Terms of Service

1. Agreement

These Terms of Service (the "Terms") form a binding agreement between you and VibeLock LLC, a Delaware limited liability company ("VibeLock", "we", "us"). They govern your access to and use of the VibeLock platform, website, documentation, hosted MCP server, repository connections, trust pages, badges and any related services (together, the "Service").

By creating an account, accessing the Service, or clicking to accept, you agree to these Terms. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity.

If you do not agree to these Terms, do not use the Service.

These Terms incorporate the Acceptable Use Policy, the Security and AI Disclaimer, the Badge and Brand Guidelines and the AI Transparency Notice. The Digital Products License governs the free Vibe Coding Security Checklist and the Vibe Coding Security OS, and the Waitlist and Early Access Terms govern the waitlist. Where one of those documents is more specific about its subject, it applies to that subject.

VibeLock is open for signups. Some features described in these Terms, including paid plans, are not yet available to anyone. Until a feature is made available to you, the parts of these Terms that describe it do not create any obligation for either party, and nothing in these Terms promises that a feature will be released or when.

2. What VibeLock is, and what it is not

The Service scans your application and reports what it observed. It checks your live URL from outside, in a safe mode that never writes to, changes or overloads your application. After you prove ownership, it also sends read-only requests using the public key your application already gives every browser, to show whether that key can read your database tables or list your stored files; it keeps only the names of tables, columns and storage buckets and a count of rows, never a value. Where you connect them, it checks your code through your repository host or through the hosted VibeLock MCP server used by your coding tool. It turns findings into explanations and fix prompts for your own coding tool, and it treats a finding as fixed only when a later scan verifies the fix. It keeps a dated record of facts about your application: which of the badge criteria hold, how much of the application was tested (coverage), open findings with their severities and deadlines, and the date of the last verified scan. It does not assign you a score, a grade or a rating.

• The Service does not write to, change or deploy your code. Fixes are applied by you, using your own tools.
• A scan examines only what it can reach. It can miss weaknesses, and a finding can be wrong. The Service is not a penetration test, does not run active attacks against your application by default, and is not a vulnerability remediation service.
• Results reported through the MCP server are produced by your own coding tool on your own machine. A failure counts at once. A pass is treated as self-reported until a second run on the same commit at least an hour later, or a check of the repository by VibeLock, corroborates it, and these results can never earn the badge on their own.
• VibeLock does not audit, assess or certify you, your organisation or your application against any framework, and is not a certification body, notified body or auditor.
• What the Service reports is a record of evidence observed at a stated time, and where it reads code, at a stated commit. It is not a third-party audit, attestation or certification. It does not state that your application is secure or ready to be released, and it does not mean your application cannot be compromised.
• Generated policies and documents are produced automatically and have not been reviewed by a lawyer. VibeLock is not a law firm and does not provide legal advice.
• Nothing in the Service constitutes legal, regulatory, financial, or professional compliance advice.

3. Eligibility and accounts

• You must be at least 18 years old and able to form a binding contract.
• You must provide accurate registration information and keep it current.
• You are responsible for all activity under your account, including activity by your team members.
• You must keep your credentials confidential and enable multi-factor authentication where offered. Notify us promptly at hello@vibelock.ai, with the word security in the subject line, if you suspect unauthorised access.
• You may not share a single seat between multiple individuals, or resell access.

4. Authorised use only

This section is important and is not boilerplate. The Service produces guidance, prompts and techniques for examining software systems for security weaknesses.

You represent and warrant that you will use the Service only in respect of systems, applications, repositories, accounts and infrastructure that you own or are expressly authorised in writing to assess. This applies to every scan, including the free preview.

The preview of a URL you paste is passive: it reads only what any visitor to that URL receives, such as response headers, page content and public scripts. Every deeper scan requires you to prove ownership of the exact host first, by a verification file, a meta tag, a DNS record or a supported hosting sign-in. A repository connection or an MCP connection does not prove ownership of a URL. We re-check ownership regularly, and if the proof is lost, deeper scans pause.

Proving ownership is a technical control, not a substitute for your authorisation. If you are not the owner of an application, you must hold the owner's written authorisation before you prove ownership of it or scan it.

