Terms of service

Draft version 0.1 · Drafted 2026-09-25 · Effective date: 25 September 2026

1. Who we are and acceptance

These terms are an agreement between you and Sofus ("VentureLint", "we"). VentureLint is a brand of Sofus (Dutch Chamber of Commerce/KvK 50937782). By signing in to or using VentureLint you accept these terms. If you use VentureLint for an organization, you confirm that you are authorized to accept these terms for it.

VentureLint is intended for businesses and their representatives. [COUNSEL: confirm business-only use and any consumer-law consequences.]

2. Alpha service

VentureLint is in alpha. Features, limits, the assessment profile, and these terms may change. The service is provided without a service-level agreement or availability commitment. We may pause new assessments, scanning, or sharing at any time, for example to protect security or control cost. Live private-repository assessments are not yet enabled in production; the public demo uses fixed sample data only.

3. What an assessment is

A VentureLint assessment is an automated, point-in-time review of evidence about one GitHub repository at one commit, evaluated against a named, versioned VentureLint profile. It combines:

• repository settings and activity read from GitHub;
• static analysis by VentureLint-controlled, version-pinned scanners;
• your founder declarations, which are labeled as declared and are not independently verified.

The result is one of three verdicts: Baseline ready, Conditional, or Not ready. "Baseline ready" is the highest conclusion an automated assessment can reach. It means that, within the assessed scope, the evidence met the profile's minimum baseline. It is not a prediction of product quality, security, or investment outcome.

4. What an assessment is not

An assessment, report, or verdict is not:

• a penetration test, security audit, or code review by a person;
• a certification, attestation, or guarantee that software is secure or free of vulnerabilities;
• a statement of compliance with OWASP, NIST, ISO, SOC 2, or any other framework or law;
• legal, financial, or investment advice, or an endorsement of your company.

You may not describe a report as any of the above.

5. Limits of the evidence

• A report applies only to the assessed repository, branch, and commit, the profile version, and the time of issue.
• Missing, failed, timed-out, or unsupported evidence is reported as unknown. It never counts as a pass.
• Runtime behavior, production infrastructure, cloud configuration, and your team's understanding of the code are not assessed unless explicitly added.
• Scanners have limited language and file-type coverage and can produce false positives and false negatives.
• Repositories above the alpha limits (250 MiB compressed, 1 GiB expanded, 100,000 files, 10 MiB per file, 10-minute scan time) receive a partial or unsupported result.
• A report becomes stale when the tracked branch changes, and can be superseded, disconnected, or revoked. The share page shows the current status; a downloaded PDF shows only the status at issue.

6. Read-only GitHub access

• The VentureLint GitHub App requests read-only permissions: Metadata, Contents, Pull requests, Actions, Checks, and Administration (read), and optionally Deployments (read). It requests no write permissions.
• It can be installed on selected repositories only. Only repositories on which you have GitHub admin rights can be connected.
• Installation tokens are created just in time for each use and never stored.
• Disconnecting a repository in VentureLint stops VentureLint from using it but does not remove the App from GitHub. To revoke GitHub-side access, uninstall or reconfigure the App in GitHub.

7. No code execution

VentureLint does not run your code. It does not install packages, run tests, builds, scripts, hooks, or Dockerfiles, initialize submodules, or fetch Git LFS content. Repository files are analyzed statically in a temporary isolated environment that is deleted after the scan. Source code and declarations are not sent to AI or LLM providers.

8. Your responsibilities

You are responsible for:

• connecting only repositories you are authorized to have assessed, and having any permission required for personal data those repositories contain;
• the accuracy of your declarations, which you attest to when submitting;
• deciding whether and with whom to share a report, and describing it accurately, including its date, commit, status, and limitations;
• keeping your GitHub account and share links secure;
• your remediation, security, and business decisions. You remain responsible for your software.

9. Reports and sharing

• Each assessment produces a private report for your workspace and a separate public report built from a sanitized projection. The public report excludes private file paths, code snippets, contributor identities, secret values, remediation notes, and the repository name.
• A share link is a bearer link: anyone who has it can view the public report. Links can have an expiry date and can be revoked at any time.
• Revocation stops access through VentureLint. It cannot recall JSON or PDF copies that a recipient has already downloaded.
• Reports are never edited after issue. A correction creates a new report that supersedes the old one.
• We may mark a report revoked or superseded if its integrity is in doubt, for example after a scanner defect.

10. Acceptable use

You must not:

• connect repositories without authorization, or use VentureLint to assess third parties' code without their permission;
• attempt to access other customers' data or bypass authorization, rate limits, quotas, or other controls;
• submit content designed to attack, escape, or overload the scanner or the service, except as part of good-faith security research reported to security@venturelint.com;
• alter a report or present it as current, complete, or certified when it is not;
• use the service unlawfully.

We may suspend access that breaches these rules or threatens the service or other users.

11. Your content and our rights

Your code, declarations, and data remain yours. You grant us a limited right to process them only as needed to provide, secure, and support the service, as described in the privacy notice. VentureLint software, the report format, and the VentureLint name and marks remain ours. You may share reports issued to you under section 9. [OPEN: license for the published assessment profile is not yet activated.]

12. Fees

VentureLint is provided without charge during the closed alpha. Any fees will be agreed in writing before they apply.

13. Privacy and data

Our privacy notice explains what personal data we process and how long we keep it. You can export a project, purge scanner output, disconnect a repository, and delete a project or your account yourself. [COUNSEL: data processing agreement for personal data in customer repositories.]

14. Disclaimer

To the extent permitted by law, the alpha service and all reports are provided "as is" and "as available", without warranties of any kind, including fitness for a particular purpose or that the service will detect every issue.

15. Limitation of liability

[COUNSEL: draft this clause. Points to address:]

• [Liability cap: LIABILITY CAP AMOUNT or fees paid in the preceding period.]
• [Exclusion of indirect and consequential loss, lost profit, and loss of data.]
• [No liability for decisions made by you or third parties (investors, customers, acquirers) in reliance on a report.]
• [Nothing limits liability that cannot be limited by law, including for intent or deliberate recklessness (opzet of bewuste roekeloosheid).]

16. Termination

You may stop using VentureLint and delete your account at any time. We may suspend or end your access for breach of these terms, or end the alpha with 30 days' notice. On deletion, your data is removed as described in the privacy notice.

17. Changes

We may update these terms. We will publish the new version with its effective date and [COUNSEL: notice method for material changes].

18. Governing law and disputes

[COUNSEL: suggested — these terms are governed by Dutch law, and disputes are submitted to the competent court in Amsterdam. Confirm before publication.]

19. Contact

support@venturelint.com · VentureLint is a brand of Sofus (Dutch Chamber of Commerce/KvK 50937782).