Terms of Service

1. What Meshbound Does

Meshbound is an application-security service designed to identify certain security weaknesses in software, recommend or apply human-engineered remediations, and verify proposed fixes in controlled environments.

Depending on the features you use, Meshbound may:

• analyze source code and configuration;
• inspect connected repositories and projects;
• analyze Supabase, Vercel, GitHub, or other connected services;
• scan deployed applications and publicly accessible endpoints;
• identify potential security vulnerabilities or unsafe configurations;
• generate proposed code changes;
• create pull requests or other reviewable changes;
• create temporary or throwaway environments for verification;
• execute controlled security tests against those environments;
• monitor repositories for subsequent changes; and
• provide findings, remediation information, verification records, and related security information.

Meshbound is intended to assist developers and organizations. It is not a substitute for a qualified security engineer, penetration test, code review, legal advice, or a comprehensive security program.

2. Eligibility and Authority

You must be legally capable of entering into these Terms.

If you use Meshbound for an organization, you represent that:

1. you are authorized to do so;
2. you have authority to grant Meshbound the permissions necessary to provide the Service; and
3. your use of the Service complies with your organization's policies and applicable law.

You are responsible for ensuring that you have permission to scan, analyze, modify, or otherwise interact with every application, repository, environment, endpoint, database, and other system that you connect to Meshbound.

3. Your Accounts

Some features require an account.

You are responsible for:

• providing accurate account information;
• maintaining the confidentiality of your credentials;
• securing your account and connected integrations;
• limiting access to authorized users; and
• notifying us promptly of unauthorized access or suspected compromise.

You are responsible for activity performed through your account unless that activity resulted from Meshbound's breach of its security obligations.

4. Authorization to Access Connected Systems

When you connect a repository, cloud service, database, deployment platform, application, or other system to Meshbound, you authorize us to access and process that system to the extent reasonably necessary to provide the Service you requested.

You represent and warrant that you have the right to grant that authorization.

Depending on the integration and permissions you grant, Meshbound may read source code, configuration, metadata, deployment information, security settings, logs, or other information necessary to perform scans and prepare or verify remediations.

You should grant only the permissions reasonably necessary for the features you intend to use.

5. Live Application Scanning

Meshbound may provide a feature that allows you to submit the URL of a deployed application for security scanning.

By submitting an application for scanning, you represent and warrant that you are authorized to conduct or authorize security testing against that application and its associated infrastructure.

You authorize Meshbound to perform the security tests necessary to provide the requested scan.

Meshbound's scans are intended to be controlled and security-focused. Nevertheless, security testing can cause unexpected behavior, including increased traffic, application errors, rate limiting, alerts, or temporary service disruption.

You are responsible for ensuring that the application you submit can safely be scanned.

You must not use Meshbound to scan systems that you do not own or have explicit authorization to test.

6. Prohibited Uses

You may not use Meshbound to:

• scan or test systems without authorization;
• conduct attacks against third-party systems;
• facilitate unauthorized access;
• intentionally disrupt or degrade systems or services;
• exfiltrate, destroy, or unnecessarily expose data;
• use Meshbound to develop malware or other malicious software;
• circumvent authentication, access controls, or security mechanisms for unauthorized purposes;
• upload or process information that you are legally prohibited from providing to us;
• interfere with the operation of the Service;
• attempt to gain unauthorized access to Meshbound or another user's account;
• reverse engineer or circumvent technical restrictions of the Service, except where such restriction is prohibited by applicable law; or
• use the Service in violation of applicable law or the rights of others.

Meshbound may suspend or terminate access when we reasonably believe the Service is being used for unauthorized security testing, abuse, fraud, or other prohibited activity.

7. Your Content

"Your Content" means source code, repositories, application data, configurations, credentials, findings, logs, files, prompts, inputs, and other information that you submit to or make available to Meshbound.

You retain ownership of Your Content.

You grant Meshbound a limited, worldwide, non-exclusive license to host, copy, process, transmit, modify as technically necessary, and otherwise use Your Content solely as necessary to:

• provide and operate the Service;
• perform requested scans;
• generate and verify remediations;
• create requested pull requests or changes;
• maintain security and reliability;
• prevent abuse and fraud;
• provide customer support; and
• comply with applicable law.

We do not acquire ownership of your source code or application data merely because you use Meshbound.

8. Your Responsibility for Your Content

You are responsible for:

• the legality and accuracy of Your Content;
• obtaining all necessary permissions and consents;
• ensuring that you do not provide information to Meshbound that you are prohibited from sharing;
• maintaining appropriate backups; and
• reviewing proposed changes before deploying them.

You should not submit secrets, credentials, personal information, regulated information, or other sensitive information unless doing so is necessary for the Service and you are authorized to provide it.

Where Meshbound detects exposed credentials or secrets, you remain responsible for rotating or revoking them unless Meshbound explicitly provides a separate service that performs that action.

9. Remediations and Pull Requests

Meshbound may generate code changes, configuration changes, database policies, or other remediations.

Unless expressly stated otherwise, Meshbound does not automatically merge or deploy proposed changes.

You are responsible for reviewing, testing, approving, merging, and deploying changes.

A verification record means that Meshbound's specified security test passed in the environment in which it was performed. It does not mean that:

• the entire application is secure;
• the vulnerability can never recur;
• no other vulnerability exists;
• the application is compliant with a particular standard or law;
• the remediation is appropriate for every production environment; or
• the remediation will never cause unintended effects.

