium, of the features affected and the date of the change; and
• allow you to terminate free of charge within 30 days of receiving that notice, or of the change taking effect if later, with a pro-rata refund of fees you have paid for the unused remainder of the period.

If we discontinue the Service entirely, we will give at least 30 days' notice and refund the unused portion of any prepaid fees.

15. Statutory guarantee of conformity — consumers

This section applies only if you are a consumer in the European Union, the European Economic Area, or the United Kingdom.

We are liable to you for any lack of conformity of the digital service that exists at the time of supply and becomes apparent within the period set by applicable law — for a subscription supplied continuously, throughout the period of supply.

If the Service is not in conformity, you are entitled to have it brought into conformity, and where that is impossible, disproportionate, or not done within a reasonable time, to a proportionate price reduction or to terminate the contract, in each case as provided by law. Nothing in sections 16 and 17 limits these rights.

17. Limitation of liability

Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct, or for any other liability that cannot lawfully be excluded — including liability under mandatory consumer protection or product liability law.

Subject to that paragraph, and to the fullest extent permitted by law:

• we are not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, business, goodwill, or anticipated savings;
• we are not liable for losses arising from a security issue the Service did not detect, from acting or failing to act on a finding, verdict, Ship Score, or AI-generated suggestion, or from merging a proposed fix;
• we are not liable for outages, database connection pool exhaustion, data loss, unverified or spoofed payment webhooks, exposed secrets, or breaches affecting your own systems or those of your providers; and
• our total aggregate liability for all claims arising out of or relating to the Service is limited to the greater of the fees you paid us in the 12 months before the event giving rise to the claim and €100.

If you are a consumer, the exclusions above apply only to the extent permitted by law; we remain liable for foreseeable loss caused by our breach of a material obligation under these Terms.

If you are a business customer, you must bring any claim within 12 months of becoming aware of the circumstances giving rise to it.

18. Indemnity — business customers

This section applies only to business customers.You will indemnify and hold us harmless against claims, losses, and reasonable costs arising from your breach of section 11 (acceptable use), from scanning or probing a system you were not authorised to test, or from Your Content infringing a third party's rights. We will notify you of any such claim and will not settle it without your consent, not to be unreasonably withheld.

19. Suspension and termination

You may stop using the Service, cancel your subscription, or request account deletion at any time.

We may suspend or terminate your access if you materially breach these Terms, use the Service unlawfully, put the Service or other users at risk, or fail to pay. Where it is reasonable and lawful to do so, we will give you notice and an opportunity to put the breach right first; we may act immediately in serious cases such as unauthorised scanning or an active threat to the Service.

If we terminate for a reason other than your material breach, we refund the unused portion of any prepaid fees. On termination your right to use the Service ends; sections 9, 10, 16, 17, 18, 21, and 22 survive.

20. Changes to these Terms

We may update these Terms to reflect changes to the Service, our business, or the law. We will update the "Last updated" date above.

For changes that materially affect your rights or obligations, we will give you at least 30 days' notice by email or in the application before they take effect. If you do not accept them, cancel before the effective date and we will refund the unused portion of any prepaid fees. Continuing to use the Service after that date means you accept the updated Terms.

21. Governing law, jurisdiction, and disputes

These Terms are governed by the law of the Slovak Republic, excluding its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods.

If you are a consumer, this choice of law does not deprive you of the protection of mandatory provisions of the law of your country of habitual residence, and you may bring proceedings in the courts of your place of domicile.

If you are a business customer, the courts of the Slovak Republic have exclusive jurisdiction.

21.1 Complaints and alternative dispute resolution

Please contact us first through our contact form — most issues are resolved quickly. We aim to respond substantively within 30 days.

If you are a consumer and we cannot resolve the matter, you may refer the dispute to an alternative dispute resolution body. In Slovakia the competent body is the Slovenská obchodná inšpekcia (Slovak Trade Inspection), soi.sk, under Act No. 391/2015 Coll. on alternative resolution of consumer disputes. Consumers elsewhere in the EEA can find their national body through their European Consumer Centre.

The European Commission's Online Dispute Resolution platform ceased operating on 20 July 2025 and is no longer available.

22. General

• Entire agreement: these Terms and the Privacy Policy are the entire agreement between us regarding the Service and replace any earlier understanding, save for a signed OEM order form, which prevails where it conflicts.
• Severability: if a provision is held invalid, the rest remains in force and the invalid provision is replaced by the closest valid equivalent.
• No waiver: not enforcing a right does not waive it.
• Assignment: you may not assign these Terms without our consent. We may assign them to a successor in connection with a merger, acquisition, or sale of assets, on notice to you; if you are a consumer and this worsens your position, you may terminate free of charge.
• Force majeure: neither party is liable for failure caused by events beyond its reasonable control.
• Notices: we contact you at the email address on your account; you contact us through the contact form.
• Language: these Terms are concluded in English, and the English version governs. Any translation is for convenience only.
• No third-party rights: no one other than you and us has the right to enforce these Terms.

23. Contact

Questions about these Terms, cancellations, and withdrawal declarations all go through our contact form, which opens with the Terms of Service subject already selected. Using the form means your message reaches us with the right category and is not lost to a spam filter.