Terms.
What we owe you, and what we will not promise.

ARCIFACT LTD, and the organisation you are buying for.

ARCIFACT LTD, registered in England, company number 17367182, registered office 128 City Road, London EC1V 2NX. In these terms we and us means that company, and you means the organisation on whose behalf a subscription is taken out. If you are agreeing on behalf of a company, you confirm you are authorised to do so. These terms apply to Arcifact Gate as a GitHub App, as a hosted analysis at arcifact.io, and to one-off reports we produce on request.

It reads configuration and reports what it establishes.

Gate analyses continuous integration configuration and observed check results, and reports what a passing required check does and does not establish. It reads; it does not modify your repositories, your branch protection or your rulesets. It posts its own check run and never asks to be a required check, so it cannot block a merge. If you choose to make it required, that is your configuration and its consequences are yours.

Not analysed never means safe.

Gate reasons about declared configuration and about results it can observe. It cannot see what your jobs actually do at runtime, what a third-party action does internally, what a runner image contains, or repository settings the API does not expose. Where it cannot decide, it reports undecided, and undecided is an answer rather than a pass.

A clean report is a statement about what was examined, not a warranty that your pipeline is sound or your software is secure. You remain responsible for your own release decisions. We say this here because it is the same discipline the product applies to your checks, and it would be incoherent to sell that argument and then quietly overstate our own.

Per committer, with the first five free.

Fees are charged per committer, where a committer is somebody who pushed a commit to a repository this installation covers in the preceding ninety days. The first five are free on every plan. Above that the rate falls in bands, and each band applies only to the committers inside it, so growing never produces a jump. The current rates are published at arcifact.io/pricing and form part of these terms.

You declare the number when you subscribe and we do not audit it. If it diverges materially from what GitHub reports we will write to you and agree a correction rather than adjusting a bill you have not seen. Subscriptions are annual or monthly. Fees are stated exclusive of VAT, which is added where due. Payment is taken by Stripe; we do not see or store your card details.

Public repositories are analysed free of charge, permanently, including for paying customers. A subscription renews annually unless cancelled, and you may cancel at any time from the billing portal, taking effect at the end of the period you have paid for. We do not refund the unused part of a term, and we do not charge you again after you cancel.

Changing your committer count, or switching between monthly and annual, is done by writing to us rather than from the billing portal. Stripe's portal cannot edit a subscription priced in bands, and we would rather state that here than let you discover it. We apply the change from the date you ask and prorate the difference.

Install it where you are entitled to, and do not attack it.

You confirm you are entitled to install the App on the repositories you select, and that doing so is permitted by your own policies. You agree not to use the service to analyse repositories you do not control, to attempt to extract findings about third parties, to probe or overload the service, or to resell the analysis as your own product. You are responsible for what your users do with your installation.

Your code stays yours. The reports are yours to use.

We claim no rights in your repositories, your configuration or your code. Reports and certificates we produce for you are yours to use, copy and share, including publicly. The analyser, its methods, the semantics corpus and the verifiers remain ours.

We may publish aggregate statistics drawn from analysis across many repositories, such as how often a class of defect appears. We will not identify your organisation or repositories in anything we publish without your written agreement, and we will not use your private repository contents as training data.

We disclose to the affected project first, and never sell a finding.

Our research sometimes produces findings about repositories we do not control. Every such finding is withheld from publication from the moment it is computed, and the disclosure window runs from the date the maintainers are told rather than the date we found it, so our delay cannot become their exposure. If a finding concerns your repositories, you will be told before anybody else is.

No uptime promise, because we would be promising GitHub's.

We do not offer a service level agreement. The analysis depends on GitHub's API being reachable and on infrastructure we do not own, and a number we cannot control is not a commitment we can make. What we do commit to is that the service fails closed: when it cannot complete an analysis it says so and claims nothing, rather than reporting a pass it did not establish.

We may change or discontinue features. If we discontinue a paid service during a term you have paid for, we will refund the unused portion.

We will do this properly. We will not warrant an outcome.

We warrant that we will provide the service with reasonable skill and care. Beyond that, and to the extent the law allows, the service is provided as it is, without further warranty of any kind, including any implied warranty of merchantability, fitness for a particular purpose, or that the analysis will find every defect in your pipeline.

