Terms of Service

These Terms of Service ("Terms") form a binding agreement between you ("Customer", "you") and ZerwOne Network LLC, a limited liability company organised in the State of Ohio, United States ("ZerwOne", "we", "us"), governing the Sentrail application, website, APIs, MCP server, agents, and related services (the "Service").

By creating an account, accepting these Terms, or using the Service, you agree to them. If you accept on behalf of an organisation, you represent that you have authority to bind it, and "you" means that organisation. The following are incorporated by reference and form part of these Terms: the Acceptable Use Policy, the Billing, Refunds & Support terms, and, where we process personal data on your behalf, the Data Processing Addendum.

You must be at least 18 and able to form a binding contract. You are responsible for your credentials, for every action taken under your account or tokens, and for your workspace members' compliance with these Terms. Keep your contact email current and tell us promptly at [email protected] if you suspect unauthorized access.

Sentrail observes the code, databases, configurations, deployments, and connected providers you authorise, runs security checks, records the evidence behind each result, and issues a verdict on whether the application is ready to ship. It can draft remediations — pull requests, SQL migrations, configuration changes — and presents each one with its scope and proposed impact for you to approve.

Two limits you must accept before relying on the Service:

• No security tool detects every vulnerability. A READY verdict means the required checks ran with fresh evidence and no critical or high finding is open. It is not a warranty that your application is secure, and it is not a certification.
• You remain the operator of your systems. Every production-changing action requires your explicit approval, and you are responsible for reviewing a proposed change before you approve it.

Parts of the Service use large language models to triage findings and draft fixes. Model output can be wrong or incomplete. Review it as you would a colleague's patch.

You warrant that, for every system you connect, scan, or test through the Service, you either own it or hold the owner's authorization to have it scanned and tested.

This warranty is fundamental to this agreement. Unauthorized scanning or testing may violate computer-misuse laws, and you are solely responsible for any claim arising from a target you were not authorized to test. Our Acceptable Use Policy sets out the detail, and we may suspend access immediately if we reasonably believe it has been breached.

You keep all rights in your code, data, configurations, and findings ("Customer Data"). You grant us a limited, non-exclusive licence to host, process, transmit, and display Customer Data solely to provide, secure, and support the Service.

• Database connection strings and credentials you submit for a check are held in volatile memory for the duration of that request and are not written to our persistent stores. Stored provider tokens are encrypted with a separate key.
• Repository contents are fetched into an ephemeral, network-restricted analysis container and discarded when the run ends. We retain findings, evidence records, and redacted excerpts — not full copies of your repository.
• Secrets and credentials are redacted before code excerpts are logged, stored, or sent to a model provider.
• We do not use Customer Data to train models, and we use model provider endpoints configured so that submitted content is not used for their training.

We may use aggregated, de-identified statistics that do not identify you or your systems to improve detection quality. Our Privacy Policy describes personal data handling in full.

Actions that change a production system — opening a pull request, applying a migration, changing a provider configuration — are queued as pending actions and executed only after an authorised user of your workspace approves them, having seen the scope, affected resource, and exact change. Approving an action is your instruction to us to perform it, and you accept responsibility for its effect on your systems. You must not attempt to disable or bypass this approval gate.

The Service integrates with providers such as GitHub, Supabase, Vercel, and Stripe. You are responsible for your relationship with each of them and for the scopes you grant. We access only what an integration needs, as described on our subprocessors page, and you can revoke access at any time — which may disable parts of the Service. We are not responsible for a provider's own outages, changes, or terms.

Paid subscriptions are billed in advance and renew automatically until cancelled. Fees, refunds, cancellation, and support targets are set out in our Billing, Refunds & Support terms, which form part of this agreement. Fees exclude taxes, which we add where we are required to collect them. We may change prices with at least thirty (30) days' notice, effective at your next renewal.

The Service — including its software, design, detection logic, prompts, and trademarks — remains the property of ZerwOne and its licensors. You receive only a limited, revocable, non-transferable right to use it under these Terms. Findings, fix diffs, and reports produced for your systems are yours to use freely. If you send us feedback or suggestions, you grant us a perpetual, royalty-free licence to use them without obligation to you.

Each party will protect the other's non-public information with at least reasonable care and use it only to perform this agreement. Findings and evidence about your systems are your confidential information; we disclose them only to personnel and subprocessors who need access to deliver the Service, or where required by law. This obligation survives for three (3) years after termination, and indefinitely for credentials and security findings.

EXCEPT AS EXPRESSLY STATED, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT IT WILL IDENTIFY EVERY VULNERABILITY IN YOUR SYSTEMS, OR THAT A PROPOSED FIX WILL FULLY REMEDIATE AN ISSUE OR NOT AFFECT OTHER BEHAVIOUR. THE SERVICE IS NOT LEGAL, REGULATORY, OR COMPLIANCE ADVICE, AND A VERDICT IS NOT A CERTIFICATION. Some jurisdictions do not allow certain exclusions, in which case they apply only to the extent permitted.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY.

EACH PARTY'S TOTAL CUMULATIVE LIABILITY WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID US IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100). These limits do not apply to your payment obligations, to your indemnity obligations, to a breach of the authorization warranty in Section 4, or to liability that cannot be limited by law.

You will defend and indemnify ZerwOne against any third-party claim, damage, loss, or expense (including reasonable legal fees) arising from your breach of these Terms or the Acceptable Use Policy, your scanning or testing of a system you were not authorized to test, your Customer Data, or a change you approved. We will defend and indemnify you against a third-party claim that the Service as provided by us infringes that party's intellectual property rights. The indemnified party must give prompt notice, allow the other to control the defence, and cooperate reasonably.

You may stop using the Service and close your account at any time. Either party may terminate for material breach that is not cured within thirty (30) days of notice. We may suspend access immediately, with notice as soon as practical, where there is a risk of harm to a third party, to our infrastructure, or of legal exposure — including a suspected breach of the authorization warranty. On termination your right to use the Service ends; you may export your projects, findings, and evidence, and we will delete or return data as described in the Privacy Policy and DPA. Sections on data, IP, confidentiality, disclaimers, liability, indemnity, and governing law survive.

These Terms are governed by the laws of the State of Ohio, U.S.A., excluding its conflict-of-laws rules and the U.N. Convention on Contracts for the International Sale of Goods. The parties submit to the exclusive jurisdiction of the state and federal courts located in Franklin County, Ohio. Before filing a claim, each party agrees to try in good faith to resolve the dispute by contacting the other at [email protected] and conferring for thirty (30) days. Either party may seek injunctive relief for misuse of confidential information or intellectual property in any competent court. Nothing here removes a consumer's right to bring proceedings in their own country of residence where local law grants it.

• Changes: we may revise these Terms, posting the new version with an updated effective date. For material changes we will give reasonable advance notice by email or in-product. Continued use after the effective date is acceptance; if you do not agree, stop using the Service and cancel.
• Assignment: you may not assign this agreement without our consent, except to a successor of your business. We may assign it to an affiliate or in connection with a merger or sale of assets.
• Force majeure: neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations.
• Severability and waiver: if a provision is unenforceable, the rest remains in effect; failure to enforce a provision is not a waiver of it.
• Entire agreement: these Terms, together with the incorporated policies, are the entire agreement and supersede prior discussions. No purchase-order terms apply.
• Independent parties: nothing here creates a partnership, agency, or employment relationship.

ZerwOne Network LLC, United States. Questions about these Terms: [email protected] or our contact form. A full index of our legal documents is at sentrail.dev/legal.