Terms of Service

1. Agreement

These Terms of Service (the "Terms") form a binding agreement between you and VibeLock LLC, a Delaware limited liability company ("VibeLock", "we", "us"). They govern your access to and use of the VibeLock platform, website, documentation, MCP agent and any related services (together, the "Service").

By creating an account, accessing the Service, or clicking to accept, you agree to these Terms. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity.

If you do not agree to these Terms, do not use the Service.

2. What VibeLock is, and what it is not

The Service provides checklists, structured prompts, trackers, generated documents and a numerical rating that reflect information you supply and work you record. It is an organisational and record-keeping tool.

• VibeLock is not a code scanner, penetration test, or vulnerability remediation service.
• VibeLock does not certify you as compliant with any framework, and is not a certification body, notified body, or auditor.
• The Service reports which published security requirements your application demonstrably meets, computed from evidence the Service observes about your application together with the profile you describe. It is not a third-party audit, attestation, or certification. It does not state that your application is secure, compliant, or ready to be released, and it does not mean your application cannot be compromised.
• Generated policies and documents are produced automatically and have not been reviewed by a lawyer. VibeLock is not a law firm and does not provide legal advice.
• Nothing in the Service constitutes legal, regulatory, financial, or professional compliance advice.

3. Eligibility and accounts

• You must be at least 18 years old and able to form a binding contract.
• You must provide accurate registration information and keep it current.
• You are responsible for all activity under your account, including activity by your team members.
• You must keep your credentials confidential and enable multi-factor authentication where offered. Notify us at security@vibelock.ai promptly if you suspect unauthorised access.
• You may not share a single seat between multiple individuals, or resell access.

4. Authorised use only

This section is important and is not boilerplate. The Service produces guidance, prompts and techniques for examining software systems for security weaknesses.

You represent and warrant that you will use the Service only in respect of systems, applications, repositories, accounts and infrastructure that you own or are expressly authorised in writing to assess.

Applying the Service, its prompts, or its guidance to systems you do not own or are not authorised to test may violate the Computer Fraud and Abuse Act, the UK Computer Misuse Act, the EU Directive on attacks against information systems, and equivalent laws elsewhere. You are solely responsible for obtaining any authorisation required, and you accept full responsibility for the consequences of failing to do so.

We may suspend or terminate your account immediately, without refund, if we reasonably believe you have breached this section.

5. Acceptable use

You agree not to, and not to permit any third party to:

• Use the Service to attack, disrupt, or gain unauthorised access to any system.
• Copy, redistribute, resell, sublicense, or publish the prompt library, checklist content, threat templates or policy templates, in whole or in substantial part. This content is proprietary and is the core of the Service.
• Reverse engineer, decompile, or attempt to derive source code of the Service, except to the extent this restriction is prohibited by applicable law.
• Use automated means to scrape or bulk-export Service content beyond the export functions we provide.
• Upload malware, or content that infringes third-party rights or violates applicable law.
• Circumvent usage limits, plan restrictions, rate limits, or access controls.
• Use the Service to develop a competing product, or to benchmark it for publication without our prior written consent.
• Misrepresent what the Service reported about your application, including by presenting it as a certification, audit, attestation, or third-party verification, or by describing it as a statement that your application is secure or ready to be released.

6. Your content

You retain all rights in the information, code excerpts, documents and other material you submit to the Service ("Your Content"). You grant us a limited, non-exclusive, worldwide licence to host, process, transmit and display Your Content solely to provide, secure and support the Service, and to comply with law.

You represent that you have the rights necessary to submit Your Content and that doing so does not violate any law or third-party right, including any confidentiality obligation you owe to an employer or client.

We do not use Your Content to train machine learning models.

7. Artificial intelligence features

Parts of the Service use third-party large language models to generate documents, explanations and analysis. You acknowledge that:

• Model output can be inaccurate, incomplete, outdated, or wrong, and must be reviewed by a competent human before it is relied on.
• Where you use a feature that transmits code or text to a model provider, that content is sent to our provider for processing and is then discarded. We do not retain it. See the Privacy Policy for detail.
• Generated policies and legal documents are drafts. They carry a disclaimer that they were AI-generated and not reviewed by a lawyer, and you must not remove it.
• You are responsible for how you use model output, including any decision you take on the basis of it.

8. Plans, fees and billing

• Paid plans are billed in advance, monthly or annually, through our payment processor. Fees are stated in US dollars and exclusive of taxes unless stated otherwise.
• Subscriptions renew automatically for successive periods until cancelled. You may cancel at any time from account settings, effective at the end of the current billing period.
• Except where stated in our Refund Policy or required by law, fees are non-refundable and we do not provide credits for partial periods.
• We may change pricing on at least 30 days notice, effective at your next renewal. Continuing to use the Service after that constitutes acceptance.
• You are responsible for all applicable taxes other than taxes on our net income.
• If payment fails, we may suspend access after reasonable notice.

9. Free plan and beta features

Free plan access and any feature designated beta, preview or early access is provided as-is, may change or be withdrawn at any time, and may be subject to additional terms. Availability commitments do not apply to them.

10. Trust pages and published content

The Service allows you to publish a trust page and policy documents at a VibeLock URL. You are solely responsible for the accuracy of what you publish and for any claim it makes about your security posture.

