Terms of Service

1. The Service

Canary adversarially tests software applications at runtime. When Customer connects a repository, Canary analyzes code changes, generates behavior checks, executes them against Customer's application inside isolated sandbox environments, and reports findings with supporting evidence. Findings are advisory: Canary informs Customer's engineering decisions but Customer remains solely responsible for its own code, deployments, and releases.

2. Accounts and Access

Customer must provide accurate account information and keep credentials secure. Customer is responsible for activity under its accounts and for managing which repositories and environments Canary may access. Customer must notify Canary promptly at founders@runcanary.ai of any suspected unauthorized access.

3. Customer Authorization to Test

By connecting a repository or target environment, Customer represents that it owns or controls that code and environment, or has all rights and permissions necessary to authorize automated testing against it. Customer will not direct the service at systems it does not control or is not authorized to test. Canary may suspend runs that appear to target unauthorized systems.

4. Customer Data

"Customer Data" means data Customer submits to the service, including source code, repository metadata, and application content exercised during testing. As between the parties, Customer owns Customer Data. Customer grants Canary a limited license to process Customer Data solely to provide and secure the service.

Canary will not use Customer Data to train or fine-tune any machine-learning model, whether Canary's own or a third party's. Source code is processed transiently in ephemeral sandboxes destroyed at the end of each run; retained outputs (findings, logs, evidence artifacts) are stored encrypted and deleted within 30 days of verified request or termination. Canary's processing of personal information is described in the Privacy Policy.

5. Service Outputs

Canary's reports, findings, and evidence artifacts generated for Customer ("Outputs") are provided for Customer's internal use. Customer may use Outputs freely within its organization. Outputs may contain screenshots or recordings of Customer's own application; Customer is responsible for how it shares them onward.

6. Acceptable Use

Customer will not: (a) use the service to test systems without authorization; (b) attempt to probe, disrupt, or circumvent the service's own security or sandbox isolation; (c) resell or provide the service to third parties without Canary's written agreement; (d) use the service to develop a competing product; or (e) use the service in violation of applicable law.

7. Fees

Paid plans are billed as described at purchase or in an order form. Fees are non-refundable except as required by law or expressly agreed. Canary may change pricing with notice effective at the next renewal.

8. Confidentiality

Each party will protect the other's non-public information with at least reasonable care and use it only as needed to perform under these Terms. This obligation survives termination for three years; trade secrets are protected as long as they remain trade secrets.

9. Intellectual Property

Canary retains all rights in the service, including its software, models' orchestration, and documentation. Customer retains all rights in Customer Data and in its own applications. Feedback may be used by Canary without obligation.

10. Warranties and Disclaimers

Canary warrants it will provide the service with commercially reasonable skill and care. EXCEPT AS EXPRESSLY STATED, THE SERVICE IS PROVIDED "AS IS." CANARY DISCLAIMS ALL OTHER WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. CANARY DOES NOT WARRANT THAT THE SERVICE WILL FIND ALL DEFECTS OR VULNERABILITIES, OR THAT FINDINGS ARE COMPLETE OR ERROR-FREE. THE SERVICE DOES NOT REPLACE CUSTOMER’S OWN TESTING, REVIEW, OR RELEASE PROCESSES.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS OR REVENUES. EACH PARTY’S TOTAL LIABILITY UNDER THESE TERMS IS LIMITED TO THE FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. THESE LIMITS DO NOT APPLY TO CUSTOMER’S BREACH OF SECTION 3 OR 6, EITHER PARTY’S BREACH OF SECTION 8, OR AMOUNTS OWED UNDER SECTION 7.

12. Indemnification

Customer will defend and indemnify Canary against third-party claims arising from Customer’s breach of Section 3 (unauthorized testing) or Customer Data that Customer had no right to submit. Canary will defend and indemnify Customer against third-party claims that the service, as provided by Canary, infringes their intellectual property rights.

13. Term, Suspension, and Termination

These Terms apply while Customer uses the service. Either party may terminate for material breach uncured within 30 days of notice. Canary may suspend the service immediately for security risks, unlawful use, or non-payment. Upon termination, Customer’s access ends and data deletion follows Section 4.

14. General

These Terms are governed by the laws of the State of California, excluding conflict-of-law rules, and any dispute will be resolved in the state or federal courts of San Francisco County, California. Neither party may assign these Terms without consent, except to a successor in a merger or asset sale. If a provision is unenforceable, the rest remain in effect. Notices to Canary: founders@runcanary.ai and Canaries, Inc., 450 Townsend St, San Francisco, CA 94107. Canary may update these Terms with notice; continued use after the effective date constitutes acceptance.