By proving ownership of an application and starting a scan, you authorise VibeLock, and the systems we use to run scans, to access that application and send it the requests described in these Terms, on your behalf, for as long as ownership stays proved. If you act for the owner, you confirm that the owner's written authorisation covers this access. You can withdraw this authorisation at any time by removing the ownership proof or disconnecting the application, and scans of it then stop.

Applying the Service, its prompts, or its guidance to systems you do not own or are not authorised to test may violate the Computer Fraud and Abuse Act, the UK Computer Misuse Act, the EU Directive on attacks against information systems, and equivalent laws elsewhere. You are solely responsible for obtaining any authorisation required, and you accept full responsibility for the consequences of failing to do so.

We may suspend or terminate your account immediately, without refund, if we reasonably believe you have breached this section.

Some hosting providers, platforms and clients require notice or permission before any security testing of an application they host or own. You are responsible for meeting those requirements before you prove ownership of an application or start a scan of it.

We may decline, pause or stop any scan at any time, including where we cannot confirm ownership, where a scan appears to affect the availability of the application, or where we suspect abuse. We keep records of ownership proofs and of the scans we run, which never include your code, so that we can show who authorised each scan. We keep them while your account exists and for the 30 days after deletion described in section 16.

An application address given to us on the waitlist, in a form or in a message is not proof of ownership and is never scanned, fetched or resolved on that basis alone.

5. Acceptable use

You agree not to, and not to permit any third party to:

• Use the Service to attack, disrupt, or gain unauthorised access to any system.
• Copy, redistribute, resell, sublicense, or publish the fix prompts, finding explanations, checklist content or policy templates, in whole or in substantial part. This content is proprietary and is the core of the Service.
• Reverse engineer, decompile, or attempt to derive source code of the Service, except to the extent this restriction is prohibited by applicable law.
• Use automated means to scrape or bulk-export Service content beyond the export functions we provide.
• Upload malware, or content that infringes third-party rights or violates applicable law.
• Circumvent usage limits, plan restrictions, rate limits, or access controls.
• Use the Service to develop a competing product, or to benchmark it for publication without our prior written consent.
• Misrepresent what the Service reported about your application, including by presenting it as a certification, audit or attestation, by describing it as a statement that your application is secure or ready to be released, by showing a screenshot or copy of a badge in place of its live verification link, or by showing a badge for an application other than the one it was issued for.
• Tamper with, fabricate or replay evidence, scan results or MCP submissions, or prove ownership of a host you do not control.

6. Your content and confidentiality

You retain all rights in the information, documents and other material you submit to the Service ("Your Content"). You grant us a limited, non-exclusive, worldwide licence to host, process, transmit and display Your Content solely to provide, secure and support the Service, and to comply with law.

You represent that you have the rights necessary to submit Your Content and that doing so does not violate any law or third-party right, including any confidentiality obligation you owe to an employer or client.

Where you connect a repository for code scanning, you authorise us to read that repository through a separate, read-only connection, at one exact commit of the default branch per scan. The code is read inside an isolated scanner that exists only for that scan, is checked in memory, and is then discarded. We keep only the results: verdicts, rule identifiers, file paths, line numbers, and the names and versions of dependencies. We send you an email each time your code is read, and you can pause reading, or limit it to scans you start yourself, at any time.

We do not use Your Content to train machine learning models.

Findings, scan results and other non-public information about your application are your confidential information. We use them only to provide, secure and support the Service, disclose them only to our personnel and subprocessors who need them for that purpose and are bound by confidentiality, and never publish them except through a trust page or a link that you choose to publish or share.

Non-public parts of the Service, including fix prompts, finding explanations, the control catalogue and its mapping, and any pricing or terms we offer you privately, are our confidential information. You will not disclose them except as these Terms allow. Neither duty covers information that is public through no fault of the receiving party, that it already had or independently developed, or that it must disclose by law, in which case it will give notice where the law allows.

