Skip to main content
TruStacks

Legal

TruStacks Terms of Service (Hosted Beta)

Version: 1.0 (Beta) · Last updated: 2026-10-23 Provider: TruStacks, Inc., a Delaware corporation ("TruStacks", "we", "us") Contact: the TruStacks support Discord, https://discord.gg/NSpqYrMa2p

What these terms cover

These terms govern your use of the hosted TruStacks service: the web app at app.trustacks.com, the API at api.trustacks.com, and the account and workspace you create there (together, the "Service").

They do not replace:

  • the EULA, which covers the TruStacks container images, including the runner you install in your own cluster;
  • the Apache 2.0 licence of the TruStacks policy bundle, framework packs and quickstart scripts.

You accept these terms when you create a workspace or accept an invitation to one. If you accept for an organisation, you confirm you can bind it, and "you" means that organisation.

1. What the Service is, and what it isn't

TruStacks is a governed delivery layer: agents propose, policy decides, humans approve. Agents read your repositories and declared stack and propose delivery artifacts (CI workflows, Dockerfiles, Helm or Kustomize, ArgoCD manifests) as pull requests. A signed policy decides whether a proposal may become a pull request. A person on your team reviews and merges it.

We author artifacts; you run them. The Service does not operate your CI, GitOps, cloud, secrets or scanners. Your own tools deploy what you approve.

The runner runs in your cluster, under your control, and connects out to the Service. You are responsible for that cluster and for what you deploy from it.

2. Beta

The Service is in Beta. That means:

  • Features may change, be added or be removed, sometimes without notice.
  • There is no service-level agreement and no guaranteed uptime or support response time. We aim to help quickly on our support Discord.
  • Don't rely on the Service as the only control for production or regulated workloads during Beta. Every proposal still goes through your own review and merge, which remains your control.
  • The Beta ends at General Availability. We will announce GA at least thirty (30) days in advance at https://trustacks.com, consistent with the EULA.

3. Accounts and workspaces

  • A workspace belongs to the organisation that created it. Its first user is its owner, and owners can invite and remove members.
  • Keep your credentials secure and tell us promptly about any unauthorised use.
  • You are responsible for activity in your workspace, including by people you invite.
  • Provide accurate information, including a working email address: account and password emails are how you get in.

4. Fees, Beta codes and cancellation

  • Paid plans are billed by Stripe at the price shown at checkout. We never see or store your card number.
  • A Beta code may cover your first month. After it, Stripe bills the plan price unless you cancel. If no payment method is on file, the bill fails.
  • If a subscription lapses or is cancelled, you can still sign in and see your workspace, but new work (analyses, proposals, gap analyses) stops until it's active again.
  • Cancel any time from Settings → Billing (Stripe's customer portal). Fees already paid are non-refundable, except where the law requires otherwise or section 10 says we'll refund them.
  • Prices may change; we'll give at least thirty (30) days' notice before a change applies to your subscription.

5. Your content

Your content is what you or your systems bring to the Service: repository content the runner reads, your environment profile, findings and scan results you upload or connect, questions you ask, rules you write, and the artifacts the agents generate for you.

  • You own your content, including the artifacts generated for you.
  • You give us a limited licence to host, process and transmit your content only to provide and secure the Service for you, and as described in the Privacy Policy.
  • We do not use your content to train AI models.
  • You confirm you have the rights to the content you connect, including the repositories you grant access to.

6. AI-generated output

The agents use large language models. AI output can be wrong, incomplete or insecure, even when it reads confidently. That's why TruStacks checks every proposal against a signed policy and requires a person to approve it.

  • Review every proposal before you merge it. You are responsible for what you merge and deploy.
  • Maturity scores, findings, answers and recommendations are aids to your judgement, not professional advice or a compliance certification. A SOC 2 mapping is not an audit opinion.
  • Policy checks reduce risk; they don't guarantee a change is safe, secure or compliant.

7. Your LLM provider and other third-party services

  • The agents call a large language model provider (Anthropic, or OpenRouter routing to Anthropic models) using the API key you provide. Your use of that provider is under your agreement with them, including what they do with the content sent to them and what they charge you.
  • Connecting GitHub (through the TruStacks GitHub App) grants the access shown when you install it. You can uninstall it at any time from GitHub.
  • Third-party services are governed by their own terms. We aren't responsible for them.

8. Acceptable use

Don't:

  • break the law, or infringe anyone's rights, through the Service;
  • try to access other customers' workspaces or data, or probe, scan or test the Service's security without our written permission (report vulnerabilities privately, as described in section 16);
  • disrupt or overload the Service, or get around rate limits, billing or usage controls;
  • resell the Service or use it to build a competing product;
  • use it to generate or deploy malware, or to attack systems you don't own.

We may suspend access to stop a violation, protect the Service or other customers, or comply with the law. Where we reasonably can, we'll tell you first.

9. Security

We protect the Service with measures appropriate to a Beta, including encrypted connections, credentials delivered sealed to your runner, tenant isolation, and signed images and policy. No system is perfectly secure. Tell us promptly about any vulnerability or incident you find.

10. Ending your use

  • You can stop using the Service and cancel your subscription at any time.
  • To have your workspace and its data deleted, ask us through support.
  • We may end these terms on thirty (30) days' notice, or immediately for a serious breach. If we end them without cause, we'll refund any prepaid fees for the unused period and give you a reasonable chance to export your data.
  • Sections 5, 6, 11, 12, 13 and 15 survive.

11. Disclaimer of warranties

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement, to the fullest extent the law allows.

12. Limitation of liability

To the fullest extent the law allows:

  • Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, even if advised of the possibility.
  • Each party's total liability under these terms is limited to the greater of the fees you paid us in the twelve (12) months before the claim, or one hundred U.S. dollars ($100).

13. Indemnity

You'll defend and indemnify TruStacks against third-party claims arising from your content, or from your use of the Service in breach of these terms or the law.

14. Changes to these terms

We may update these terms. For material changes we'll give at least thirty (30) days' notice in the app or by email, and the version above will change. Continuing to use the Service after the effective date means you accept the update.

15. Governing law

These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws principles. Disputes go to the state or federal courts in Wilmington, Delaware, consistent with the EULA.

16. Contact

Everything goes through the TruStacks support Discord, https://discord.gg/NSpqYrMa2p.

  • Support and legal questions: post in #support, or message a TruStacks team member directly for anything you'd rather not post publicly.
  • Security reports: message a TruStacks team member directly. Please don't post vulnerabilities in a public channel.