Terms of Service

DRAFT — pending legal review. Placeholders are marked with [BRACKETS].

Effective date: [SET BEFORE PUBLISHING]

These Terms of Service ("Terms") govern the use of the Runtz platform and services. Runtz is a product of RAW DEVOPS LTDA, a limited liability company organized under the laws of Brazil, registered under CNPJ 51.460.107/0001-53, with registered address at [FULL REGISTERED ADDRESS] ("Runtz", "we", "us").

By creating an account, activating a license, or using the Services, you agree to these Terms. If you use the Services on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to it.

1. Definitions

Platform — the Runtz DevSecOps software, including the web application, ingestion API, engine and command-line interface (CLI).
Cloud Service — the hosted version of the Platform operated by us at runtz.dev.
Self-Hosted Deployment — an instance of the Platform that you install and operate in your own environment.
Scan Data — data submitted to the Platform by scanners, including dependency inventories, package inventories, findings, vulnerability matches, hostnames, image names and related metadata.
License — a paid entitlement (e.g., Pro or Enterprise) issued by us, including licenses activated on Self-Hosted Deployments.

2. The Services

2.1. We provide security scanning features including SCA, SAST, host, container and Kubernetes scanning, dashboards, ingestion APIs and related tooling, on the Cloud Service and/or for Self-Hosted Deployments.

2.2. The Platform's source code is made available under the Business Source License 1.1 (BUSL-1.1). These Terms govern your use of the Services (including the Cloud Service, license issuance, activation and billing) and do not replace or modify the source-code license. In case of conflict regarding use of the source code, the BUSL-1.1 license prevails.

2.3. Self-Hosted Deployments with paid plans require activation against our central licensing service and periodically validate the license through a heartbeat. One installation is allowed per license unless your plan states otherwise.

3. Accounts

3.1. You must provide accurate information and keep your credentials secure. You are responsible for all activity under your account and API keys.

3.2. You must be at least 18 years old to use the Services.

3.3. We may suspend accounts that violate these Terms, present a security risk, or are past due, with notice where reasonably possible.

4. Acceptable Use

4.1. The Platform is a security assessment tool. You may only scan systems, repositories, hosts, images and clusters that you own or are explicitly authorized to assess. You are solely responsible for obtaining such authorization.

4.2. You must not:

use the Services to attack, exploit or gain unauthorized access to systems of third parties;
resell, host or embed the Platform to offer a competing commercial service, except as permitted by the BUSL-1.1 license;
interfere with or disrupt the integrity of the Services, circumvent usage limits, license validation or security controls;
submit content that is unlawful or infringes third-party rights;
use the Services to develop malware or to facilitate illegal activity.

4.3. We may throttle or suspend usage that degrades the Services for other customers.

5. Plans, Billing and Payments

5.1. Paid plans (e.g., Pro, Enterprise; cloud or self-hosted) are billed as subscriptions processed by our payment provider, Stripe. We do not store full card numbers; payment data is handled by Stripe under its own terms and privacy policy.

5.2. Subscriptions renew automatically at the end of each billing cycle until canceled. You can cancel at any time through the in-app billing screen or the Stripe customer portal; cancellation takes effect at the end of the current billing period, and already-paid amounts are non-refundable except as stated below or required by applicable law.

5.3. Refunds. Under the Brazilian Consumer Protection Code (CDC, art. 49), consumers who purchase online may withdraw within 7 (seven) days of purchase for a full refund. For business customers, refunds are otherwise granted at our discretion or where required by law.

5.4. Prices may change with at least 30 days' notice; changes apply from the next renewal. Taxes are your responsibility where applicable.

5.5. If payment fails, we may downgrade or suspend paid features after reasonable notice and retry attempts.

6. Scan Data and Your Content

6.1. You retain all rights to your Scan Data and other content you submit. You grant us a non-exclusive license to host, process and display it solely to provide and improve the Services.

6.2. You are responsible for ensuring that submitting Scan Data (which may include system details of your infrastructure) complies with your internal policies and applicable law.

6.3. Scan results are informational. They may contain false positives or miss vulnerabilities. The Services do not guarantee that scanned systems are secure, and results are not a substitute for professional security review.

6.4. We may use aggregated, de-identified usage data to operate and improve the Services.

7. Intellectual Property

The Platform, including its source code, trademarks and branding, belongs to RAW DEVOPS LTDA and its licensors. The source code is licensed under BUSL-1.1 (converting to MPL-2.0 per its terms). "Runtz" and the Runtz logo may not be used without our prior written consent, except as required to identify unmodified copies of the software.

8. Feedback

If you send feedback or suggestions, we may use them without restriction or compensation.

9. Third-Party Services

The Services integrate with third-party services (e.g., Stripe for billing, Google and GitHub for sign-in, Resend for transactional email, GitHub Security Advisories and OSV for vulnerability data). Their availability and terms are outside our control.

10. Warranty Disclaimer

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. THIS SECTION DOES NOT LIMIT MANDATORY CONSUMER RIGHTS UNDER BRAZILIAN LAW.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW: (a) NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR LOSS OF PROFITS, REVENUE OR DATA; AND (b) OUR TOTAL LIABILITY ARISING FROM THE SERVICES IS LIMITED TO THE AMOUNTS YOU PAID US IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY (OR BRL 500 IF YOU PAID NOTHING). NOTHING IN THESE TERMS EXCLUDES LIABILITY THAT CANNOT BE EXCLUDED UNDER APPLICABLE LAW.

12. Indemnification

You will indemnify us against third-party claims arising from your unlawful use of the Services, including scanning systems without authorization.

13. Termination

13.1. You may stop using the Services and delete your account at any time.

13.2. We may terminate or suspend access for material breach of these Terms (including Section 4), with notice where reasonably possible.

13.3. Upon termination, your right to use paid features ceases. We will make your Scan Data available for export for 30 days after termination of the Cloud Service, unless legal obligations require otherwise.

14. Changes to the Services and Terms

We may update the Services and these Terms. For material changes we will give at least 15 days' notice (e.g., by email or in-app notice). Continued use after the effective date constitutes acceptance.

15. Governing Law and Venue

These Terms are governed by the laws of the Federative Republic of Brazil. Disputes will be resolved in the courts of [CITY/COMARCA OF THE COMPANY'S REGISTERED OFFICE], Brazil, except that consumers may choose the courts of their domicile as provided by Brazilian law.