Terms of Service

1Agreement

These terms form the agreement between you and Diffport for use of the Diffport website, the application at app.diffport.com, and the interfaces at api.diffport.com, together the service.

By creating an account, connecting a repository, or using the service in any other way, you accept these terms. If you are accepting them for an organisation, you confirm that you have authority to bind that organisation, and you in these terms means that organisation.

Our Privacy Policy forms part of this agreement and describes how information is handled.

2The service

Diffport reads the repositories you connect and reports the provenance of the code inside them: which parts were written by a machine, which by a person, and which carry no signal at all. It scores risk, reconstructs a view of your database schema from your migration files, raises alerts against rules you define, and issues signed reports.

The service reads. It is granted no write access to your repositories and cannot push changes, open or merge pull requests, or alter branches or settings.

We may add, change or remove features. Where a change removes a feature you rely on, or materially reduces the service, section 15 applies.

3Accounts

You must be at least sixteen years old and legally able to enter into this agreement.

You are responsible for the security of your account, for the credentials used to access it, and for everything done through it. Tell us promptly at legal@diffport.com if you believe an account has been accessed without authorisation.

A workspace may have several members with different roles. The owner and administrators of a workspace can see, change and remove the workspace and everything in it, including work added by other members. If you join a workspace you do not control, the person who controls it can see your activity in it.

4Your content

You own your code and your data. Nothing in this agreement transfers ownership of your repositories, your commit history, or anything derived from them to us.

You grant us a limited, non-exclusive licence to access, copy, process and store your repository content solely to provide the service to you, and to hold the results we derive from it in your workspace. That licence exists only for as long as it is needed to provide the service and ends when you disconnect the repository or delete the workspace.

We do not use your repository content to train machine learning models, our own or anybody else's. We do not share it with other customers, and we do not sell it.

You are responsible for having the right to connect the repositories you connect, and for meeting any obligation you owe your own contributors in respect of the information git records about them.

5Acceptable use

You agree not to:

• Connect a repository you do not have the right to connect
• Use the service to breach a law, or a right belonging to someone else
• Attempt to gain access to a workspace, account or interface you are not entitled to
• Probe, scan or test the security of the service other than by reporting what you find to us, or interfere with its operation for other users
• Exceed the published rate limits by using multiple tokens or accounts to work around them
• Resell the service, or provide it to a third party as if it were your own, without our written agreement
• Represent a provenance result as something it does not say — for example presenting an untraced result as a finding of human authorship

That last item matters to us. The value of the service rests on results meaning exactly what they say, and misrepresenting them harms every other user of it.

6Fees and billing

Pricing is published at diffport.com/pricing. The current plan is charged per workspace rather than per person, in advance, each month, and renews automatically until cancelled.

Payment is processed by Stripe. By subscribing, you authorise us to charge the payment method you provide to Stripe for the fee then in effect, together with any tax we are required to collect. Fees are exclusive of tax unless stated otherwise.

If a payment fails, we may retry it and may suspend access under section 14 until it succeeds. We will tell you before access is suspended for non-payment.

We may change our prices. An existing subscription keeps its price until the end of the period in which we tell you, and any increase applies from the following renewal. You may cancel before it takes effect.

7Trial and cancellation

A subscription begins with a free trial of the length stated at the point of purchase. Cancel at any time during the trial and nothing is charged.

You may cancel at any time from inside the application. There is no call to book, no form to complete and no notice period. Cancellation takes effect at the end of the period you have already paid for, and you keep access until then.

Fees already paid are not refunded on cancellation, because you retain access for the period paid for. Where the law where you live gives you a right to a refund that this paragraph would remove, that law applies instead of this paragraph.

Reports issued before cancellation remain verifiable against their hashes independently of us. What ends is the ability to sign new attestations against the workspace.

8Availability

We aim to keep the service available and working, and we take that seriously. We do not offer a service level agreement, an uptime commitment, or service credits, and we would rather say so plainly than publish a promise we have not built the operational capability to keep.

The service depends on GitHub, on our payment processor, and on our hosting provider. An interruption at any of them can interrupt Diffport, and those interruptions are outside our control.

Repository processing is not instantaneous. Work is queued and processed in batches, so results appear some minutes after the event that produced them.

We may carry out maintenance that makes the service briefly unavailable. Where we expect that, and where we can, we will say so in advance.

9Accuracy of results

Diffport reports what it can determine from the evidence in your repository. Where no signal is found, it reports the code as untraced. An untraced result is not a finding that a person wrote the code. It is a statement that no evidence of authorship was found, and it should not be read as anything else.