7. Artificial intelligence features

Parts of the Service use third-party large language models for analysis. You acknowledge that:

• Model output can be inaccurate, incomplete, outdated, or wrong, and must be reviewed by a competent human before it is relied on.
• Where you use a feature that sends text to a model provider, that text is sent to our provider to return a result. We do not keep a separate copy of what was sent, and our provider does not use it to train models, though it may keep it for a limited period for safety and abuse monitoring under its commercial terms. We never send your code to a model provider. See the Privacy Policy for detail.
• Generated policies are filled from a fixed template using only what a scan verified. No AI model writes them. They carry a notice that VibeLock did not have them reviewed by a lawyer, and you must not remove or obscure it.
• You are responsible for how you use model output, including any decision you take on the basis of it.
• Fix prompts are suggestions for your own coding tool, which acts on your instructions and not ours. Review every change your tool makes, test it before you deploy it, and keep backups. We are not responsible for changes made to your code by you or by your tools, including a change that introduces a new weakness or breaks a feature.
• The AI Transparency Notice explains where the Service uses AI models, what is generated by them, and how to ask for a human to review a result.

8. Plans, fees and billing

• Paid plans are billed in advance, monthly or annually, through our payment processor. Fees are stated in US dollars and exclusive of taxes unless stated otherwise. If you are a consumer in the European Union or the United Kingdom, the price shown to you at checkout includes any VAT you must pay.
• Subscriptions renew automatically for successive periods until cancelled. You may cancel at any time from account settings, effective at the end of the current billing period.
• Except where stated in our Refund Policy or required by law, fees are non-refundable and we do not provide credits for partial periods.
• We may change our prices. We will email you at least 30 days before a new price applies to you, tell you the new price and the date, and explain how to cancel online. The new price applies from your next renewal after that date unless you cancel before it.
• You are responsible for all applicable taxes other than taxes on our net income.
• If payment fails, your account becomes read-only for a grace period of 14 days: you can see and export your data, but no new scans run. If payment is not made by the end of the grace period, your paid features end and your account continues on the terms in section 16 for a downgrade. Your published trust page stays up and shows the date your application was last verified.
• Before you subscribe, our checkout shows the total price you will be charged, how often, that the plan renews automatically until you cancel, and how to cancel. You can cancel online from account settings at any time, without contacting us. Before an annual plan renews, we email you the price, the renewal date and how to cancel.
• No fees are charged before VibeLock launches. Joining the waitlist is free and does not commit you to buy anything.

9. Free plan and beta features

Free plan access and any feature designated beta, preview or early access is provided as-is, may change or be withdrawn at any time, and may be subject to additional terms. Availability commitments do not apply to them. They are provided without any warranty, and if you have paid nothing for them, our total liability for them is limited as section 14 states for a customer who has paid nothing. Tell us about problems you find; doing so is feedback under section 11.

10. Trust pages, badges and published content

The Service allows you to publish a trust page, a VibeLock Verified badge and policy documents at a VibeLock URL. You are solely responsible for the accuracy of any document you write or publish and for any claim you make about your security posture.

What the trust page and badge show about your application is computed by VibeLock from evidence and cannot be edited by you. The badge shows one of two facts: Verified, with the date of the last verified scan, while all of the published badge criteria hold; or Last verified, with the date on which they last all held. The badge criteria are published on the verification page. Each control on the trust page shows the date and method of the scan that verified it. The live verification link is the proof of the badge; a screenshot or copy proves nothing.

Published pages carry a notice stating that what is shown was verified by VibeLock from evidence observed at a stated date and, where code was read, a stated commit, and that this does not constitute a third-party certification, audit or attestation. You may not remove, obscure or contradict that notice.

We do not take a trust page down because evidence has aged, a connection was lost, a payment lapsed or a plan was downgraded; in those cases it stays up and shows the date your application was last verified. We unpublish the trust page, and the badge address stops responding, when you delete your account, when proof of ownership of the application has been lost for more than 14 days, or when we reasonably believe there has been abuse, such as faked ownership, scanning an application without authorisation, tampering with evidence, or showing a badge for a different application. Where we remove a page for abuse, we tell you the reason privately and you may appeal. Re-proving ownership and completing a verified scan republishes a page removed for lost ownership.

We may also remove published content that we reasonably believe is misleading, unlawful, or in breach of these Terms.

You may show the badge only as the Badge and Brand Guidelines allow. A trust page and a badge are facts about one application at a stated date, provided so that you can share them. They are not a recommendation, endorsement or guarantee by VibeLock, and they create no duty or liability from VibeLock to anyone who views them.

