Terms of Service

Effective date: 2026-10-17

1. Who we are and what these terms cover

keptsec is operated by Secure Stack Consulting S.R.L., a limited liability company registered in Romania (“we”, “us”). These Terms of Service (“Terms”) govern your use of the website at keptsec.com, our maintained open-source forks, our signed release artifacts and security documents, our private package registry, our oracle API and MCP server, and our GitHub App (together, the “Service”).

If you use the Service for an organisation, you accept these Terms for that organisation and confirm you are allowed to do so.

Our Acceptable Use Policy and Privacy Policy, both published at keptsec.com, form part of these Terms.

2. What we provide: software deliverables only

The Service consists only of software and machine-generated documents. It includes:

• Maintained forks of abandoned open-source packages, published as public source repositories and packages. Free.
• The GitHub App, which posts automated comments on pull requests in repositories that install it. Free.
• The oracle free tier, an API and MCP tool that returns automated verdicts on whether a package version or call still works, up to the free quota shown on keptsec.com.
• Per-release evidence for every fork: signed releases with provenance (Sigstore), build attestations, software bills of materials (SBOM) and vulnerability exploitability exchange (VEX) documents in OpenVEX and CycloneDX formats, advisory records in OSV format, and test and re-run logs. Free and public.
• Paid plans (per organisation, as described on the pricing page at keptsec.com), which give access to deliverables our automated pipelines produce, such as:
  • a signed evidence bundle covering the whole catalog, and a VEX feed for your organisation kept current by the pipeline;
  • VEX and remediation reports generated against a lockfile you provide;
  • access to our private package registry, including pinned long-term branches where the plan says so.

We do not sell services performed by people. No plan includes consulting, audits, custom development, manual review, signed letters or certificates, guaranteed response times, service level agreements (SLAs), uptime commitments, or any other human service. Where we answer questions by email, we do so as a courtesy about access and billing, not as a paid deliverable.

3. Open-source licences come first

Every fork we maintain is free and remains under the permissive licence of the upstream project it derives from (for example MIT, Apache-2.0, BSD or ISC). We keep the upstream licence text and add our own notice. Our changes are released under the same licence as the upstream project.

A paid plan does not change, narrow or add conditions to any open-source licence. Nothing in these Terms restricts rights you have under an open-source licence. If these Terms and an open-source licence conflict about the code, the open-source licence wins.

Paid plans pay for access to deliverables and convenience (the catalog evidence bundle, organisation VEX feed, reports and registry access), not for a licence to the code.

4. No affiliation with upstream projects

keptsec is independent. We are not affiliated with, endorsed by or sponsored by the original authors or maintainers of any package we fork, or by any foundation or company that owns or stewards those projects or their trademarks. We use upstream project names only to describe what our forks derive from or are compatible with.

We send our fixes to upstream projects first. If an upstream project releases its own fix, you may prefer to switch back.

5. Buying through Polar (merchant of record)

Our paid plans are sold by Polar as merchant of record and authorised reseller. When you buy, you buy from Polar, and Polar’s Checkout Buyer Terms apply to the purchase. Polar:

• takes your payment through its payment processor (we never see your full card details);
• calculates, collects and remits sales tax, VAT or GST;
• issues your invoices and receipts;
• handles billing questions and payment disputes.

These Terms are the supplier terms that Polar’s Buyer Terms refer to: they govern your use of the deliverables you buy. For billing matters you can contact Polar directly, or write to us at support@keptsec.com and we will help.

Prices are shown at checkout, in the currency Polar offers, with any tax added according to your billing address.

6. Subscriptions, renewal and cancellation

• Paid plans are subscriptions billed in advance for each billing period shown at checkout (for example monthly).
• Your subscription renews automatically and you will be charged at the start of each new period until you cancel.
• You can cancel at any time online through Polar’s customer portal (linked from your receipt email) or by writing to support@keptsec.com. Cancellation takes effect at the end of the current billing period, and you keep access until then.
• Cancelling does not affect anything you have already downloaded, or your rights under open-source licences.
• If we stop providing a paid deliverable before the end of a period you have paid for, we will give you a pro-rated refund for the unused part of that period.

