Terms of Service

Effective date: August 8, 2026

These Terms of Service ("Terms") are a binding agreement between you and RAW DEVOPS LTDA, a Brazilian limited liability company enrolled with the CNPJ under no. 51.460.107/0001-53, with registered office at Avenida Portugal, 1148, Goiânia, State of Goiás, 74150-030, Brazil ("Runtz", "we", "us" or "our").

These Terms govern your access to and use of the Runtz services. By creating an account, starting a paid subscription, activating a license, accessing the hosted MCP server or otherwise using the Services, you agree to these Terms. If you use the Services for a company or other organization, you represent that you have authority to bind it, and "you" includes that organization.

If you do not agree to these Terms, do not use the Services.

1. Definitions and scope

Cloud Service means the Runtz software-as-a-service environment operated by us, including the hosted web application, engine and ingestion APIs.
Customer Content means the data and materials that you or your authorized users submit to the Services, including Scan Data, workspace names and other configuration. It does not include feedback or aggregated, de-identified information.
Documentation Services means the Runtz website, documentation and hosted, docs-only Model Context Protocol (MCP) server.
Order means an online checkout, order form or other written ordering document accepted by Runtz.
Scan Data means normalized information submitted by the CLI or other scanners, such as dependency and package inventories, vulnerabilities, findings, project and target names, file paths, hostnames, image identifiers, Kubernetes resource metadata and related technical information.
Self-Hosted Deployment means an instance of Runtz installed and operated in infrastructure controlled by you or on your behalf.
Services means the Cloud Service, Documentation Services, paid plans, license issuance and validation, support, and related services we make available. It does not include software made available solely under a repository license.
Software means the Runtz platform, engine, CLI, MCP server, skills and related software components distributed by or for Runtz.

An Order may contain additional terms. If an Order conflicts with these Terms, the Order controls only for the Services covered by that Order. The license included with a Software component controls the copying, modification and distribution of that component.

2. Eligibility, organizations and administrators

2.1. You must be at least 18 years old and legally capable of entering into these Terms.

2.2. You must provide accurate, current information and keep it updated. You are responsible for activity under your account, workspace, API keys and other credentials, except to the extent caused by our breach of these Terms.

2.3. If your account uses an email address controlled by an organization or is added to its workspace, the organization's administrator may manage your membership and access to Customer Content. The organization is responsible for its administrators and authorized users.

3. The Services

3.1. Runtz provides DevSecOps capabilities that currently include software composition analysis (SCA), static application security testing (SAST), host, container and Kubernetes scanning, scan ingestion, dashboards, APIs, CLI tooling, licensing and documentation. Features identified as previews, roadmap items or "coming soon" are not part of the Services until released.

3.2. We may improve or change the Services over time. We may also set or update reasonable technical, storage and usage limits. Current plan features and limits are shown on the pricing page, in the product or in the applicable Order.

3.3. We may use subcontractors and third-party infrastructure to provide the Services. We remain responsible for our obligations under these Terms.

3.4. No service-level commitment applies unless it is expressly included in an Order. We may perform maintenance and take measures reasonably necessary to protect the security or stability of the Services.

4. Accounts and security

4.1. Keep passwords, session access, API keys and license keys confidential. Do not share individual accounts. You must promptly revoke compromised API keys and notify us at [email protected] if you suspect unauthorized use.

4.2. You are responsible for configuring user roles and removing access when it is no longer required. API keys must be limited to the workspaces and systems for which they are intended.

4.3. We may reject registration, require verification, or suspend access when reasonably necessary to address fraud, abuse, a security risk, non-payment or a violation of these Terms. Where reasonably possible, we will notify you and provide an opportunity to cure the issue.

5. Customer Content and scans

5.1. As between you and Runtz, you retain all rights in Customer Content. You grant us a non-exclusive, worldwide, royalty-free license to host, transmit, process, reproduce and display Customer Content only as needed to provide, secure and support the Services, comply with law and enforce these Terms. This license ends when the relevant Customer Content is deleted from our active systems, subject to legal retention requirements and backup cycles.

5.2. You represent that you have the rights and lawful authority required to submit Customer Content and instruct us to process it. You must avoid including personal data, secrets or other confidential information that is not necessary for the scan or Service.

5.3. You may scan only repositories, systems, hosts, images, clusters and other targets that you own or are expressly authorized to assess. You are responsible for the scope, timing and impact of each scan and for obtaining all required authorizations.

