Terms of Service

By using the service, you agree to these Terms, our privacy policy, Acceptable Use Policy, and — where applicable — our Data Processing Agreement and refund policy.

Account creation, continued use of the application, and any action that publishes or regenerates a customer-facing compliance page or export constitutes acceptance of these Terms as then in effect. If you do not agree, do not use the service.

Before publishing, you are responsible for ensuring that your organization has reviewed the underlying inventory and approved what will be shown externally. When you publish, you represent that you — not SourceTrust — stand behind the accuracy and appropriateness of that publication.

SourceTrust provides software to help organizations inventory third-party components, review license-related obligations, publish hosted compliance pages, and generate related exports. Features may change over time.

Unless we agree otherwise in writing (for example, in an enterprise order form with a service-level agreement), we do not guarantee uptime, availability, or response times. The service may be unavailable during maintenance, upgrades, or events outside our reasonable control.

We may modify, suspend, or discontinue features with reasonable notice where practicable. Price changes apply to new subscription periods or renewals as described at checkout or in your account.

Some features — including the public site scan and newly released capabilities — may be labeled beta or preview. Beta features are provided as-is and may change or be withdrawn without notice.

You are responsible for account credentials, accurate registration information, and all activity under your account. Information you provide about your organization — including its name, products, and domains — must be truthful and must reflect the organization you are authorized to represent.

Optional authenticator-app multi-factor authentication is available for your account. We recommend enabling it where practical; it is not required to use the service.

You may not register for or use the service while impersonating another company or person, or while claiming an affiliation you do not have (for example, signing up as "Apple" or publishing a compliance page that presents another company's products as yours without their authorization).

Notify us promptly if you suspect unauthorized access. We may suspend or terminate accounts where reasonably necessary for security, legal compliance, misrepresentation, non-payment, or protection of the service and third parties.

Your use of the service must comply with our Acceptable Use Policy, which describes prohibited misrepresentation, security abuse, scan misuse, and restrictions on hosted compliance pages.

We may investigate violations and suspend or terminate access where we reasonably believe the service is being misused.

You retain ownership of content you submit (for example, project inventory, license text, organization names, and compliance materials). You grant SourceTrust a worldwide, non-exclusive, royalty-free license to host, store, process, reproduce, display, and distribute that content as needed to operate the service — including publishing customer-facing compliance pages on sourcetrust.app or your configured custom domain using our hosting attribution format.

You represent and warrant that you have all rights necessary to submit and publish your content, that you are authorized to act for the organization named in your account and on any published compliance page, that published license disclosures accurately reflect that organization's reviewed findings, and that your use of the service does not violate any third-party rights or applicable law.

Public compliance pages are your representations to third parties. We do not pre-approve their legal sufficiency. We may unpublish, suspend, or remove hosted pages or accounts without notice where we reasonably believe content is unlawful, abusive, misleading, infringes rights, creates liability for the service, or violates these Terms — including in response to credible third-party complaints or legal requests.

To request review of hosted content, contact hello@sourcetrust.dev. We may remove or disable access while reviewing a complaint.

Our privacy policy describes how we handle personal data on the marketing website and in the application.

Where you upload data relating to your organization, products, or repositories, you are typically the data controller and SourceTrust acts as a data processor on your instructions, as described in our Data Processing Agreement. Account, billing, and service-administration data may be processed by SourceTrust as an independent controller as described in the privacy policy.

Business customers may request a signed DPA by email. Continued use of the application for organizational data constitutes acceptance of the DPA where applicable law requires a written agreement.

Paid subscriptions are subject to our refund policy. Invoiced or custom enterprise agreements are governed by their order form or contract where it conflicts with self-serve terms.

The site scan on https://sourcetrust.dev is a free, limited preview of publicly visible signals. It is not a complete compliance assessment, not legal advice, and not a substitute for importing and reviewing what you actually ship in the application. Scan availability, rate limits, and scope may change without notice.

