Terms and Conditions

1. Parties and Agreement

These Terms and Conditions ("Terms") constitute a legally binding agreement between you ("User", "Customer", or "you") and XtraSecurity ("XtraSecurity", "we", "our", or "us") governing your access to and use of the XtraSecurity platform, including the web dashboard, CLI, SDK, VS Code extension, and APIs (collectively, the "Service").

By creating an account, clicking "I agree", or using the Service, you confirm that:

• You are at least 18 years of age
• You have the legal capacity to enter into a binding contract
• If acting on behalf of an organisation, you have authority to bind that organisation
• You have read, understood, and agree to these Terms and our Privacy Policy

If you do not agree to these Terms, do not use the Service.

2. Description of Service

XtraSecurity is a cloud-based secrets management platform that enables developers and organisations to securely store, manage, rotate, and inject application secrets (API keys, tokens, database credentials, environment variables) across development, staging, and production environments.

The Service includes:

• Web dashboard for secret management and team collaboration
• CLI tool (xtra-cli) for terminal-based operations and CI/CD integration
• Node.js, Python, and Go SDKs for programmatic access
• VS Code extension for inline drift detection and secret scanning
• REST and WebSocket APIs
• GitHub Actions integration for secret synchronisation

3. Subscription Plans & Licence

Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Service for your internal business or personal development purposes.

3.1 Plan Tiers

Current pricing and plan features are listed on our Pricing page at xtrasecurity.com/pricing. We reserve the right to modify plan pricing with 30 days notice to existing paid subscribers.

3.2 Billing & Payment

• Paid subscriptions are billed in advance on a monthly or annual cycle
• Payments are processed by Razorpay (India) in INR, or by Stripe in USD/EUR for international customers
• All prices are inclusive of applicable GST for Indian customers
• Auto-renewal is enabled by default and will be disclosed at checkout. You may disable auto-renewal from Settings → Subscription at any time
• Failed payments may result in Service downgrade to the Free tier after a 7-day grace period

3.3 Refund Policy

• Monthly plans: No refunds after the billing cycle starts. You may cancel at any time; access continues until end of the paid period.
• Annual plans: Pro-rated refund available within 30 days of purchase or renewal. No refunds after 30 days.
• Service outage credits: If Service availability falls below 99.5% in any calendar month (for paid plans), you may request a pro-rated credit for the affected period. Contact [email protected] within 30 days of the incident.
• Refund requests must be submitted to [email protected] with order details

4. Account Registration & Security

• You must provide accurate, current, and complete information during registration
• You are responsible for maintaining the confidentiality of your account credentials
• You must notify us immediately at [email protected] of any unauthorised use of your account
• You are responsible for all activity that occurs under your account
• One person or legal entity may not maintain more than one free account
• You must not share your account credentials with third parties except Service Accounts created within the platform for this purpose

5. Your Data & Intellectual Property

Your data is yours. You retain all intellectual property rights in the secrets, configuration data, and other content you upload to the Service ("Customer Content").

By using the Service, you grant XtraSecurity a limited, non-exclusive licence to store, process, and transmit Customer Content solely to the extent necessary to provide the Service to you. We will not access, use, or disclose Customer Content for any other purpose without your explicit consent.

You are responsible for ensuring that Customer Content you upload does not violate any applicable laws or third-party rights.

6. Acceptable Use Policy (AUP)

You agree to use the Service only for lawful purposes. You must not use the Service to:

6.1 Prohibited Activities

• Store, manage, or distribute credentials for illegal services (dark web markets, malware distribution, phishing infrastructure)
• Store credentials that provide access to child sexual abuse material (CSAM) or any content that exploits minors
• Support, finance, or facilitate terrorist organisations or sanctioned entities
• Circumvent, disable, or interfere with security features of the Service
• Conduct penetration testing, vulnerability scanning, or load testing against XtraSecurity infrastructure without prior written consent
• Attempt to gain unauthorised access to other users' accounts or data
• Reverse-engineer, decompile, or extract source code from the Service
• Resell, sublicense, or otherwise commercialise access to the Service without a written reseller agreement
• Use automated means (bots, scrapers) to extract data from the platform beyond documented API limits
• Impersonate XtraSecurity or its employees in communications
• Transmit unsolicited commercial messages via platform invitation features

6.2 GitHub Integration Specific Terms

When using the GitHub Sync feature, you authorise XtraSecurity to access your GitHub repositories as configured. You must only connect repositories you own or have permission to integrate with third-party services. XtraSecurity will access only the minimum data necessary to perform the synchronisation.

6.3 Regulated Industries

If you operate in a regulated industry, you are solely responsible for ensuring your use of XtraSecurity complies with applicable sector-specific regulations, including:

• Healthcare (HIPAA): XtraSecurity does not provide a Business Associate Agreement by default. Contact [email protected] to request a BAA before storing credentials that provide access to Protected Health Information (PHI).
• Financial services: Compliance with PCI-DSS, RBI guidelines, and other financial regulations is your responsibility.
• Defence / Government: Use of XtraSecurity for classified government systems is prohibited without a specific written agreement.

7. Service Availability & SLA

We target a monthly uptime of 99.5% for paid plans, excluding scheduled maintenance (announced 48 hours in advance) and Force Majeure events.

The Free tier is provided on a best-effort basis with no uptime guarantee.