11. Intellectual property

The Service, including its software, content, checklists, fix prompts, templates, the control catalogue and its mapping to published requirements, and the VibeLock name, badge and marks, is owned by us and protected by intellectual property law. The requirements themselves are published by their own authors and are not ours. Except for the limited right to use the Service under these Terms, no rights are granted to you.

If you send us feedback or suggestions, you grant us an unrestricted, perpetual, royalty-free right to use them without obligation to you.

VibeLock, the VibeLock logo and the VibeLock Verified badge are our trademarks. You may use them only as the Badge and Brand Guidelines allow. The names of coding tools and other products mentioned in the Service belong to their owners, and mentioning them does not mean they endorse VibeLock or that we endorse them.

12. Third-party services

The Service integrates with third-party services such as source control, payment processing and model providers. Your use of those services is governed by their terms, and we are not responsible for them. A current list of the subprocessors we use is published on our Subprocessors page.

13. Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT THE SERVICE WILL IDENTIFY ALL SECURITY WEAKNESSES IN YOUR APPLICATION, THAT ANY FINDING, COVERAGE FIGURE, BADGE STATE OR CHECKLIST REFLECTS YOUR ACTUAL SECURITY POSTURE, THAT USE OF THE SERVICE WILL PREVENT A SECURITY INCIDENT OR DATA BREACH, OR THAT IT WILL SATISFY ANY REGULATOR, AUDITOR, CUSTOMER OR INVESTOR.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

IF YOU ARE A CONSUMER IN THE EUROPEAN UNION OR THE UNITED KINGDOM, YOU HAVE LEGAL RIGHTS THAT THE SERVICE WILL MATCH ITS DESCRIPTION AND BE OF SATISFACTORY QUALITY AND FIT FOR PURPOSE, AND TO A REPAIR, A PRICE REDUCTION OR A REFUND IF IT DOES NOT. NOTHING IN THESE TERMS LIMITS THOSE RIGHTS.

14. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS INTERRUPTION, OR THE COST OF SUBSTITUTE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY.

THE EXCLUSIONS IN THE PARAGRAPH ABOVE DO NOT APPLY TO YOUR OBLIGATIONS UNDER SECTION 15, TO YOUR BREACH OF SECTION 4 OR SECTION 5, TO YOUR INFRINGEMENT OR MISUSE OF OUR INTELLECTUAL PROPERTY, OR TO FEES YOU OWE US.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE AMOUNT YOU ACTUALLY PAID US IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IF YOU HAVE PAID US NOTHING, OUR TOTAL LIABILITY IS ONE HUNDRED US DOLLARS.

IN PARTICULAR, WE ARE NOT LIABLE FOR ANY SECURITY INCIDENT, BREACH, REGULATORY ACTION, FINE, LOST CUSTOMER, FAILED AUDIT, OR FAILED FINANCING AFFECTING YOU OR YOUR USERS, WHETHER OR NOT THE SERVICE IDENTIFIED THE UNDERLYING ISSUE.

THESE LIMITS APPLY REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THEY DO NOT APPLY TO LIABILITY THAT CANNOT BE LIMITED BY LAW, INCLUDING FRAUD, WILFUL MISCONDUCT, OR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE.

15. Indemnity

You will defend, indemnify and hold us harmless from any claim, demand, loss, liability, fine and expense (including reasonable legal fees) arising from: your use of the Service; Your Content; your breach of these Terms, in particular the Authorised Use section; your publication of a trust page or generated document; and any claim that your assessment of a system you were not authorised to assess caused harm.

16. Term, suspension and termination

• These Terms apply while you have an account. You may terminate at any time by deleting your account.
• We may suspend or terminate access immediately for breach of the Authorised Use or Acceptable Use sections, or where required by law. Non-payment is handled as set out in section 8, not by termination.
• If we stop providing the Service, or end your account for any reason other than your breach of these Terms, we will give you at least 30 days notice where we can, so that you can export your data, and refund any fees you paid in advance for the period after it ends.
• Cancelling or downgrading a paid plan is not termination. Your data is frozen, never deleted: you keep read access to it, features of the higher plan stop, and your published trust page stays up and shows the date your application was last verified. If you upgrade again, those features return, and a verified scan can restore the Verified state.
• Deleting your account terminates these Terms. On deletion we revoke every connection and token you granted, unpublish your trust page, and stop the badge address from responding. Your account data, including scan history, is kept for 30 days and then permanently deleted, and removed from our backups as they expire, except records we must keep by law, such as billing records. Export your data before you delete.
• Sections that by their nature should survive termination do so, including fees owed, confidentiality, intellectual property and feedback, disclaimers, limitation of liability, indemnity, governing law and dispute resolution, and the general terms in section 21.