5.4. Security results are informational and may contain false positives, false negatives, incomplete coverage or outdated third-party vulnerability data. The Services do not guarantee that a target is secure or compliant and do not replace professional security review, penetration testing, legal advice or your own risk management.

5.5. We may generate statistics from usage and Customer Content only after the information has been aggregated or de-identified so that it does not identify you, your users or your organization. We may use that information to operate, secure and improve Runtz.

6. Acceptable use

You must not, and must not help others to:

access, scan, test, attack, exploit or disrupt a system without authorization;
use the Services to develop or distribute malware, steal credentials, facilitate unlawful activity or infringe third-party rights;
submit unlawful, malicious or infringing content;
interfere with the Services or other users, including through excessive or automated traffic that bypasses documented limits;
probe or circumvent authentication, usage controls, plan restrictions, license validation or other security measures, except for good-faith security research conducted under our published Security Policy;
use another person's credentials or misrepresent your identity or authority;
resell, host or embed the Software as a competing commercial service except as expressly permitted by the applicable Software license or a written agreement with Runtz; or
remove proprietary notices or use Runtz trademarks in a way that suggests sponsorship or endorsement without our written permission.

We may throttle or suspend activity that violates this section or materially degrades the Services for others.

7. Plans, subscriptions and payment

7.1. Free and paid plan entitlements are described at checkout, on the pricing page or in an Order. Fees, billing currency, taxes and billing frequency are shown before purchase. Except where law requires otherwise, you are responsible for applicable taxes other than taxes based on our net income.

7.2. Paid online plans are recurring subscriptions processed by Stripe. You authorize Runtz and Stripe to charge the payment method associated with your subscription at each renewal until cancellation. We do not receive or store full payment-card numbers.

7.3. You may cancel or downgrade through the in-product billing flow or Stripe customer portal. Unless stated otherwise at purchase, cancellation takes effect at the end of the then-current paid period, you retain access through that period, and no cancellation penalty applies.

7.4. Fees already paid are non-refundable except as required by law or stated in an Order. A consumer entitled to the right of withdrawal under article 49 of the Brazilian Consumer Protection Code may withdraw from an eligible online purchase within seven days and receive the refund required by law. Requests may be sent to [email protected].

7.5. If a payment fails or becomes overdue, we may retry the charge and, after reasonable notice, suspend or downgrade paid features. You remain responsible for undisputed amounts due.

7.6. We may change prices prospectively. For an existing recurring online subscription, we will provide at least 30 days' notice and the new price will apply no earlier than the next renewal after that notice. You may cancel before the new price takes effect.

8. Self-hosted deployments and paid licenses

8.1. You are responsible for installing, securing, maintaining, backing up and operating a Self-Hosted Deployment and its underlying infrastructure. Your local accounts and Scan Data remain in that environment unless you choose to send information elsewhere.

8.2. Paid Self-Hosted Deployments contact the central Runtz licensing service to complete checkout or activation and periodically validate entitlement. The licensing service receives limited account, subscription, license and installation information; it does not receive your local Scan Data through the license heartbeat. Details are in the Privacy Policy.

8.3. Unless an Order says otherwise, each paid self-hosted License may be activated on one installation at a time. You may not remove, weaken, emulate or bypass the technical controls used to issue or validate paid entitlements.

8.4. A Self-Hosted Deployment may connect directly to services you configure, including identity providers, email services, vulnerability databases, container registries or observability systems. You are responsible for those connections and their terms.

9. Software and intellectual property

9.1. Runtz and its licensors own the Services, Documentation, branding and all related intellectual property, excluding Customer Content and third-party materials.

9.2. The Runtz platform and CLI are currently source-available under the Business Source License 1.1 (BUSL-1.1) and convert to the stated change license on the change date applicable to each release. Other components may use different licenses. The license file distributed with each component is the authoritative agreement for that component and is not replaced by these Terms.

9.3. These Terms do not grant rights to the Runtz name, logo or other marks except the limited right to identify the unmodified Services or Software truthfully.

9.4. If you voluntarily provide suggestions or feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free right to use it without restriction or compensation. This does not transfer ownership of Customer Content.

10. Confidentiality

10.1. Each party may receive non-public information that a reasonable person would understand to be confidential ("Confidential Information"). Customer Content is your Confidential Information. The receiving party will use Confidential Information only to perform or receive the Services and will protect it with at least reasonable care.

10.2. Confidential Information does not include information that is lawfully public, already known without confidentiality duty, independently developed, or lawfully received from a third party. A party may disclose information when legally required after giving notice where permitted.