You should independently review all proposed changes before deploying them.

10. Verification Environments

Meshbound may create temporary or isolated environments to test proposed fixes.

Verification environments may contain copies or derivatives of portions of Your Content. We use such environments only for purposes related to providing the Service and will handle the information in accordance with our Privacy Policy.

Because verification environments are temporary, you should not rely on them as backups or permanent hosting environments.

11. Third-Party Services

Meshbound may integrate with third-party services such as GitHub, Supabase, Vercel, cloud providers, hosting providers, and other platforms.

Your use of those services is governed by their respective terms and policies.

Meshbound does not control third-party services and is not responsible for their availability, security, functionality, or changes to their APIs, permissions, pricing, or policies.

A third-party service may restrict or revoke Meshbound's access, which may prevent certain features from working.

12. Security

We take reasonable measures designed to protect information processed through Meshbound.

However, no software, service, storage system, or transmission method is completely secure.

You acknowledge that security vulnerabilities may exist in Meshbound itself, in third-party services, or in systems connected to Meshbound.

If you discover a potential security vulnerability in Meshbound, please report it to us through the security contact provided on our website.

13. Availability and Changes

We may modify, improve, suspend, or discontinue portions of the Service from time to time.

We do not guarantee that the Service will:

• be continuously available;
• operate without interruption;
• be free from errors;
• detect every vulnerability;
• identify vulnerabilities without false positives or false negatives; or
• remain compatible with every third-party platform.

We may perform maintenance, updates, or emergency changes that temporarily affect availability.

14. Fees and Paid Services

Certain features may require payment.

Prices, billing periods, usage limits, and applicable taxes will be presented to you before you purchase a paid Service.

Unless otherwise stated:

• subscriptions renew automatically for the applicable billing period;
• you authorize Meshbound or its payment provider to charge applicable fees;
• fees are non-refundable except where required by law or expressly stated otherwise; and
• you are responsible for applicable taxes other than taxes based on Meshbound's net income.

We may change pricing for future billing periods by providing reasonable notice.

15. Free Services and Scans

Meshbound may offer free scans, trials, or other free functionality.

Free features may have limitations, including scan limits, retention limits, functionality restrictions, or other usage restrictions.

We may modify or discontinue free functionality at any time, subject to applicable law.

16. Intellectual Property

Meshbound and its licensors own all rights in the Service, including its software, interfaces, designs, branding, documentation, detection rules, remediation libraries, verification systems, and other underlying technology, except for Your Content.

These Terms do not grant you ownership of Meshbound's technology.

You may not copy, sell, sublicense, distribute, modify, or create derivative works of the Service except as expressly permitted by us or applicable law.

17. Feedback

If you provide suggestions, ideas, bug reports, or other feedback about Meshbound, you grant us the right to use that feedback without restriction or compensation to you.

We will not treat feedback as confidential unless we separately agree to do so.

18. Confidentiality

Each party may receive confidential information belonging to the other party.

The receiving party will use reasonable care to protect confidential information and will use it only for purposes related to the parties' relationship.

Confidential information does not include information that:

• is publicly available without breach of these Terms;
• was already lawfully known to the receiving party;
• is independently developed without use of confidential information; or
• is lawfully received from another source without confidentiality obligations.

A party may disclose confidential information when required by law, provided that, where legally permitted, it gives the other party reasonable notice.

19. Privacy

Our collection and use of personal information is described in the Meshbound Privacy Policy.

The Privacy Policy forms part of these Terms.

Where Meshbound processes personal information on your behalf as a service provider or processor, additional data-processing terms may apply.

20. Disclaimers

21. Limitation of Liability

22. Indemnification

To the maximum extent permitted by law, you agree to defend, indemnify, and hold harmless Meshbound and its affiliates, officers, employees, and contractors from claims, damages, liabilities, losses, costs, and expenses arising from:

• your unauthorized use of the Service;
• your violation of these Terms;
• your violation of applicable law;
• your violation of a third party's rights; or
• your failure to obtain authorization to scan or access a system through Meshbound.

23. Suspension and Termination

You may stop using Meshbound at any time.

We may suspend or terminate your access if:

• you materially breach these Terms;
• you use the Service unlawfully or abusively;
• your use creates a security risk;
• payment obligations remain overdue;
• required by law; or
• we discontinue the relevant Service.

Upon termination, your right to use the Service ends.

We may retain certain information for legitimate business purposes, security, fraud prevention, legal compliance, dispute resolution, or as otherwise described in our Privacy Policy.

24. Changes to These Terms

We may update these Terms from time to time.

When we make material changes, we will provide reasonable notice, such as by posting an updated version on our website or notifying you through the Service.

Your continued use of Meshbound after the effective date of updated Terms constitutes acceptance of the updated Terms.

25. Governing Law

These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-law principles.

The courts located in Ontario, Canada will have exclusive jurisdiction over disputes arising from these Terms, except where applicable law requires otherwise.

26. General

These Terms constitute the agreement between you and Meshbound regarding the Service and supersede prior agreements concerning the same subject matter.

If any provision is found unenforceable, the remaining provisions remain effective.

You may not assign these Terms without our prior written consent, except in connection with a merger, acquisition, corporate reorganization, or sale of substantially all of your assets.

Meshbound may assign these Terms without restriction.

Failure to enforce a provision does not constitute a waiver.

27. Contact

Questions about these Terms can be sent to:

Meshbound
Email: legal@meshbound.dev

Meshbound may update this contact information by posting an updated address on its website.