The application may connect to repositories you authorize on a supported provider - currently GitHub (via the GitHub App), GitLab, or Azure DevOps (via a personal access token you generate and paste in). You represent that you have authority to connect each account, organization, and repository you link, on whichever provider you use.

Imports are designed to reflect watched branches when sync runs successfully, based on repository contents and supported lockfile or SBOM formats. We do not guarantee completeness, timeliness, or error-free operation; for example when files are missing, formats are unsupported, the provider is unavailable, an access token expires or is revoked, or webhook/notification delivery is delayed.

If you disconnect a repository, revoke the GitHub App, or revoke a pasted access token, future sync stops. Previously imported data and published materials are handled as described in the privacy policy, DPA, and termination section below.

Each project includes a limited number of watched branches; additional slots may be purchased as described on our pricing page and refund policy.

More detail on how repository connections work is on our GitHub integration page. Sub-processor processing for whichever provider you connect is described in our sub-processor list.

Organizations may purchase an optional security monitoring add-on that checks your reviewed inventory against public OSV advisory data and notifies your organization's users. It is advisory notification tooling only, not a vulnerability scanner, penetration test, security audit, or compliance certification.

Alerts are vendor-only: They are shown to your organization's users in the application and are not published on customer-facing compliance pages. We design the service to keep advisory findings off public attestation pages, but you remain responsible for what you publish and export elsewhere.

Scan cadence (for example periodic checks and rescans after sync, import, or publish) is provided on a best-effort basis without a service-level agreement unless we agree otherwise in writing. Advisory matching depends on your inventory, package identifiers, and third-party advisory sources; false positives and false negatives may occur.

Pricing and refunds for this add-on are described on our pricing page and refund policy.

Organizations may purchase an optional custom domain add-on to serve published compliance pages at a customer-owned hostname (for example licenses.example.com/{project}). One hostname per add-on may serve multiple projects in that organization using path routing configured in the product.

You are responsible for DNS configuration, domain ownership, and keeping certificates and records valid. We host pages using our standard attribution format (sourcetrust.app on behalf of your organization).

Custom domain availability is subject to the same uptime limitations as the rest of the service. If you remove the add-on or cancel, pages may revert to default sourcetrust.app hosting or be unpublished as described in your account and the refund policy.

More detail is on our attestation pages page.

SourceTrust owns the service, website, software, branding, documentation, and other materials we provide, except for your content and third-party materials.

You may not copy, modify, or redistribute our service or branding except as permitted by these Terms or with our written consent.

If you believe content on the service infringes your intellectual property rights, contact hello@sourcetrust.dev with sufficient detail for us to evaluate the claim.

SourceTrust is compliance infrastructure and software tooling. It is not a law firm, not legal advice, and must not be used, relied on, or treated as a substitute for qualified legal counsel.

What you publish (including public compliance pages and release artifacts) is your content and your representation to buyers, auditors, licensors, and regulators — not SourceTrust's legal opinion, certification, or attestation.

We do not guarantee that use of the service satisfies any particular legal, regulatory, audit, procurement, contractual, or licensing requirement.

You retain full and sole responsibility for your products, releases, license obligations, and all decisions to publish or distribute compliance materials, including the accuracy and completeness of inventory, license text, and attributions.

SourceTrust does not act as your legal shield, compliance officer, regulator, auditor, or guarantor. Using the service does not mean you are compliant, will pass an audit, will avoid enforcement, or will satisfy a buyer's or licensor's requirements.

To the fullest extent permitted by applicable law, SourceTrust is not liable for any fine, penalty, sanction, enforcement action, audit finding, injunction, license termination, contractual remedy, or similar measure imposed on you by a regulator, court, licensor, customer, acquirer, or other third party.

That includes losses arising from your products, reliance on published compliance pages or exports, or any representation that SourceTrust or the service made you compliant.

The service is provided "as is" and "as available". To the fullest extent permitted by applicable law, SourceTrust disclaims all warranties, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, accuracy, completeness, and non-infringement.

We do not warrant uninterrupted or error-free operation, complete imports, correct license identification for your situation, suitability for any specific legal or regulatory purpose, or accuracy of optional advisory alerts or drift notifications. Workflow guidance is an operational aid only.