17. Changes to the Service and these Terms

We may modify the Service, and may update these Terms. For material changes we will give notice by email or in-app at least 30 days before they take effect, unless a shorter period is required by law or the change is necessary for security. Continued use after the effective date constitutes acceptance. If you do not agree, stop using the Service and cancel. If a change to these Terms materially reduces your rights or the Service you paid for, and you cancel within 30 days of our notice because of it, we refund any fees you paid in advance for the period after you cancel.

18. Governing law and dispute resolution

These Terms are governed by the laws of the State of Delaware, excluding its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods.

PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS HOW DISPUTES ARE RESOLVED.

Before filing any claim, the parties will attempt in good faith to resolve it informally by written notice to hello@vibelock.ai with "Legal notice" in the subject line, allowing 30 days to reach resolution.

Any dispute not resolved informally will be brought exclusively in the state or federal courts located in Delaware, and both parties consent to that venue and to personal jurisdiction there.

Either party may bring an individual action in small claims court, and either party may seek injunctive relief in any court of competent jurisdiction to protect intellectual property or to address unauthorised access.

Nothing in this section deprives a consumer of mandatory protections, or of the right to bring proceedings in their country of residence, where local law provides that right.

19. Export control and sanctions

You represent that you are not located in, ordinarily resident in, or organised under the laws of any country or region subject to comprehensive US sanctions, and that you are not on any US, UK or EU restricted party list. You will not use or export the Service in violation of applicable export control or sanctions laws.

20. Copyright complaints

If you believe content on the Service infringes your copyright, send a notice under the Digital Millennium Copyright Act to hello@vibelock.ai with "Copyright notice" in the subject line, including the elements required by 17 U.S.C. § 512(c)(3). We will respond appropriately and may terminate the accounts of repeat infringers.

Our Copyright and DMCA Policy sets out what a notice and a counter notice must contain and how we handle them.

21. General

• Entire agreement. These Terms, the documents they incorporate in section 1, the Data Processing Addendum where it applies, and any order form are the entire agreement between the parties on this subject. If they conflict, this order applies: an order form signed by both parties, then the Data Processing Addendum for personal data, then these Terms, then the other documents. The Privacy Policy explains how we handle personal data; it is a notice, not a contract term.
• Severability. If any provision is unenforceable, it is modified to the minimum extent necessary and the rest remains in effect.
• No waiver. Failure to enforce a provision is not a waiver of it.
• Assignment. Neither party may assign these Terms without the other's written consent, except that either party may assign them to a successor in a merger, acquisition or sale of all or substantially all of its relevant business, on notice to the other. These Terms bind permitted successors.
• Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control, such as a natural disaster, war, an outage of a third-party service it depends on, or an act of government, provided it tells the other party and works to resume. This does not excuse a payment you owe.
• Relationship. The parties are independent contractors. Nothing creates a partnership, agency or employment relationship.
• No third-party beneficiaries. These Terms are for the benefit of you and us only. No one else, including a visitor to your trust page or a customer, investor or user of your application, has any right under them or may rely on them.
• Notices. We send notices to your account email, and they are received when sent. Send notices to us at hello@vibelock.ai with "Legal notice" in the subject line; they are received when we confirm receipt or two business days after sending, whichever is earlier.
• Electronic communications. You agree to enter into these Terms, receive notices and keep records electronically.
• Publicity. We will not use your name or logo to promote VibeLock without your permission. A trust page or badge you publish is published by you.
• Interpretation. Headings are for convenience. "Including" means including without limitation.

22. Contact

Entity

VibeLock LLC, a Delaware limited liability company

General and legal notices

hello@vibelock.ai, with "Legal notice" in the subject line for a notice under these Terms

Security

hello@vibelock.ai, with the word security in the subject line, for reporting a vulnerability in VibeLock