Terms of Service

These terms are the agreement between you and Atmos Security Consultoria em Ti LTDA for the Atmos scanner, the Atmos platform and everything on atmoslab.dev. Read them with the Privacy Policy, the Acceptable Use Policy and, where Atmos processes personal data for you, the Data Processing Addendum. Each of those is part of this agreement.

Version 2026-10-02. We keep a record of the version you accepted.

1. Who you are contracting with

In these terms, Atmos, we and us mean that company. You means the person who signs in to Atmos, or the organization that person accepts these terms for (for example by making a team workspace or paying for a plan). If you accept these terms for an organization, you confirm that you are allowed to bind it, and you then means that organization.

2. What the service is

Atmos is an application security scanner. The Software is the atmos command line binary, the editor extension and any other client we distribute. The Platform is the hosted service at app.atmoslab.dev that authorizes scans, delivers the managed ruleset and shows your findings to your team. Together they are the Service.

Scans run on your own machines or in your own continuous integration. The Platform does not clone your repositories.

Support. Questions and problems go to support@atmoslab.dev. A person reads and answers them. No current plan carries a committed response time.

3. Your account and your workspace

You need an account to use the Service. Your credentials are your sign-in to the Platform, each machine sign-in you approve for atmos login or an installer, and your workspace tokens. Keep them secret, and approve a machine sign-in only when you started it yourself on a machine you control.

A machine sign-in acts as you, with your current role, in the workspace you chose when you approved it. Anyone holding a machine sign-in can scan into that workspace and use its allowance, and anyone holding a workspace token can do the same in the token's workspace. Treat each credential like a password and revoke it if it leaks or the machine is lost. Tell us at support@atmoslab.dev as soon as you believe someone used one of your credentials without permission. You are responsible for what happens under your account and under your credentials, except where it is our fault.

You must be able to form a binding contract where you live, and you must not use the Service if we have previously terminated your account.

4. Plans and scan allowances

Free. One seat, three repositories and 100 scans per calendar month. Scans of public GitHub repositories are not counted. Free runs the same managed ruleset and the same engine as Pro, not a subset.

Pro. Priced per developer seat, billed monthly or annually, with unlimited scans, seats for your team, and ten repositories per seat. A seat is a member of your workspace, and a pending invitation holds a seat until it is accepted or withdrawn. Your seat count must cover the people who use the Service through your workspace, and where the developers active in your repositories materially and persistently outnumber your seats we may ask you to true up.

Fair use. The Service is for people developing software, not for bulk collection. Every plan has a ceiling of 500 scan uploads per repository per day, and we may add or adjust ceilings of this kind to protect the Service. A ceiling applies to new uploads only.

Scans. Each run of the scanner that the Platform authorizes is one scan, and a run the Platform refuses is not a scan.

Availability. Atmos needs to reach the Platform to run a scan, and there is no offline mode.

Trials. We may grant a trial on request. A trial includes everything in Pro except the source of the managed rules. When a trial ends, the workspace returns to Free.

Betas and previews. A capability we label beta, preview or experimental may change or be withdrawn at any time, without notice. Do not build a pipeline that depends on one.

5. Payment terms

Prices are in United States dollars and are shown on the pricing page. Payment is handled by our payment processor. Card details never reach our systems.

A subscription renews automatically at the end of each billing period at the price current for your plan at that time, until you cancel. You can cancel at any time from the billing portal. Cancelling stops the next renewal and leaves the subscription active until the end of the period you have already paid for, after which the workspace returns to Free.

Deleting a workspace ends its subscription at once, and the rest of the current period is not refunded.

Prices are exclusive of taxes unless stated otherwise. Where we are required to collect a tax, it is added at checkout. You are responsible for any tax you owe on your side of the transaction, and for giving us the tax identification we need to invoice you correctly.

We may change prices with at least 30 days of notice before the change applies to your next renewal.

Fees are not refundable and not creditable once a billing period has begun, except as stated in this section, in the Data Processing Addendum, or where mandatory law says otherwise.

Consumers. If you subscribe as a consumer, meaning a natural person buying outside a business or professional activity, you may withdraw within 7 days of a charge by writing to support@atmoslab.dev, and we refund it. This is the withdrawal right Brazilian consumer law grants on distance sales, honored for every consumer wherever you are. If the consumer law of your country grants you more, you keep it.