These Terms apply while you use the service. You may stop using the service and cancel subscriptions as described in your account or the refund policy.

We may suspend or terminate access immediately for material breach, non-payment, legal requirement, or risk to the service or third parties. We may discontinue the service on reasonable notice where practicable.

On termination, your right to access the application ends. Public compliance pages may be unpublished. Export data you need before canceling; we may delete organization and project data after a reasonable retention period unless law requires longer storage.

Sections intended to survive termination (including customer content licenses granted to us for retention backups where required by law, indemnification, limitation of liability, governing law, and general provisions) survive.

You agree to indemnify, defend, and hold harmless SourceTrust, its operators, affiliates, and their directors, officers, employees, and agents from any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from or related to:

• your use or misuse of the service;
• your products, services, or distributions;
• content you submit or publish;
• representations you make regarding license compliance or regulatory posture;
• claims by customers, regulators, licensors, acquirers, or other third parties relating to your published materials or products; or
• your breach of these Terms or applicable law.

To the fullest extent permitted by applicable law, SourceTrust will not be liable for indirect, incidental, special, consequential, or punitive damages, or loss of profits, revenue, data, business, goodwill, or anticipated savings, even if advised of the possibility.

Our total aggregate liability arising out of or relating to these Terms or the service in the twelve (12) months before the claim shall not exceed the fees you paid to SourceTrust for the service in that period.

Nothing excludes or limits liability that cannot be excluded or limited under applicable law (including fraud or wilful misconduct). These limitations apply whether claims arise in contract, tort, or otherwise.

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive sanctions that would prohibit use of the service, and that you are not on applicable restricted-party lists.

You will not use the service in violation of export control or sanctions laws.

These Terms are governed by the laws of Denmark, excluding conflict-of-law rules.

Subject to mandatory law, the courts of Copenhagen, Denmark have exclusive jurisdiction over disputes arising from these Terms or the service. Each party submits to that jurisdiction and waives forum objections to the extent permitted by law.

Before commencing litigation, either party may request good-faith mediation in Copenhagen. Mediation is optional and does not suspend limitation periods unless the parties agree in writing.

SourceTrust may seek injunctive relief in any competent court to protect intellectual property or the service.

These Terms are written in English. If we publish a Danish translation for convenience, the English version governs in case of conflict unless mandatory law requires otherwise.

Order of precedence. For self-serve customers: these Terms, the Acceptable Use Policy, privacy policy, DPA, and refund policy. A signed order form or enterprise agreement prevails where it explicitly conflicts.

Entire agreement. These Terms together with the documents above and any order form are the entire agreement regarding the service.

Severability. If any provision is unenforceable, the remainder stays in effect.

No waiver. Failure to enforce a provision is not a waiver.

Assignment. You may not assign these Terms without our consent. We may assign these Terms to a successor entity (for example, upon incorporation or sale) without your consent.

Notices. We may send notices to your account email or through the application. You may send legal notices to hello@sourcetrust.dev.

Insurance. SourceTrust maintains insurance only if and as we choose for our own business purposes. Your use of the service does not confer any insured benefit on you.

We may update these Terms. Material changes will be posted on https://sourcetrust.dev and, where appropriate, sent to your account email. Continued use after the effective date constitutes acceptance.

Questions about these Terms: hello@sourcetrust.dev

BY USING THE SERVICE — INCLUDING BROWSING THE WEBSITE, CREATING AN ACCOUNT, PUBLISHING A COMPLIANCE PAGE, OR CONTINUING TO USE THE APPLICATION AFTER WE POST UPDATES — YOU ACKNOWLEDGE THAT YOU HAVE READ THESE TERMS OF SERVICE AND AGREE TO BE BOUND BY THEM, TOGETHER WITH OUR ACCEPTABLE USE POLICY, PRIVACY POLICY, DATA PROCESSING AGREEMENT, AND REFUND POLICY WHERE APPLICABLE.