Proveta terms of service

Who we are

Proveta is operated by GoStack Software Technologies, Unipessoal, Lda, a company in Portugal registered at the Conservatória do Registo Comercial under registration number and NIPC 519208340. VAT number PT519208340. Email hi@gostack.dev.

Accepting these terms

You accept these terms when you sign in to Proveta. A workspace admin accepts them again before paying in Stripe Checkout. If you accept for an organisation, you confirm that you can bind it. Proveta is for business use only, not for consumers.

The service

Proveta collects dependency and code findings from the GitHub repositories you connect. It tracks owners, deadlines, and decisions, and it produces evidence reports. Optional fix PRs propose dependency updates in your repositories. We can change and improve the service. We tell workspace admins at least 30 days before we remove a feature from a paid plan.

Your responsibilities

• Connect only the repositories and accounts that you are allowed to connect.
• Control who is in your workspace. Workspace admins manage members and roles.
• Review each fix PR and its checks before you merge it.
• Do not try to access another workspace, disrupt the service, or use it for anything unlawful. Test our security only under the rules on the Security page.

Findings and advice

Findings come from GitHub, OSV, FIRST.org EPSS, the CISA Known Exploited Vulnerabilities catalogue, and our own scanners. These sources can be incomplete or late. Proveta helps you manage and record your decisions. It does not replace your own judgement or an auditor’s opinion.

Your data

Your organisation owns the data it brings to Proveta. We use it only to provide the service, as the Data Processing Agreement describes. The Data Processing Agreement is part of these terms. We do not sell your data, and we do not use your code or data to train AI models. The Privacy notice explains the account data that we control ourselves.

Plans, fees, and taxes

The Free plan costs nothing. Paid plans are billed per workspace in advance, monthly or yearly, through Stripe, at the prices on the Pricing page. Prices do not include VAT or other taxes. We add them where the law requires. We tell workspace admins at least 30 days before a price change, and the new price applies from your next billing period.

You can cancel at any time in Settings. Cancellation takes effect at the end of the billing period that you paid for. We do not refund partial periods, unless these terms or the law say otherwise.

Availability and support

We work to keep Proveta available, but we do not promise a specific uptime. Support is by email at hi@gostack.dev, and we answer on business days.

Suspension

We can suspend a workspace if an invoice stays unpaid after we remind you, if its use puts the service or other customers at risk, or if it breaks these terms. We tell workspace admins before we suspend, unless the risk is urgent. We restore access when the cause is fixed.

Ending the contract, export, and switching

You can end the contract at any time, with no notice period. Cancel your plan and email us. When you ask to end the contract, export your data, or move to another provider:

• A transition period of up to 30 days starts. The service continues and we help you export your data.
• You can export workspace members and roles, connected repositories, findings and their sources, owners, deadlines, decisions and risk acceptances with their history, SLA policies and results, scans and their results, evidence reports, and the activity history.
• Evidence reports download from the app. We send the other data as JSON files by email when you ask.
• We do not export our scanning rules, internal logs, or security records. They are our trade secrets or they protect the service.
• After the transition period, you have at least 30 more days to collect your data.
• Then we erase your workspace data within 30 days, unless the law requires us to keep it. We tell you when the erasure is complete.
• Export and switching are free of charge.

The Security page states where Proveta’s infrastructure is and which law applies to it. We can end the contract with 60 days’ notice, or at once if you seriously break these terms.

Confidentiality

Each party keeps the other party’s non-public information confidential and uses it only for this contract. This does not apply to information that is public or that the law requires a party to disclose.

Liability

Neither party is liable for indirect or consequential loss, such as lost profits. The total liability of each party under this contract is limited to the fees that you paid in the 12 months before the claim, or €100 if you use the Free plan. These limits do not apply to fraud, wilful misconduct, or gross negligence, to death or personal injury, or where the law does not allow a limit.

Changes to these terms

We email workspace admins at least 30 days before a material change takes effect. If you do not agree, you can end the contract before the change applies. This page always shows the version in force and its date.

Law and courts

Portuguese law applies. The courts of Porto, Portugal, decide disputes, unless the law gives another court mandatory jurisdiction.