11. Privacy and data protection

Our Privacy Policy explains how we process personal data. When we process personal data in Cloud Scan Data on behalf of your organization, your organization is the controller and Runtz acts as its operator/processor. You are responsible for providing lawful instructions and required notices to affected individuals.

12. Third-party services

The Services may interoperate with independent third parties, including Stripe, Google, GitHub, Resend, OSV, container registries and infrastructure providers. Their services are governed by their own terms and privacy notices. We are not responsible for a third party's service, content or availability, but this does not limit our responsibility for subprocessors we engage to perform our own obligations.

13. Suspension, termination and data handling

13.1. You may stop using the Services at any time and may request account closure by contacting [email protected] or [email protected]. Canceling a paid subscription does not automatically delete an account or Customer Content.

13.2. Either party may terminate an Order for an uncured material breach after reasonable written notice. We may suspend or terminate access immediately when necessary to prevent unlawful activity, an imminent security risk or material harm, or when a breach cannot reasonably be cured.

13.3. After termination or account closure, your right to use the affected Services ends. Before closure, you should retrieve any Customer Content you need. We will delete or anonymize Cloud Customer Content in accordance with the Privacy Policy, except to the extent retention is required by law or reasonably necessary for legal claims, fraud prevention or security.

13.4. Sections that by their nature should survive will survive termination, including payment obligations, intellectual property, confidentiality, disclaimers, liability limitations and general terms.

14. Disclaimers

To the maximum extent permitted by law, the Services are provided "as is" and "as available". We do not warrant that they will be uninterrupted, error-free, free of every vulnerability or suitable for every regulatory requirement. We disclaim implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.

Nothing in these Terms excludes a warranty, remedy or other right that cannot be excluded under the Brazilian Consumer Protection Code or other applicable law.

15. Limitation of liability

15.1. To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, exemplary, punitive or consequential damages, or for loss of profits, revenue, goodwill or data, arising from the Services, even if advised that such loss was possible.

15.2. For a business customer, each party's aggregate liability arising from the Services will not exceed the greater of (a) the amount paid or payable by you for the affected Services during the 12 months before the event giving rise to the claim or (b) BRL 500 if you used only free Services.

15.3. The exclusions and cap above do not apply to payment obligations, breach of confidentiality, infringement or misappropriation of the other party's intellectual property, fraud, willful misconduct, or liability that cannot be limited by law. Mandatory consumer rights are not limited.

16. Indemnification by business customers

If you use the Services for business purposes, you will defend and indemnify Runtz and its personnel against a third-party claim to the extent arising from (a) Customer Content that violates law or third-party rights; (b) your scan of a target without authorization; or (c) your material violation of Section 6. We will promptly notify you, allow you to control the defense and cooperate at your expense. You may not settle a claim in a way that admits fault by or imposes obligations on Runtz without our consent.

17. Changes to these Terms

We may update these Terms to reflect changes in the Services, law or security practices. We will post the updated version and its effective date. For a material change that adversely affects an existing user, we will provide at least 15 days' advance notice by email, in-product notice or another reasonable method, except when an earlier change is required by law or an urgent security need. If you do not agree, you must stop using the affected Services before the change takes effect.

18. Governing law and venue

These Terms are governed by the laws of the Federative Republic of Brazil, without regard to conflict-of-law rules. The parties elect the courts of the Judicial District of Goiânia, State of Goiás, Brazil to resolve disputes, to the exclusion of any other court, however privileged, except that a consumer may use the courts of their domicile or any other venue guaranteed by applicable law.

19. General terms

19.1. Neither party is liable for delay or failure caused by events beyond its reasonable control, except for payment obligations.

19.2. You may not assign these Terms or an Order without our prior written consent, except as part of a merger, reorganization or sale of substantially all relevant assets. We may assign them as part of a corporate reorganization or sale of the business, with notice where required by law.

19.3. If a provision is unenforceable, it will be adjusted only as necessary and the remaining provisions will remain effective. A failure to enforce a provision is not a waiver.

19.4. These Terms and applicable Orders are the entire agreement about the Services and supersede prior discussions on that subject. Headings are for convenience only. Electronic notices and acceptance have the same effect as written originals to the extent permitted by law.

20. Contact

Legal and consumer requests: [email protected]
Support and account closure: [email protected]
Privacy requests: [email protected]
Security reports: [email protected]
Licensing: [email protected]

RAW DEVOPS LTDA, CNPJ 51.460.107/0001-53, Avenida Portugal, 1148, Goiânia, GO 74150-030, Brazil