Terms of Service

These terms are the agreement between you and Atmos Security Consultoria em Ti LTDA for the Atmos scanner, the Atmos platform and everything on atmoslab.dev. Read them with the Privacy Policy, the Acceptable Use Policy and, where Atmos processes personal data for you, the Data Processing Addendum. Each of those is part of this agreement.

Version 2026-09-01. When you create a workspace or complete a checkout, the version you accepted is recorded with the time you accepted it.

1. Who you are contracting with

In these terms, Atmos, we and us mean that company. You means the person or the organization that creates a workspace or pays for a plan. If you accept these terms for an organization, you confirm that you are allowed to bind it, and you then means that organization.

2. What the service is

Atmos is an application security scanner. The Software is the atmos command line binary, the editor extension and any other client we distribute. The Platform is the hosted service at app.atmoslab.dev that validates licenses, delivers the managed ruleset, receives findings and shows them to your team. Together they are the Service.

Scans run on your own machines or in your own continuous integration. The Platform does not clone your repositories.

Support. Questions and problems go to support@atmoslab.dev. A person reads and answers them. No current plan carries a committed response time.

3. Your account and your workspace

You need an account to use the Service. Keep your credentials and your workspace tokens secret. Anyone holding a workspace token can scan against your workspace and consume your allowance, so treat one like a password, and revoke it if it leaks. You are responsible for what happens under your account and under your tokens, except where it is our fault.

You must be able to form a binding contract where you live, and you must not use the Service if we have previously terminated your account.

4. Plans and scan allowances

Free. One seat, three repositories, and 100 metered scans per calendar month. The counter resets on the first day of each month at 00:00 UTC, so signing up on the 28th gives you three days of that first month. Scans of repositories the Platform has verified as public do not consume the allowance. Free runs the same managed ruleset and the same engine as Pro, not a subset.

Pro. Priced per developer seat, billed monthly or annually, with unlimited scans, seats for your team, and ten repositories per seat. A seat is a member of your workspace, and a pending invitation holds a seat until it is accepted or withdrawn. Your seat count must cover the people who use the Service through your workspace. The Platform counts the developers active in your repositories over the trailing 90 days, and where that number materially and persistently exceeds your seats we may ask you to true up.

Fair use. The Service is metered for people developing software, not for bulk collection. We apply technical ceilings, including a limit of 500 scan uploads per repository per day on every plan, and we may add or adjust ceilings of this kind to protect the Service. A ceiling of this kind pauses further uploads until it resets. It never deletes anything you have already uploaded.

Scan history. On Free, scan history older than 90 days is deleted, including the uploaded scan reports behind it. Findings and their triaging are not affected by that deletion. On paid plans we keep scan history for the life of the workspace, except that we may delete scan history older than 400 days where operationally necessary, and we will give you at least 30 days notice before doing so. A workspace that moves from a paid plan to Free becomes subject to the Free retention window.

How a scan is counted. One gated invocation of the scanner consumes one scan from your allowance. A scan that is denied, for example because the allowance is exhausted or the token is invalid, does not consume one.

The license check is required. Every scan validates your workspace with the Platform before it runs. There is no offline mode, no cached lease and no grace window. If the Platform is unreachable, scans do not run. A pipeline that depends on Atmos also depends on the Platform being reachable.

Trials. We may grant a trial of the full product for a limited time on request. When it ends, the workspace returns to Free. Nothing is deleted by that change.

Betas and previews. A capability we label beta, preview or experimental may change or be withdrawn at any time, without notice. Do not build a pipeline that depends on one.

5. Payment terms

Prices are in United States dollars and are shown on the pricing page. Payment is handled by our payment processor. Card details never reach our systems.

A subscription renews automatically at the end of each billing period at the price current for your plan at that time, until you cancel. You can cancel at any time from the billing portal. Cancelling stops the next renewal and leaves the subscription active until the end of the period you have already paid for, after which the workspace returns to Free. Nothing is deleted by that change.

Prices are exclusive of taxes unless stated otherwise. Where we are required to collect a tax, it is added at checkout. You are responsible for any tax you owe on your side of the transaction, and for giving us the tax identification we need to invoice you correctly.

