Terms of service

1. Who we are and what this covers

Stableship ("we", "us") provides a service that reviews software, tests private copies of applications, holds deployments, and produces findings, fixes and reports (the "Service"). These terms apply to the website at stableship.ai, the application at app.stableship.ai, the free URL scan, the free audit, paid plans, and any integration we provide.

2. Accounts and workspaces

You need an account to use anything beyond the free URL scan. You are responsible for activity under your account and for keeping sign-in methods secure. A workspace may have several members; the workspace owner is responsible for who they invite and for the roles they grant.

3. Authorization to scan and test

By requesting a URL scan you confirm that you own, or are authorized by the owner to test, the site you enter. We verify control through a DNS record or a meta tag before any scan runs, and the scan is passive: it reads only what a visitor's browser would receive.

By connecting a repository, database or hosting account you authorize us to read the code and configuration you select, to provision private test copies of your application, to create test accounts in those copies, and to run active tests against those copies, including attempts to access data across user roles, inject input, and reach protected pages. You confirm you have the right to grant this authorization for every project you connect. Active tests run only against test copies whose isolation from production we have confirmed. We never attack production systems.

You must not use the Service to test systems you do not own or are not authorized to test. We may suspend an account where we believe testing is unauthorized.

4. Deploy holds and fixes

Where you enable holds, we can delay a production deployment until a check passes or a person overrides it. Overrides are recorded with the name of the person who made them. Fixes we propose are suggestions; merging them is your decision unless you have selected an autonomy level that merges low-risk fixes for you, which you can change at any time.

5. Plans, checks and payment

Paid plans are billed monthly in advance. Included checks reset each billing period and unused checks roll over one month. Additional checks are bought explicitly and are never charged automatically. If you run out, deployments fall back to a quick check with a warning; nothing is blocked for lack of credit. You can cancel at any time; the plan stays active until the end of the period you paid for.

6. Your content and our use of it

You keep all rights to your code, data and findings. We use them only to provide the Service, to keep it secure, and to meet legal obligations. We do not use your code or data to train models, and we use model providers under zero-data-retention terms where available. Evidence such as traces and videos is kept for 30 days by default, and you can delete it sooner.

7. Reports

Scan reports and launch reports describe what was tested and found for one version of a system at one point in time. They are evidence, not a certification, warranty or guarantee that a system is free of defects or vulnerabilities. You may share them; we may revoke a published report if it was obtained through a false ownership claim.

8. Acceptable use

• Do not test systems you are not authorized to test.
• Do not attempt to make the Service act against production systems.
• Do not use the Service to build a competing product by systematic extraction of its output.
• Do not interfere with the Service, other customers, or our providers.

9. Availability and changes

We work to keep the Service available but do not promise uninterrupted operation. Our own failures, retries and verification never count against your plan. We may change features and these terms; for material changes we give notice by email or in the app at least 14 days before they take effect.

10. Disclaimer and limitation of liability

The Service is provided as is. To the fullest extent permitted by law, we disclaim implied warranties and are not liable for indirect, incidental or consequential damages, or for losses arising from vulnerabilities or defects the Service did not find. Our total liability for any claim is limited to the amount you paid us in the twelve months before the claim.

11. Termination and clean exit

You can leave at any time. Clean exit removes our configuration files through a pull request, restores your hosts' original deploy settings, revokes every token we hold, and deletes stored data within 7 days, except what we must keep by law.

12. Contact

Questions about these terms: hello@stableship.ai. Questions about scanning: scan@stableship.ai.