Terms of Service

The Service is intended for businesses and professionals. You must be at least 18 years old and legally capable of entering into these Terms. You may use the Service only for repositories, systems, and materials that you own or are authorized to assess.

Access may be invite-only or subject to approval. You must provide accurate information, keep your sign-in links and connected accounts secure, and promptly notify us if you suspect unauthorized use. You are responsible for activity performed through your account and for ensuring that your users comply with these Terms.

We may reject an access request, limit account features, or require additional verification at our discretion, including to protect the Service or other customers.

GregoAI analyzes selected source code and produces security findings, code references, remediation guidance, and downloadable reports. Features may include automated scans and separately scoped custom audits. Custom audits may require separate pricing, timing, and engagement terms.

We may improve, modify, suspend, or discontinue parts of the Service. We do not promise that every feature will remain available or that the Service will be uninterrupted.

You retain ownership of source code, repository data, instructions, and other materials you submit or make available to the Service ("Customer Content"). You grant GregoAI a limited, non-exclusive license to access, copy, process, transmit, and store Customer Content only as reasonably necessary to provide, secure, support, and improve the operation of the Service.

You represent that you have all rights and permissions needed for GregoAI and its service providers to process Customer Content as described in these Terms and the Privacy Policy.

Private repositories are accessed through authorized integrations or credentials intended to be limited in scope and duration. We may retain Customer Content, including source code and associated scan materials, while your account remains active when needed to operate the Service, support you, or reprocess a scan.

We treat non-public Customer Content as confidential and limit access to personnel and service providers who need it to operate or support the Service. We do not use Customer Content or customer-specific reports to train general-purpose models, and we do not disclose one customer's Customer Content to another customer.

After a verified account-deletion request or termination, we aim to remove active Customer Content and account data within 30 days, except where retention is required by law, needed to resolve disputes, or necessary to enforce agreements. Residual copies may remain temporarily in backups until those backups rotate.

The Service uses automated and AI-assisted techniques. Results may contain false positives, false negatives, incomplete analysis, or suggested fixes that are not appropriate for your environment. The Service is not a substitute for independent review, testing, professional judgment, or a comprehensive security audit.

GregoAI does not guarantee that Customer Content is secure, error-free, or free of vulnerabilities. You are solely responsible for reviewing findings, testing remediation, making deployment decisions, and maintaining the security of your systems.

You may not use the Service to:

• scan, access, or test repositories or systems without authorization;
• violate law, intellectual-property rights, privacy rights, or contractual restrictions;
• upload malware or content designed to disrupt, exploit, or compromise the Service or others;
• circumvent rate limits, access controls, usage restrictions, or security safeguards;
• reverse engineer or attempt to extract non-public models, source code, pricing logic, or system prompts, except where applicable law prohibits this restriction;
• resell or provide the Service to third parties unless GregoAI has agreed in writing; or
• use the Service in a way that creates unreasonable load or interferes with another user's access.

The Service may connect to third-party services such as source-code hosts, authentication providers, infrastructure providers, and communications services. Your use of those services remains subject to their own terms. GregoAI is not responsible for third-party services or for changes they make that affect an integration.

Some features consume prepaid or granted credits. Applicable pricing and estimated credit cost are shown before a scan is submitted, but final usage may depend on the selected scope and Service rules. Credits have no cash value, may not be transferred, and are normally non-refundable except where required by law.

When the platform records an eligible run as failed or cancelled, it may automatically restore the associated credits. Any other refund or billing adjustment is at GregoAI's discretion unless applicable law requires otherwise. Separate custom-audit work may be governed by an order form or written agreement.

GregoAI and its licensors own the Service, including its software, interfaces, models, methods, documentation, branding, and improvements. As between you and GregoAI, you own reports generated specifically from your Customer Content, excluding GregoAI technology, templates, methods, and other pre-existing materials embedded in or used to produce those reports.

If you provide feedback, you allow us to use it without restriction or compensation, provided we do not identify you or disclose your confidential Customer Content without permission.

You may stop using the Service at any time and may request account deletion from Settings or by contacting us. We may suspend or terminate access if you violate these Terms, create security or legal risk, fail to pay applicable fees, or if continued operation is no longer commercially reasonable.

Sections that by their nature should survive termination will survive, including ownership, disclaimers, limitations of liability, indemnification, and governing law.

To the maximum extent permitted by law, the Service is provided "as is" and "as available." GregoAI disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade.

We do not warrant that the Service will be uninterrupted, secure, accurate, complete, or suitable for any particular deployment, transaction, compliance obligation, or security decision.

To the maximum extent permitted by law, GregoAI and its affiliates, personnel, and providers will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, goodwill, business opportunity, or costs of substitute services, even if advised that such damages are possible.

To the maximum extent permitted by law, GregoAI's total liability arising out of or relating to the Service or these Terms will not exceed the amount you paid to GregoAI for the Service during the 12 months before the event giving rise to the claim. If you used the Service without payment, the cap is USD 100. These limits apply in the aggregate and do not limit liability that cannot legally be limited.

You will defend and indemnify GregoAI and its affiliates, personnel, and providers against third-party claims, damages, losses, and reasonable costs arising from your Customer Content, your unauthorized or unlawful use of the Service, or your material violation of these Terms, except to the extent caused by GregoAI's own breach or misconduct.

We may update these Terms as the Service evolves. We will post the updated version and change the effective date. If a change is material, we will provide reasonable notice through the Service or by email when practicable. Continued use after the updated Terms take effect constitutes acceptance.

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law principles. Except where applicable law requires otherwise, the state and federal courts located in Delaware will have exclusive jurisdiction over disputes arising from these Terms or the Service.

Questions about these Terms may be sent to grego@grego.ai.