Published pages carry a notice stating that the controls were verified by us from evidence observed at a stated commit and that this does not constitute third-party certification or audit. You may not remove, obscure or contradict that notice.

We may remove published content that we reasonably believe is misleading, unlawful, or in breach of these Terms.

11. Intellectual property

The Service, including its software, content, checklists, prompt library, templates, the control catalogue and its mapping to published requirements, and the VibeLock name and marks, is owned by us and protected by intellectual property law. The requirements themselves are published by their own authors and are not ours. Except for the limited right to use the Service under these Terms, no rights are granted to you.

If you send us feedback or suggestions, you grant us an unrestricted, perpetual, royalty-free right to use them without obligation to you.

12. Third-party services

The Service integrates with third-party services such as source control, payment processing and model providers. Your use of those services is governed by their terms, and we are not responsible for them. A current list of the subprocessors we use is published on our Subprocessors page.

13. Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT THE SERVICE WILL IDENTIFY ALL SECURITY WEAKNESSES IN YOUR APPLICATION, THAT ANY RATING OR CHECKLIST REFLECTS YOUR ACTUAL SECURITY POSTURE, THAT USE OF THE SERVICE WILL PREVENT A SECURITY INCIDENT OR DATA BREACH, OR THAT IT WILL SATISFY ANY REGULATOR, AUDITOR, CUSTOMER OR INVESTOR.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

14. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS INTERRUPTION, OR THE COST OF SUBSTITUTE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE AMOUNT YOU ACTUALLY PAID US IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IF YOU HAVE PAID US NOTHING, OUR TOTAL LIABILITY IS ONE HUNDRED US DOLLARS.

IN PARTICULAR, WE ARE NOT LIABLE FOR ANY SECURITY INCIDENT, BREACH, REGULATORY ACTION, FINE, LOST CUSTOMER, FAILED AUDIT, OR FAILED FINANCING AFFECTING YOU OR YOUR USERS, WHETHER OR NOT THE SERVICE IDENTIFIED THE UNDERLYING ISSUE.

THESE LIMITS APPLY REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THEY DO NOT APPLY TO LIABILITY THAT CANNOT BE LIMITED BY LAW, INCLUDING FRAUD, WILFUL MISCONDUCT, OR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE.

15. Indemnity

You will defend, indemnify and hold us harmless from any claim, demand, loss, liability, fine and expense (including reasonable legal fees) arising from: your use of the Service; Your Content; your breach of these Terms, in particular the Authorised Use section; your publication of a trust page or generated document; and any claim that your assessment of a system you were not authorised to assess caused harm.

16. Term, suspension and termination

• These Terms apply while you have an account. You may terminate at any time by deleting your account.
• We may suspend or terminate access immediately for breach of the Authorised Use or Acceptable Use sections, non-payment after notice, or where required by law.
• On termination, your right to use the Service ends. Export your data first: account data is retained for 90 days after cancellation and then permanently deleted, and published trust pages go offline 30 days after cancellation.
• Sections that by their nature should survive termination do so, including intellectual property, disclaimers, limitation of liability, indemnity and dispute resolution.

17. Changes to the Service and these Terms

We may modify the Service, and may update these Terms. For material changes we will give notice by email or in-app at least 30 days before they take effect, unless a shorter period is required by law or the change is necessary for security. Continued use after the effective date constitutes acceptance. If you do not agree, stop using the Service and cancel.

18. Governing law and dispute resolution

These Terms are governed by the laws of the State of Delaware, excluding its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods.

PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS HOW DISPUTES ARE RESOLVED.

Before filing any claim, the parties will attempt in good faith to resolve it informally by written notice to legal@vibelock.ai, allowing 30 days to reach resolution.

Any dispute not resolved informally will be brought exclusively in the state or federal courts located in Delaware, and both parties consent to that venue and to personal jurisdiction there.

Either party may bring an individual action in small claims court, and either party may seek injunctive relief in any court of competent jurisdiction to protect intellectual property or to address unauthorised access.

Nothing in this section deprives a consumer of mandatory protections, or of the right to bring proceedings in their country of residence, where local law provides that right.

19. Export control and sanctions

You represent that you are not located in, ordinarily resident in, or organised under the laws of any country or region subject to comprehensive US sanctions, and that you are not on any US, UK or EU restricted party list. You will not use or export the Service in violation of applicable export control or sanctions laws.

20. Copyright complaints

If you believe content on the Service infringes your copyright, send a notice under the Digital Millennium Copyright Act to legal@vibelock.ai, including the elements required by 17 U.S.C. § 512(c)(3). We will respond appropriately and may terminate the accounts of repeat infringers.

21. General

• Entire agreement. These Terms, with the Privacy Policy and any order form, are the entire agreement between the parties on this subject.
• Severability. If any provision is unenforceable, it is modified to the minimum extent necessary and the rest remains in effect.
• No waiver. Failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these Terms without our written consent. We may assign them in connection with a merger, acquisition or sale of assets.
• Force majeure. Neither party is liable for delay caused by events beyond its reasonable control.
• Relationship. The parties are independent contractors. Nothing creates a partnership, agency or employment relationship.
• Notices. We may send notices to your account email. Send notices to us at legal@vibelock.ai.

22. Contact

Entity

VibeLock LLC, a Delaware limited liability company

General

hello@vibelock.ai

Legal

legal@vibelock.ai

Security

security@vibelock.ai