7. Refund policy

• If you ask within 14 days of any charge (the first purchase or a renewal), we will refund that charge in full. No reason needed.
• Ask through Polar or by writing to support@keptsec.com with your order email. Polar processes the refund to your original payment method.
• When we refund a subscription charge, we cancel the subscription and access to the paid deliverables for that period ends.
• After 14 days, charges are not refundable except under section 6 or where the law requires it.
• Polar may also issue refunds under its own terms. Nothing in this section limits any consumer rights you have under mandatory law. If you are a consumer in the EU, this 14-day refund is at least as generous as the statutory 14-day withdrawal right, and it applies even after you have started using the deliverables.

8. Accounts, API keys and registry tokens

Keep your API keys and registry tokens secret. They are issued to your organisation and must not be shared outside it. You are responsible for activity under your keys, including activity by software agents you run. Tell us at support@keptsec.com if you think a key has leaked; we will revoke it and issue a new one.

9. Oracle verdicts

Oracle answers are generated automatically from test runs in our sandbox. Each verdict says which package version was tested and when. Verdicts can be out of date or wrong, and when we have no recent run the oracle answers “unknown”. Verdicts are information to help you decide; they are not advice or a guarantee that any software is safe or will work in your environment. You remain responsible for what you install and ship.

10. Signed releases, SBOM and VEX documents

Signatures and provenance attestations show that an artifact was built by our pipeline from a stated source. They do not mean the software is free of defects or vulnerabilities. SBOM and VEX documents reflect our pipeline’s analysis on the date they were issued and may change as new advisories appear.

You may use, copy and share the documents we deliver to you, including with your own customers, auditors and regulators, as long as you do not alter them and present them as ours.

11. The GitHub App

The GitHub App is free. It reads pull request metadata and the repository contents it needs to identify dependencies, and it posts comments only on pull requests in repositories that installed it. It requests pull requests read and write, contents read and metadata read permissions, and no administration or issue write permissions. You can uninstall it at any time from your GitHub settings. Your use of GitHub is also subject to GitHub’s own terms.

12. Acceptable use

You must follow our Acceptable Use Policy. In short: respect rate limits, do not scrape or resell the oracle, and do not use the Service to attack anyone.

13. No warranty

To the fullest extent the law allows, the Service and all deliverables are provided “as is” and “as available”, without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted or error-free operation. Open-source code is also provided under the warranty disclaimer in its own licence.

14. Limitation of liability

To the fullest extent the law allows:

• we are not liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data or goodwill;
• our total liability for all claims relating to the Service is limited to the greater of (a) the amounts paid for the Service in the 12 months before the event giving rise to the claim, and (b) USD 100.

These limits do not apply to damage we cause intentionally or through gross negligence, to liability for death or personal injury, to fraud, or wherever mandatory law (including Romanian law and consumer protection law) does not allow them.

15. Suspension and termination

We may suspend or revoke keys, tokens or access if you breach these Terms or the Acceptable Use Policy, if your use threatens the security or stability of the Service, or if the law requires it. Where reasonable we will tell you first. You may stop using the Service at any time. Sections 3, 4, 9, 10, 13, 14 and 17 survive termination.

16. Changes

We may change the Service or these Terms. We will post the new Terms at keptsec.com with a new effective date. For material changes affecting paid plans we will give at least 30 days’ notice by email before they apply to you; if you do not agree, you can cancel before they take effect.

17. Governing law and disputes

These Terms are governed by Romanian law, and the competent courts in Timiș county, Romania, have jurisdiction, except where mandatory consumer law gives you the right to bring proceedings where you live or to rely on the laws of your country of residence.

18. Contact

Secure Stack Consulting S.R.L., Romania. Support and billing: support@keptsec.com. Legal matters: legal@keptsec.com.