1. Acceptance of Terms
These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer," "User," or "you") and Vouch Security Inc. ("Vouch," "we," "us," or "our") governing your access to and use of the Vouch autonomous security platform, website (vouch.security and active deployment at https://vouch-eta-one.vercel.app/), developer console, APIs, GitHub App integrations, and CLI utilities (collectively, the "Service").
BY CREATING AN ACCOUNT, CONNECTING A GIT REPOSITORY, OR USING THE SERVICE, YOU AGREE TO BE BOUND BY THESE TERMS. IF YOU DO NOT AGREE, YOU MUST NOT ACCESS OR USE THE SERVICE.
2. Authorized Code Access & Scanning Policy
You represent and warrant that:
- You are the legal owner of, or have received explicit written authorization from the repository owner to submit, scan, and patch all codebases provided to the Service;
- Scanning the submitted repository does not violate any third-party intellectual property rights, employment agreements, or cybersecurity laws (including the CFAA, 18 U.S.C. § 1030);
- You will never use Vouch for unconsented reconnaissance, malicious exploitation, or harassment.
3. Account Registration & Workspace RBAC
You are responsible for maintaining the confidentiality of your session credentials and API keys. The designated Workspace Primary Owner has the exclusive authority to assign roles (OWNER, SECURITY_LEAD, DEVELOPER, AUDITOR, CUSTOM) and manage team seats.
4. Proprietary Rights & Customer Code Ownership
Customer Code Ownership: You retain all right, title, and interest in and to your source code, repositories, configuration files, and any patches synthesized by Vouch specifically for your codebase.
Zero Model Training: Vouch guarantees that your source code, repository structure, security findings, and patches will never be used to train public foundational AI models.
Vouch Platform IP: Vouch retains all right, title, and interest in and to the Service, including all AST parser engines, multi-agent algorithms, heuristics, logos, and UI frameworks.
5. AI Remediation & Patch Disclaimer
Remediation patches and vulnerability findings generated by Vouch are provided on an "AS-IS" basis. While Vouch performs deterministic sandbox testing and syntax validation, you are solely responsible for reviewing and testing all pull requests and code diffs before merging into production.
6. Subscriptions, Fees & Billing
Paid subscription plans (SWE, Enterprise, audit packages) are billed on a recurring monthly or annual basis via Stripe, Inc. You may cancel or modify your subscription at any time via Account Settings (/settings).
7. Integrated Third-Party Services & Sub-Processors
To provide comprehensive automated security scanning, authentic telemetry, and verified code delivery, the Service integrates with vetted third-party infrastructure and sub-processors:
- PostHog, Inc.: Product analytics, operational runtime telemetry, and user interaction diagnostics.
- PostgreSQL Serverless Cluster: Serverless PostgreSQL database infrastructure, connection pooling, and live telemetry persistence.
- GitHub (Microsoft Corporation): Developer platform OAuth authentication, repository code tree inspection, webhook event ingestion, and pull request bot review comments.
- Resend, Inc.: Transactional security alerts and inbound service request triage notifications.
- Vercel, Inc.: Edge infrastructure, static asset delivery, and serverless compute hosting.
- Stripe, Inc.: Payment processing, invoicing, and PCI-DSS compliant subscription billing.
8. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL VOUCH SECURITY INC. BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES (INCLUDING LOSS OF PROFITS, DATA, OR CODE CORRUPTION) ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE SERVICE.
9. Governing Law & Jurisdiction
These Terms shall be governed by and construed in accordance with the laws of the State of Delaware, United States. Any disputes arising hereunder shall be resolved exclusively in the state or federal courts located in New Castle County, Delaware.