Terms of Service

These terms are between you and Veristria, a Norwegian aksjeselskap (AS) under incorporation (24 August 2026), based in Norway. “We” and “us” mean that company. “The services” means veristria.com and the three product sites: keydrift.dev, rowshield.dev and feeguard.dev.

Using any of the services means you accept these terms. If you are agreeing on behalf of a company, you are confirming you are allowed to do that.

By submitting a target — a URL, a database connection, a Stripe account, a pasted payload — you confirm that you own it or that you have permission from the owner to have it tested. You are responsible for that permission, and for any consequence of testing something you were not entitled to test.

We may refuse or stop a scan without warning where we believe this is being broken, and we will cooperate with a site owner who reports unauthorized scanning of their property.

Our scanners are deliberately narrow: they read, they do not write, and they take the same path a browser or a read-only database role would. That is a constraint on us, not a license for you.

What each product retains from a scan is set out in the privacy policy, and it differs by product. Two things are worth stating here because they change what you should submit.

First: a scan report created from a public URL on KeyDrift is itself public. Anyone with the link can open it, and it names the site scanned. If you do not want that, use the paste mode or an account.

Second: you keep everything you submit. We claim no ownership over your code, your schema, your Stripe data or your findings. We may use aggregate, de-identified statistics about scans — counts, rule hit rates, timings — to improve detection.

You are responsible for what happens under your account and for keeping access to your email secure, since that is how sign-in works. Tell us promptly if you think someone else is in your account. Do not share one account across people who should not see each other’s findings; invite them to the organization instead.

You need to be old enough to enter a contract where you live, and the services are not intended for children.

Paid plans are billed through Stripe. A monthly plan renews monthly and an annual plan renews annually, at the price shown when you subscribed, until you cancel. Taxes are added where they apply.

You can cancel at any time from the billing portal in your account settings, without emailing anyone and without a retention conversation. Cancellation stops the next renewal; you keep the plan until the end of the period you have already paid for, and the account then continues on the free tier.

If a price changes we will tell you before it applies to you, and you can cancel instead.

Payments are not automatically refundable, but we are not going to argue with you over a period you did not use. If the product did not work, if you were charged after cancelling, or if you subscribed by mistake and have not used it, email us and we will refund it. Where consumer law gives you a right of withdrawal, that right applies on top of this and we will not ask you to waive it.

Do not use the services to:

• scan, probe or monitor anything you do not own or have permission to test;
• attack, overload or work around the rate limits on our infrastructure, or use the scanners as a relay to reach a third party;
• resell, white-label or redistribute the services, or scrape them to build a competing dataset;
• break the law, infringe someone else’s rights, or do anything that would put us in breach of the terms of the platforms we build on.

We can suspend an account that is doing any of this. Where the situation allows it we will tell you first and give you a chance to fix it.

We own the services, the detection rules, the documentation and the brands. You get a license to use them for as long as your account is in good standing, and nothing more. The reports we generate for you are yours to keep, publish and share.

Names like Stripe and Supabase belong to their owners. We use them descriptively to say what our products work with; we are not affiliated with or endorsed by them.

A clean scan is not a certificate of security. Our scanners look for specific, documented classes of problem in what they can see, and no scanner sees everything. Finding nothing means we found nothing — not that there is nothing to find. Every product publishes its own limits page, and we would rather you read that than trust a green checkmark.

We also do not provide legal, financial or compliance advice, and nothing we produce is a compliance certification or an audit in the regulatory sense.

The services are provided as they are, without warranties beyond those the law gives you and does not allow us to exclude. We work hard on uptime but we do not promise a specific availability level.

If we cause you loss, what we owe you is capped at the amount you paid us in the twelve months before the event — or, if you have paid us nothing, at nothing. We are not liable for indirect losses: lost profit, lost revenue, lost data, or a breach that a scan did not catch.

None of this limits liability we are not allowed to limit: death or personal injury caused by negligence, fraud, or anything else mandatory law reserves. If you are a consumer, your statutory rights come first and this section yields to them.

You can stop using the services and delete your account at any time. We can end this agreement with reasonable notice, or immediately if you break the acceptable-use rules. If we end it for our own reasons, we refund the unused part of what you paid.

We will update this page as the products change, and the date at the top moves with it. For a change that materially affects a paying customer we will give notice by email before it takes effect, and you can cancel if you do not accept it.

Norwegian law governs this agreement, and the Norwegian courts have jurisdiction. If you are a consumer in the EEA, you keep the protection of the mandatory law of the country you live in, and you can bring a claim there.