Terms of Service
Version 1.0.0 · last reviewed 2026-09-19. Structure fixed by legal review; wording subject to final review before launch.
1. The service
An automated release attestation service: published, versioned audit scripts are executed on the release you designate, in an ephemeral sandbox with AI assistance. Automated checks executed in an ephemeral sandbox with AI assistance; not a human audit.
2. What an attestation is and is not
An attestation is signed evidence that named scripts ran on a named build and produced the recorded outcome. Auditor certifies and guarantees only this: the listed checks were executed by Auditor on this exact release (hash), under the published criteria (script versions), and the result is signed by Auditor. Everything needed to audit that claim is published. Whether to trust it is up to the reader. Not an accredited certification; not an EU cybersecurity certificate; not an ISO or PCI DSS certification. It is not a warranty of the quality or fitness of your software.
3. Obligation of means
The provider undertakes an obligation of means: to execute the scripts faithfully and record the outcome. No result is guaranteed.
4. Accounts and organisations
The organisation is the contracting unit. Owners and admins must use a second authentication factor for privileged actions. CI tokens are scoped, expire and can be revoked at any time.
5. Fees
Runs are billed as quoted before they start. Prepaid credits are consumed per run. Failed executions caused by the provider are not billed. A check the provider could not execute is never recorded as a failure of your release: the suite is attested as incomplete, grants no attestation badge and is not billed — the run is refunded in full when no suite could be completed, and otherwise a free retry of those checks is credited.
6. Liability
Aggregate liability is limited to the greater of the fees paid in the 12 months preceding the claim or EUR 10000. Indirect and consequential damages are excluded. Nothing limits liability for wilful misconduct or gross negligence.
7. Claims
Claims must be notified in writing within 12 months of the event giving rise to them.
8. Incidents
Incidents caused by the service are notified within 24 hours of detection, with a detailed account within 72 hours.
9. Governing law and forum
Laws of Spain; disputes before the courts of the city of the provider's registered office (Spain). Enterprise customers established in the United States may elect arbitration seated in Madrid, conducted in English. Jury trial and class actions are waived to the extent permitted by law.
10. Changes
A newer version replaces this one for runs started after its publication; the version accepted for each run is recorded.