Terms of Service

1. Definitions

• "Account" means the account you register to access the Service.
• "Cloud Account" means a cloud provider account (e.g. AWS or Google Cloud) that you connect to the Service so that we can provision and operate a package gateway on your behalf.
• "Package" means a software dependency (and its metadata) routed through the Service, such as a PyPI, npm, or RubyGems artifact.
• "Quarantine" means the holding repository into which incoming Packages are placed pending review under your configured policies.
• "Customer Data" means data you submit to or generate within the Service, including Account details, Cloud Account configuration, Package metadata, policies, and audit logs.
• "Subscription" means a paid or trial plan that determines your access tier, limits, and fees.

2. The Service

Package Shield is a secure package gateway. When you connect a Cloud Account, we provision package repositories in your own cloud (for example, AWS CodeArtifact or Google Artifact Registry), route incoming Packages through a quarantine-and-approval workflow, and let you apply policies before a Package becomes available to your builds.

We operate within your Cloud Account by assuming a role that you explicitly grant. The package repositories, stored artifacts, and associated cloud resources reside in your Cloud Account and remain under your control. Package Shield does not permanently host or redistribute your Packages; it brokers and governs their flow.

We may modify, add, or remove features of the Service over time. We will not materially reduce the core functionality of a paid Subscription during its term without notice.

3. Accounts and eligibility

• You must provide accurate, current, and complete information when registering and keep it up to date.
• You are responsible for safeguarding your credentials and for all activity that occurs under your Account. Notify us promptly at [email protected] of any unauthorized use.
• You must be at least 18 years old and capable of forming a binding contract.
• You may invite team members to your organization; you remain responsible for their use of the Service and compliance with these Terms.

4. Customer responsibilities and cloud accounts

To use the Service you grant us limited access to your Cloud Account, typically by deploying an IAM role (AWS) or workload identity configuration (Google Cloud) that we assume. You represent that you are authorized to grant this access and to connect the Cloud Account.

• You are solely responsible for your Cloud Account, including its configuration, security, and all charges levied by your cloud provider (e.g. storage, data transfer, and CodeArtifact or Artifact Registry usage). Those charges are separate from your Package Shield fees.
• You are responsible for the Packages you choose to route, approve, or block, and for the policies you configure.
• You must not use the Service to store, distribute, or facilitate malware, infringing content, or anything unlawful.
• You will comply with the terms of the upstream registries (such as PyPI, npm, and RubyGems) from which Packages originate.

5. Acceptable use

You agree not to, and not to permit anyone to:

• use the Service to violate any law or third-party right;
• reverse engineer, decompile, or attempt to derive the source code of the Service, except to the extent permitted by mandatory law;
• circumvent or disable any security, rate-limiting, or access-control feature;
• probe, scan, or test the vulnerability of the Service without our prior written consent, or otherwise interfere with its integrity or performance;
• resell, sublicense, or provide the Service to third parties except as expressly permitted;
• use the Service to build a competing product.

6. Plans, trials, fees, and billing

Trials

We may offer a free trial (for example, 14 days). When a trial ends, unless you have selected a paid plan, your Account is automatically downgraded to the free or entry tier; we do not charge you and do not require a payment method to start a trial.

Fees and payment

• Paid Subscriptions are billed in advance on a recurring (monthly or annual) basis through our payment processor, Stripe. By providing a payment method you authorize us to charge the applicable fees.
• Fees are stated exclusive of taxes. You are responsible for any VAT or other taxes; where required, VAT will be added at the applicable rate.
• Subscriptions renew automatically for successive periods unless cancelled before the end of the current period. You can cancel at any time, effective at the end of the current billing period.
• Except where required by mandatory law, fees already paid are non-refundable, and cancellation does not entitle you to a refund for the remainder of a paid period.
• We may change our fees on renewal by giving you at least 30 days' notice. Continued use after the change takes effect constitutes acceptance.