Detection depends on the signals tools leave behind. A tool that leaves no trace, a rewritten history, or a tool we do not yet recognise will all produce untraced results. We report confidence as the weakest of the signals contributing to a conclusion rather than the strongest.

Provenance results, risk scores and schema views are provided for your assessment and are not legal, regulatory, compliance or security advice. You remain responsible for decisions you make using them, including any representation you make to a third party, an auditor or a regulator on the basis of a report.

10Our intellectual property

The service, the software behind it, the Diffport name and marks, and everything on our website other than your content, belong to us or to our licensors. Nothing in this agreement transfers any of it to you.

You may use our name and marks to refer to Diffport factually, in line with our brand guidelines. You may not use them in a way that suggests we endorse you, or as part of your own name or mark.

If you send us feedback, a suggestion or a bug report, we may use it without obligation to you. We will not identify you as its source without asking.

11Warranties

We warrant that we will provide the service with reasonable skill and care.

Beyond that, and to the fullest extent the law allows, the service is provided as is and as available, without warranties of any kind, whether express, implied or statutory, including any implied warranty of merchantability, fitness for a particular purpose, non-infringement, or that the service will be uninterrupted, error-free, or that its results will be complete or accurate.

Some jurisdictions do not allow the exclusion of certain warranties. Where that is so, this section applies to the fullest extent permitted, and nothing in it removes a right you have that cannot lawfully be removed.

12Liability

To the fullest extent the law allows, neither party is liable to the other for indirect, incidental, special, consequential or punitive damages, or for loss of profit, revenue, data, goodwill or anticipated savings, however caused and whether or not the possibility of it was known.

To the fullest extent the law allows, our total liability arising out of or in connection with this agreement, whether in contract, tort including negligence, or otherwise, is limited in aggregate to the fees you paid us in the twelve months immediately before the event giving rise to the claim.

Nothing in this agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.

These limits reflect the price of the service and the allocation of risk both parties have agreed. Without them the service would be priced differently.

13Indemnity

You will defend and indemnify us against claims, losses and reasonable costs arising from your use of the service in breach of these terms, from content you connect that you did not have the right to connect, or from your breach of a law or of a right belonging to a third party.

We will tell you promptly of any such claim, let you control its defence, and give you reasonable co-operation at your expense. You may not settle a claim in a way that imposes an obligation on us without our agreement.

14Suspension and termination

You may stop using the service at any time, and may delete your workspace from inside the application.

We may suspend or terminate access where you materially breach these terms, where a payment remains unpaid after we have told you, or where continuing would expose us or another user to legal or security risk. Except where the risk requires immediate action, we will tell you first and give you a reasonable opportunity to put it right.

We may discontinue the service as a whole. If we do, we will give account holders at least thirty days' notice, refund any fee paid for a period after the service ends, and keep the export interfaces working during the notice period so you can take your data with you.

On termination, the licence in section 4 ends and your data is deleted in line with the retention periods in our Privacy Policy. Sections 4, 9, 10, 11, 12, 13 and 16 survive termination.

15Changes to these terms

We will update these terms as the service changes. The date at the top always reflects the current version.

Where a change materially reduces your rights or materially increases your obligations, we will tell account holders by email at least thirty days before it takes effect, and we will describe what changed rather than only that something did. If you do not accept the change, cancel before it takes effect and it will not apply to you.

Continuing to use the service after a change takes effect means you accept it.

16General

Governing law

This agreement is governed by the laws of Canada, and by the laws of the province in which Diffport is established, without regard to conflict of laws rules. The courts of that province have exclusive jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction. Nothing here removes the protection of the mandatory consumer law of the country where you live.

Entire agreement

These terms and the Privacy Policy are the entire agreement between us about the service and replace anything said or written before about it.

Severability and waiver

If a provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed if it cannot be, and the rest continues in force. A failure to enforce a provision is not a waiver of it.

Assignment

You may not assign this agreement without our written consent. We may assign it to a successor in connection with a merger, acquisition or sale of substantially all of our assets, on notice to you.

Force majeure

Neither party is liable for a failure to perform caused by an event beyond its reasonable control, excluding an obligation to pay.

Notices

Notices to you are sent to the email address on your account, and are treated as received when sent. Notices to us go to legal@diffport.com.

17Contact

Questions about this agreement, and any formal notice under it, go to one address.