Enterprise plan SLAs are defined in the applicable Order Form or Enterprise Agreement.

8. Security Responsibilities

XtraSecurity is responsible for:

• Security of the platform infrastructure
• Encryption of secrets at rest and in transit
• Access control enforcement
• Timely patching of known vulnerabilities in our software
• Notifying you of security incidents affecting your data

You are responsible for:

• Safeguarding your vault passphrase (zero-knowledge mode)
• Proper team permission configuration within your organisation
• Enabling 2FA on your account
• Promptly rotating secrets you believe may be compromised
• Not sharing API keys or Service Account tokens with unauthorised parties
• Compliance with your organisation's internal security policies

9. Disclaimers

THE SERVICE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, XTRASECURITY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that the Service will be uninterrupted, error-free, or free of harmful components. We do not warrant that defects will be corrected.

Compliance disclaimer: Our "Pre-Audit Readiness Reports" (formerly labelled SOC 2/GDPR reports) are self-assessment tools generated from your current platform configuration. They are not official SOC 2 Type II attestations, GDPR audit certifications, or representations of regulatory compliance. Regulatory compliance is your responsibility.

Passphrase disclaimer: If you use Zero-Knowledge E2EE mode and lose your vault passphrase, XtraSecurity cannot recover your secrets. There is no technical mechanism for us to do so. We strongly recommend downloading and securely storing your recovery kit.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL XTRASECURITY, ITS DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR:

• Indirect, incidental, special, consequential, or punitive damages
• Loss of profits, revenue, data, goodwill, or other intangible losses
• Damages resulting from your inability to access or use the Service
• Damages resulting from unauthorised access to your account where you failed to secure your credentials
• Loss of secrets where zero-knowledge passphrase was lost

Our total cumulative liability to you for all claims arising out of or relating to these Terms or the Service shall not exceed the greater of:

• The total fees paid by you to XtraSecurity in the twelve (12) months preceding the claim; or
• INR 10,000 (ten thousand rupees) / USD 100 (one hundred US dollars)

Note for Indian consumers: Nothing in this section shall limit your rights under the Consumer Protection Act 2019 (India) or any other non-waivable statutory consumer rights.

Note for EU users: Nothing in this section limits XtraSecurity's liability under GDPR Article 82 for damages resulting from our violation of GDPR obligations.

11. Indemnification

You agree to indemnify, defend, and hold harmless XtraSecurity and its officers, directors, employees, and agents from any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising from:

• Your violation of these Terms
• Your violation of any applicable law or regulation
• Customer Content you upload that infringes third-party rights
• Your use of the Service in a manner that causes harm to a third party

12. Account Termination & Suspension

12.1 Termination by You

You may terminate your account at any time from Settings → Account → Delete Account. Upon termination, your secrets, projects, and personal data will be deleted within 30 days, except data we are required to retain by law (e.g., payment records for 7 years per GST Act).

12.2 Termination or Suspension by XtraSecurity

We may suspend or terminate your account:

• Immediately and without notice if you violate Section 6 (Acceptable Use), engage in fraudulent activity, or pose a security risk to other users
• With 14 days notice for non-payment of subscription fees (after the 7-day grace period)
• With 30 days notice if we decide to discontinue the Service or a feature

Upon termination by us without cause, we will provide a pro-rated refund of prepaid fees for the unused subscription period.

13. Open Source Components

Certain components of XtraSecurity (including the CLI and SDKs) are made available under open-source licences. The applicable licence for each component is identified in the respective repository's LICENSE file and THIRD_PARTY_NOTICES.

Nothing in these Terms grants you a right to use XtraSecurity's trademarks, logos, or brand elements beyond what is expressly permitted.

14. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of India, without regard to its conflict of law principles.

14.1 Grievance Redressal

In accordance with the Consumer Protection (E-Commerce) Rules 2020 and the Information Technology Act 2000, any grievances regarding the Service should first be raised with our Grievance Officer:

14.2 Arbitration

If a dispute cannot be resolved through the Grievance process, the parties agree to resolve disputes through binding arbitration under the Arbitration and Conciliation Act, 1996 (India). The arbitration shall be:

• Conducted by a sole arbitrator mutually agreed upon by both parties
• Conducted in English in Mumbai, Maharashtra, India
• Subject to the substantive laws of India

Class action waivers: You agree that any arbitration or proceedings shall be limited to the dispute between you and XtraSecurity individually. You waive any right to bring claims as a class action or class arbitration.

EU users: Notwithstanding the above, EU consumers retain the right to bring claims before their local courts and to use EU online dispute resolution mechanisms available at ec.europa.eu/consumers/odr.

15. General Provisions

• Entire Agreement: These Terms, together with our Privacy Policy and any Order Form, constitute the entire agreement between you and XtraSecurity regarding the Service and supersede all prior agreements.
• Severability: If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect.
• No Waiver: Our failure to enforce any right or provision of these Terms will not constitute a waiver of that right.
• Assignment: You may not assign or transfer these Terms without our prior written consent. We may assign these Terms to a successor entity in connection with a merger, acquisition, or sale of assets.
• Modifications: We may modify these Terms with 30 days' notice to registered users via email or prominent in-app notification. Continued use of the Service constitutes acceptance.
• Force Majeure: We are not liable for delays or failures due to circumstances beyond our reasonable control, including natural disasters, government actions, internet outages, or third-party service failures.

16. Contact Information