Annual subscriptions. An annual subscription cancelled in the middle of its term is not refunded pro rata, and access continues until the term ends.

Our billing errors. We refund a charge that we got wrong: a duplicate payment, a renewal after you tried to cancel, or seats you were billed for and never had.

Nothing in this section limits rights you have under mandatory law, including consumer protection law where it applies to you.

6. License to use the Software

For as long as your account is in good standing and within the limits of your plan, we grant you a revocable license to install and run the Software, and to use the Platform, for your own internal purposes, including scanning code you own or are authorized to scan. The license is not exclusive, and you may not transfer or sublicense it.

You may not:

• resell, rent, sublicense or host the Software or the Platform as a service for third parties,
• reverse engineer, decompile or disassemble the Software, except to the extent that applicable law expressly allows it despite this restriction,
• remove or obscure any notice of ownership, or work around the Platform's authorization of scans, the scan count or any other technical limit,
• extract the managed ruleset or the advisory data in order to build or improve a competing product, or
• use the Service in a way the Acceptable Use Policy forbids.

We keep every right we do not grant here, including all intellectual property in the Software, the Platform and the managed ruleset. Third-party components we distribute come with their own notices, which travel with the release and are printed by the atmos licenses command. The notices for this website and its assets are at THIRD-PARTY-NOTICES.txt.

7. What stays yours

Your code stays yours. Your custom rules stay yours. The findings a scan produces are yours. We claim no ownership over any of them.

To operate the Platform, you grant us a limited license to host, store, process and display the data your scans upload, for the purpose of providing the Service to you. The Privacy Policy lists what Atmos collects.

We may use aggregated operational data about how the Service performs, for example scan durations and error rates, to run and improve it. That data does not identify you. We do not use your code or your findings to train AI models. The subprocessors page describes the service providers we use and the trust review that shares the current named list.

If you give us feedback, we may use it without obligation to you.

8. How long we keep your data

Scan history. We keep the record of each scan and the report it uploaded for 12 months on Free, and for 18 months on Pro and during a trial, so your team can look back at past scans. After that we delete them. Open findings are not part of scan history, and they stay in the workspace.

Inactive accounts and workspaces. An account whose only workspace is its own Free personal workspace is kept, with that workspace, for as long as its holder signs in or runs a scan at least once every 12 months. After 12 months with neither, we delete the account and its workspace. Any other Free workspace is deleted after 12 months without a scan. We email the account holder, or the owners of the workspace, 30 days before either deletion, and a scan, or a sign-in by the account holder or by an owner, in those 30 days cancels it.

Shorter periods. We give at least 30 days' notice before we shorten a period in this section.

The Privacy Policy lists how long we keep everything else.

9. Confidentiality

Each party may receive information from the other that is not public: your findings, your custom rules and your configuration on our side, unreleased features and unpublished terms on yours. Each party uses the other's confidential information only to perform under this agreement, protects it with at least the care it gives its own and never less than reasonable care, and shares it only with people who need it and are bound to keep it confidential.

This does not cover information that is or becomes public without a breach of this section, that the receiving party already knew lawfully, that it lawfully received from someone under no duty of confidence, or that it developed independently. A disclosure the law compels is permitted. Where the compelled disclosure is of your information, we will tell you before we make it, unless the law forbids the notice.

Personal data is governed by the Privacy Policy and the Data Processing Addendum. What we may do with uploaded scan data is in section 7. This section covers everything else.

10. What Atmos does not promise

Atmos can miss a vulnerability. Every static analyzer can. We do not represent or warrant that the Service will find or identify every vulnerability, error, weakness or malicious pattern in your code or your dependencies, or that code the Service reports no findings on is free of them. Atmos reports what its rules and its analysis can support with evidence, on the languages and package ecosystems it supports, at the version you are running. It does not detect every vulnerability class, it does not cover every language, it can be defeated by code patterns it cannot follow, and a clean report is not proof that your code is secure.