7. Third-party services and registries

The Service interoperates with third-party services (such as AWS, Google Cloud, and Stripe) and pulls Packages from upstream registries (such as PyPI, npm, and RubyGems). We do not control those services or the content they make available, and we are not responsible for their availability, accuracy, security, or terms. Your use of them is governed by their own agreements.

8. Intellectual property

The Service, including all software, documentation, and content we provide (excluding Customer Data and third-party Packages), is owned by Package Shield or its licensors and is protected by intellectual property laws. We grant you a limited, non-exclusive, non-transferable, revocable right to use the Service during your Subscription, solely for your internal business purposes.

You retain all rights in your Customer Data. You grant us a limited licence to host, process, and transmit Customer Data solely to provide and improve the Service. If you send us feedback or suggestions, you grant us a perpetual, royalty-free licence to use it without restriction.

9. Confidentiality

Each party may receive non-public information of the other ("Confidential Information"). The receiving party will use it only to perform under these Terms and will protect it with at least the same care it uses for its own confidential information. This does not apply to information that is or becomes public through no fault of the receiving party, was lawfully known beforehand, or is required to be disclosed by law.

10. Disclaimers

The Service helps you govern and screen Packages, but it is not a guarantee of security. A Package that passes through quarantine, scanning, or your policies may still contain vulnerabilities, malware, or defects. Package Shield does not warrant that any Package is safe, fit for purpose, or free of harmful code. You remain responsible for evaluating and accepting the Packages you use.

Except as expressly stated and to the maximum extent permitted by law, the Service is provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted or error-free operation.

11. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or goodwill, arising out of or relating to these Terms or the Service.

To the maximum extent permitted by law, our total aggregate liability arising out of or relating to these Terms or the Service will not exceed the total fees you paid to us for the Service in the twelve (12) months preceding the event giving rise to the claim.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under mandatory applicable law, including liability for damage caused intentionally or by gross negligence, or for death or personal injury.

12. Indemnification

You will defend and indemnify Package Shield against third-party claims, damages, and reasonable costs arising from your Customer Data, your use of the Service in breach of these Terms, or your violation of law or third-party rights.

13. Term, suspension, and termination

• These Terms apply for as long as you use the Service.
• You may stop using and close your Account at any time.
• We may suspend or terminate your access if you materially breach these Terms, fail to pay fees when due, or if your use poses a security or legal risk. Where practical, we will give notice and an opportunity to cure.
• On termination, your right to use the Service ends. We will, on request and within a reasonable period, allow you to export your Customer Data, after which we may delete it in accordance with our Privacy Policy and applicable retention obligations.
• Because your package repositories live in your own Cloud Account, deprovisioning is performed in cooperation with you; you remain responsible for any resources that persist there after termination.

14. Changes to these Terms

We may update these Terms from time to time. If a change is material, we will give reasonable notice (for example, by email or in-product). Changes take effect on the date stated in the notice. If you do not agree, you must stop using the Service before the change takes effect; continued use constitutes acceptance.

15. Governing law and disputes

These Terms and any dispute arising out of or in connection with them are governed by the laws of Poland, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods.

For business customers, any dispute will be subject to the exclusive jurisdiction of the Polish court having jurisdiction over our registered seat. Mandatory consumer-protection rights, where they apply, are not affected.

16. Miscellaneous

• Entire agreement. These Terms, together with the Privacy Policy and any order or plan you select, form the entire agreement between us regarding the Service.
• Severability. If any provision is held unenforceable, the remaining provisions stay in effect.
• No waiver. Failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.
• Notices. Legal notices to us should be sent to [email protected].
• Language. These Terms are provided in English and Polish. In case of any discrepancy, the English version prevails, except where mandatory law requires otherwise.

17. Contact

Questions about these Terms? Contact [LEGAL ENTITY NAME] sp. z o.o. at [email protected] or [email protected], or write to [ul. ____, 00-000 ____, Poland].