Capped at what you paid, with the things that cannot be capped left uncapped.

Nothing in these terms limits or excludes our liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else which cannot lawfully be limited. Subject to that, neither party is liable to the other for indirect or consequential loss, loss of profit, loss of business, or loss or corruption of data, and our total liability arising out of or in connection with these terms is limited to the greater of the fees you paid us in the twelve months before the claim arose, or one thousand pounds.

That cap is set deliberately low relative to the harm a bad merge can do, and it is the reason the service does not block your merges and does not ask to be a required check. You should read a Gate report as information for your own judgement, not as a control you are relying on in place of your own.

You can leave from the portal. We need a reason.

You may cancel at any time, effective at the end of the paid term, and you may uninstall the App at any moment, which stops all analysis immediately. We may suspend or terminate an account that breaches § 05, that is used to attack the service or another party, or where required by law, and we will tell you why unless the law prevents it. On termination we delete your analysis records within thirty days, except where we must keep something for legal or accounting reasons.

You are the controller. We are your processor.

For the repository data the App reads on your instruction, you are the controller and we act as your processor. We process it only to provide the service and only on your documented instructions, keep it confidential, apply appropriate technical and organisational measures, assist you with data subject requests and with any breach, and return or delete it when you leave. We engage the sub-processors listed in our privacy policy and will give notice before adding another, so that you can object. Where data leaves the UK it is covered by the standard contractual clauses. A signed data processing agreement is available on request from legal@arcifact.io.

What we learn about your pipeline stays between us.

Each party will keep the other's confidential information in confidence, use it only for the purpose it was given, and disclose it only to people who need it and are under a like duty. This does not cover information that is already public, was already known without a duty of confidence, or is independently developed, and it does not prevent disclosure required by law, where we will tell you first if we lawfully can. Findings about your repositories are your confidential information, and § 07 says what we do with them.

Narrow, and pointed at the thing you actually control.

You will indemnify us against claims arising from your use of the service in breach of § 05, in particular from installing the App on repositories you were not entitled to, and from any claim by a third party that your material infringes their rights. We will indemnify you against a third-party claim that the service as we supply it infringes their intellectual property, provided you tell us promptly, let us conduct the defence, and do not settle without us. That indemnity does not apply where the claim arises from your modification of our output or from combining it with something we did not supply.

If GitHub is down, neither of us has broken this agreement.

Neither party is in breach for a failure caused by something beyond its reasonable control, including an outage at a platform or provider either of us depends on. If such an event prevents us providing the service for more than thirty consecutive days, either party may terminate and we will refund the unused portion of the term.

We cannot sell to everybody, and neither can you resell.

You confirm that you are not subject to UK, EU or US sanctions, are not located in a territory subject to comprehensive sanctions, and will not make the service available to anybody who is. We may suspend an account immediately where continuing would put us in breach of sanctions or export control law.

Tell us what is wrong and give us thirty days.

If either of us has a complaint, we will raise it in writing and try in good faith to resolve it for thirty days before starting proceedings. This does not stop either party seeking an injunction where it genuinely needs one, and it does not extend any limitation period. Write to legal@arcifact.io.

England and Wales, and thirty days' notice for anything material.

We may amend these terms. Where a change materially reduces what you get, we will give at least thirty days' notice by email to the address on the account, and you may cancel before it takes effect and receive a refund of the unused portion. Minor changes take effect on publication.

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If any part is unenforceable, the rest continues. Nothing here creates a partnership or agency, and a person who is not a party has no right to enforce these terms.

You may not assign this agreement without our written consent, which we will not withhold unreasonably; we may assign it to a successor of our business on notice to you. These terms, together with the privacy policy and any order we agree in writing, are the entire agreement between us on this subject and replace anything said beforehand, although nothing here excludes liability for fraudulent misrepresentation. If our terms and a written order conflict, the order wins for that order only.

Write to support@arcifact.io for the service, or legal@arcifact.io for anything on this page. Telephone +44 24 7542 2117, which directs to email so that every question reaches somebody who can answer it. Last revised August 2026.