Atmos is not a substitute for security review. It is one control among several. It does not replace human review, threat modelling, penetration testing, dependency policy, secure design or your own judgment about what to ship. Nothing Atmos reports, or fails to report, transfers responsibility for your software to us.

Findings are information, not advice. You decide what to fix, what to accept and what to ship. You are responsible for evaluating and testing any change you make in response to a finding before you rely on it. We are not liable for a decision you take on the basis of a finding, or on the basis of the absence of one.

11. Warranty disclaimer

The Service is provided as it is and as it is available. To the fullest extent the law allows, we disclaim every warranty that is not written into these terms, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, absence of infringement, accuracy, and uninterrupted operation free of errors. We do not warrant that the Service will detect any particular vulnerability, that it will be free of false results, or that it will meet any regulatory or certification requirement that applies to you.

Some jurisdictions do not allow parts of this disclaimer, and in that case it applies to you only as far as the law permits.

12. Limitation of liability

To the fullest extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost business, or loss of data or goodwill, however caused, even if the party was told such damages were possible.

To the fullest extent the law allows, our total aggregate liability arising out of or related to these terms or the Service, for all claims combined, is limited to the total amount you actually paid us for the Service in the twelve months immediately before the event that gave rise to the claim.

To the fullest extent the law allows, we are not liable for damages caused by your failure to meet your obligations under these terms, or by your decision to implement, delay or forgo a change in response to a finding or to the absence of one.

These limits do not apply to liability that cannot be limited under the law that governs this agreement, including liability for fraud or for willful misconduct. Nothing here removes rights you have under mandatory law, including consumer protection law where it applies to you.

Each limit above survives even if a remedy in these terms is found to have failed its essential purpose.

13. Your responsibility for what you scan

You confirm that you own the code you scan or that you are authorized to scan it, and that scanning it and uploading its findings does not breach anyone else's rights or any obligation you are under. You will defend and hold us harmless against a third-party claim that arises because that was not true, or because you used the Service in a way these terms or the Acceptable Use Policy forbid.

14. Suspension and termination

You may stop using the Service at any time, cancel your subscription from the billing portal and delete your account from your account settings.

We may suspend or terminate access if you materially breach these terms or the Acceptable Use Policy, if your payment fails and stays unpaid, or if we must do so to comply with the law or to protect the Service or other customers. Except where the breach makes it impossible, we will tell you first and give you a fair chance to fix it.

On termination, your license to the Software ends and you must stop using it. You can export your data before you close the account, and you can ask us to delete it afterwards. What we keep, and for how long, is in the Privacy Policy. Records we must keep for Brazilian tax and accounting obligations are kept for as long as that law requires.

These parts of the terms survive termination:

• the license restrictions and ownership,
• confidentiality,
• the disclaimers and the limitation of liability,
• your responsibility for what you scan,
• governing law, and this list.

15. Changes

We may change the Service, and we may change these terms. When a change is material, we will give notice by email to the address on the account or by a notice in the product, at least 30 days before it applies, unless the change must be immediate for legal or security reasons. Continuing to use the Service after a change takes effect means you accept it. If you do not, cancel before it applies.

16. Data protection

Where we process personal data on your behalf as part of the Service, the Data Processing Addendum applies and is incorporated into this agreement by this reference. You do not need to sign it separately. If your own procurement requires a signed copy, write to support@atmoslab.dev and we will countersign the same text.

17. Governing law and venue

These terms are governed by the laws of the Federative Republic of Brazil, without regard to conflict of law rules. The courts of the Judicial District of São Paulo, State of São Paulo, Brazil, have exclusive jurisdiction over any dispute arising from them, and both parties waive any other venue however privileged. This does not remove any right you have to bring a claim in the courts of your own country of residence where mandatory law gives you that right.

18. General

These terms, together with the documents they reference, are the entire agreement between us about the Service and replace any earlier understanding. If a clause is held unenforceable, the rest stays in force and that clause is read as narrowly as it must be to become enforceable. Failure to enforce a right is not a waiver of it. You may not assign this agreement without our written consent, and we may assign it to a successor in a merger or a sale of the business. Neither party is liable for a failure caused by something genuinely outside its control, other than an obligation to pay.

Notices to us go to support@atmoslab.dev or to the registered address above. Notices to you go to the email address on your account.