Terms of Service

The short version: You use Lumstep to scan your code for security issues. You keep ownership of your code and your results. We run the service in good faith. These terms explain how the relationship works.

1. Acceptance of terms

By creating a Lumstep account or using the service, you agree to these Terms of Service and our Privacy Policy. If you're using Lumstep on behalf of an organization, you confirm that you have authority to bind that organization to these terms.

2. What Lumstep provides

Lumstep is an automated security scanning service. We connect to your code repositories, run security analyses (SAST, SCA, secret detection, SBOM generation), and deliver findings to your dashboard. For vulnerable dependencies with available fixes, Lumstep opens pull requests automatically - you decide whether to merge them.

• Free tier: Available without a time limit. No SLA guarantees on the free tier.
• Paid plans: Priority scanning, higher repository limits, team features, support response commitments.
• We reserve the right to change the feature set included in each plan with 30 days' notice.

3. Your responsibilities

• You own your code. Lumstep claims no ownership over your repositories.
• You grant temporary access. You authorize Lumstep to clone your repositories for scanning. Revocable at any time.
• Use it legally. Don't scan repositories you don't have permission to access.
• Keep your credentials secure. You're responsible for all activity under your account.

4. Data and privacy

Our Privacy Policy at /privacy explains how we handle data. Short: we don't store your source code, your data stays in the EU, and you can request deletion at any time.

5. Pricing and payment

• Free tier: Available at no cost. We may add limits with 30 days' notice.
• Paid plans: Billed monthly or annually via Stripe. Prices in euros, excluding taxes.
• Refunds: Full refund within first 30 days of a new paid subscription. No refunds after 30 days for the current period.
• Price changes: 30 days' notice before subscription price changes.

6. Intellectual property

• Lumstep's platform: owned by Lumstep SAS. Don't copy, reverse-engineer, or redistribute it.
• Your code and results: you retain full ownership. You can export results at any time. We claim no rights to your repositories.

7. Limitation of liability

Security findings are advisory. They represent our best automated analysis at the time of the scan. A clean scan is not a guarantee of security.

Lumstep SAS is not liable for: security incidents despite a passing scan, indirect or consequential damages, downtime or data loss. Our total liability is limited to the amount paid in the 12 months preceding the claim.

8. Termination

• You can cancel and disconnect at any time. Data deleted within 30 days.
• We can terminate access for terms violations or illegal activity. We'll notify you first unless immediate suspension is required.
• After termination, scan results available 30 days for export, then permanently deleted.

9. Governing law

French law. Exclusive jurisdiction of the courts of Paris, France.

10. Changes to these terms

30 days' notice by email and on the platform before material changes. Continued use after the effective date constitutes acceptance.