We may change prices with at least 30 days of notice before the change applies to your next renewal.

Fees are not refundable and not creditable once a billing period has begun, except as stated in this section, in the Data Processing Addendum, or where mandatory law says otherwise.

Consumers. If you subscribe as a consumer, meaning a natural person buying outside a business or professional activity, you may withdraw within 7 days of a charge by writing to support@atmoslab.dev, and we refund it. This is the withdrawal right Brazilian consumer law grants on distance sales, honored for every consumer wherever you are. If the consumer law of your country grants you more, you keep it.

Annual subscriptions. An annual subscription cancelled in the middle of its term is not refunded pro rata, and access continues until the term ends.

Our billing errors. We refund a charge that we got wrong: a duplicate payment, a renewal after you tried to cancel, or seats you were billed for and never had.

Nothing in this section limits rights you have under mandatory law, including consumer protection law where it applies to you.

6. License to use the Software

For as long as your account is in good standing and within the limits of your plan, we grant you a revocable license to install and run the Software, and to use the Platform, for your own internal purposes, including scanning code you own or are authorized to scan. The license is not exclusive, and you may not transfer or sublicense it.

You may not:

• resell, rent, sublicense or host the Software or the Platform as a service for third parties,
• reverse engineer, decompile or disassemble the Software, except to the extent that applicable law expressly allows it despite this restriction,
• remove or obscure any notice of ownership, or work around the license check, the allowance metering or any other technical limit,
• extract the managed ruleset or the advisory data in order to build or improve a competing product, or
• use the Service in a way the Acceptable Use Policy forbids.

We keep every right we do not grant here, including all intellectual property in the Software, the Platform and the managed ruleset. Third-party components we distribute come with their own notices, which travel with the release and are printed by the atmos licenses command. The notices for this website and its assets are at THIRD-PARTY-NOTICES.txt.

7. What stays yours

Your code stays yours. Your custom rules stay yours. The findings a scan produces are yours. We claim no ownership over any of them.

To operate the Platform, you grant us a limited license to host, store, process and display the data your scans upload, for the purpose of providing the Service to you. The Privacy Policy lists exactly what a scan uploads. In summary, a scan sends findings, rule identifiers, repository identity, branch, file paths, line numbers and one-way hashes of committer email addresses. Lines of source code are not sent unless you turn that option on yourself.

We may use aggregated operational data about how the Service performs, for example scan durations and error rates, to run and improve it. That data does not identify you. We do not use your code or your findings to train machine learning models. The subprocessors page describes the service providers we use and the trust review that shares the current named list.

If you give us feedback, we may use it without obligation to you.

8. Confidentiality

Each party may receive information from the other that is not public: your findings, your custom rules and your configuration on our side, unreleased features and unpublished terms on yours. Each party uses the other's confidential information only to perform under this agreement, protects it with at least the care it gives its own and never less than reasonable care, and shares it only with people who need it and are bound to keep it confidential.

This does not cover information that is or becomes public without a breach of this section, that the receiving party already knew lawfully, that it lawfully received from someone under no duty of confidence, or that it developed independently. A disclosure the law compels is permitted. Where the compelled disclosure is of your information, we will tell you before we make it, unless the law forbids the notice.

Personal data is governed by the Privacy Policy and the Data Processing Addendum. What we may do with uploaded scan data is in section 7. This section covers everything else.

9. What Atmos does not promise

Atmos can miss a vulnerability. Every static analyzer can. We do not represent or warrant that the Service will find or identify every vulnerability, error, weakness or malicious pattern in your code or your dependencies, or that code the Service reports no findings on is free of them. Atmos reports what its rules and its analysis can support with evidence, on the languages and package ecosystems it supports, at the version you are running. It does not detect every vulnerability class, it does not cover every language, it can be defeated by code patterns it cannot follow, and a clean report is not proof that your code is secure.

Atmos is not a substitute for security review. It is one control among several. It does not replace human review, threat modelling, penetration testing, dependency policy, secure design or your own judgment about what to ship. Nothing Atmos reports, or fails to report, transfers responsibility for your software to us.

Findings are information, not advice. You decide what to fix, what to accept and what to ship. You are responsible for evaluating and testing any change you make in response to a finding before you rely on it. We are not liable for a decision you take on the basis of a finding, or on the basis of the absence of one.

10. Warranty disclaimer

The Service is provided as it is and as it is available. To the fullest extent the law allows, we disclaim every warranty that is not written into these terms, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, absence of infringement, accuracy, and uninterrupted operation free of errors. We do not warrant that the Service will detect any particular vulnerability, that it will be free of false results, or that it will meet any regulatory or certification requirement that applies to you.

Some jurisdictions do not allow parts of this disclaimer, and in that case it applies to you only as far as the law permits.

11. Limitation of liability

To the fullest extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost business, or loss of data or goodwill, however caused, even if the party was told such damages were possible.

To the fullest extent the law allows, our total aggregate liability arising out of or related to these terms or the Service, for all claims combined, is limited to the total amount you actually paid us for the Service in the twelve months immediately before the event that gave rise to the claim.

To the fullest extent the law allows, we are not liable for damages caused by your failure to meet your obligations under these terms, or by your decision to implement, delay or forgo a change in response to a finding or to the absence of one.

These limits do not apply to liability that cannot be limited under the law that governs this agreement, including liability for fraud or for willful misconduct. Nothing here removes rights you have under mandatory law, including consumer protection law where it applies to you.

Each limit above survives even if a remedy in these terms is found to have failed its essential purpose.

12. Your responsibility for what you scan

You confirm that you own the code you scan or that you are authorized to scan it, and that scanning it and uploading its findings does not breach anyone else's rights or any obligation you are under. You will defend and hold us harmless against a third-party claim that arises because that was not true, or because you used the Service in a way these terms or the Acceptable Use Policy forbid.

13. Suspension and termination

You may stop using the Service at any time, cancel your subscription from the billing portal and delete your account from your workspace settings.

We may suspend or terminate access if you materially breach these terms or the Acceptable Use Policy, if your payment fails and stays unpaid, or if we must do so to comply with the law or to protect the Service or other customers. Except where the breach makes it impossible, we will tell you first and give you a fair chance to fix it.

On termination, your license to the Software ends and you must stop using it. You can export your data before you close the account, and you can ask us to delete it afterwards. What we keep, and for how long, is in the Privacy Policy. Records we must keep for Brazilian tax and accounting obligations are kept for as long as that law requires.

The sections on license restrictions, ownership, confidentiality, disclaimers, limitation of liability, your responsibility for what you scan, governing law and this sentence survive termination.

14. Changes

We may change the Service, and we may change these terms. When a change is material, we will give notice by email to the address on the account or by a notice in the product, at least 30 days before it applies, unless the change must be immediate for legal or security reasons. Continuing to use the Service after a change takes effect means you accept it. If you do not, cancel before it applies.

15. Data protection

Where we process personal data on your behalf as part of the Service, the Data Processing Addendum applies and is incorporated into this agreement by this reference. You do not need to sign it separately. If your own procurement requires a signed copy, write to support@atmoslab.dev and we will countersign the same text.

16. Governing law and venue

These terms are governed by the laws of the Federative Republic of Brazil, without regard to conflict of law rules. The courts of the Judicial District of São Paulo, State of São Paulo, Brazil, have exclusive jurisdiction over any dispute arising from them, and both parties waive any other venue however privileged. This does not remove any right you have to bring a claim in the courts of your own country of residence where mandatory law gives you that right.

17. General

These terms, together with the documents they reference, are the entire agreement between us about the Service and replace any earlier understanding. If a clause is held unenforceable, the rest stays in force and that clause is read as narrowly as it must be to become enforceable. Failure to enforce a right is not a waiver of it. You may not assign this agreement without our written consent, and we may assign it to a successor in a merger or a sale of the business. Neither party is liable for a failure caused by something genuinely outside its control, other than an obligation to pay.

Notices to us go to support@atmoslab.dev or to the registered address above. Notices to you go to the email address on your account.