Terms of Service

Who these terms bind#

These terms form a contract between LIMITLESS KNOWLEDGE, a French simplified joint-stock company with a single shareholder (SASU) with a share capital of 500 euros, registered office at 10 Place de Wicklow, 78180 Montigny-le-Bretonneux, France, registered with the Versailles Trade and Companies Register under number 994 833 143 (SIRET 994 833 143 00013, VAT FR46994833143), owner of the Narvy brand, and you, whether you use Narvy as an individual or on behalf of an organisation. In this document "we" and "us" mean LIMITLESS KNOWLEDGE, and "Narvy" means the platform we publish at narvy.io.

If you accept these terms on behalf of a company, you confirm you have authority to bind it, and "you" then means that company.

You accept these terms by creating an account or by using the service. If you do not accept them, do not use Narvy. Our Privacy Policy and, where it applies, our Data Processing Agreement form part of this contract.

What Narvy does#

Narvy analyses software for security weaknesses across several surfaces and, for a subset of findings, proposes the fix as a pull request. Depending on your plan, the service includes:

• Mobile static analysis of Android (APK, AAB) and iOS (IPA) binaries, and of Android and iOS source code.
• Mobile dynamic analysis, which runs the application in an instrumented test environment we operate.
• Web application scanning against a URL you specify, including authenticated scanning where you supply credentials.
• Source code analysis for several languages, from a connected repository or an uploaded archive.
• Dependency analysis against public vulnerability databases.
• Cloud posture review using read-only credentials you provide.
• Host configuration auditing over SSH against a server you designate.
• Automatic remediation, which opens a pull request on your repository for the finding classes it supports.
• Reports and exports in JSON, SARIF, HTML and PDF, and integrations with CI/CD tooling and issue trackers.

Automatic remediation does not cover every finding class, and it will not silently change your code: it opens a pull request that you review and merge, or close. Compliance mapping in the product is a decision-support tool, not a certification. Our mapping is article-by-article for OWASP MASVS and for CNIL recommendations; our references to CRA, DORA and NIS2 are a derived mapping intended to help you prepare, and neither we nor the report certifies compliance with any of them.

We may add, change or withdraw features. If we withdraw a feature you are paying for, section 15 applies.

Your account#

You need an account to use anything beyond the public pages. You agree to register with accurate details, to keep them current, and to keep your password and any API tokens to yourself. Enable two-factor authentication if your account has repository or cloud access; it is available on every plan.

You are responsible for what happens under your account, including actions by your team members and by anything you automate against our API. Tell us at founders@narvy.io as soon as you suspect unauthorised access.

One account is one customer. Sharing credentials so that several organisations use a single subscription is a breach of these terms.

Plans, limits and fair use#

Current plans, prices and included limits are published on the pricing page, which forms part of these terms. Plans differ in scan volume, available scan types, retention, and the number of team members.

The free Community plan is rate limited and carries the shortest retention: a Community scan and its report are deleted seven days after the scan runs. Export what you need before then. Community is for evaluating the product and for personal projects. Using it to deliver paid security services to third parties is not fair use, and we may require an upgrade.

Scanning consumes real compute, test environments and network capacity. We may apply proportionate technical limits, queue long jobs, or contact you before a scan whose cost is out of proportion to your plan, rather than run it and bill you for a surprise.

Authorisation to test#

Dynamic scanning is not passive. A web scan sends real requests to the target from our infrastructure. A host audit opens a real SSH session. Mobile dynamic analysis installs and runs your application. Directing any of these at a system you do not control, without authorisation, may constitute an offence under Articles 323-1 and following of the French Criminal Code, and equivalent legislation elsewhere, including the Computer Misuse Act in the United Kingdom and the Computer Fraud and Abuse Act in the United States.

We may ask for proof of authorisation before running a scan, and we may refuse or stop any scan where we have reasonable doubt. We keep records of who launched which scan against which target, and we will produce them to a competent authority when legally required.

You are solely responsible for any consequence of a scan against a target you were not authorised to test, including disruption of the target. Section 12 applies.

Acceptable use#

You agree not to:

• Use Narvy to prepare, assist or carry out an attack on any system.
• Upload malware for distribution, or use the platform as a hosting or delivery channel. Analysing a suspected malicious sample you legitimately hold is a legitimate use and is not covered by this restriction.
• Attempt to access another customer's data, or any part of our infrastructure not exposed to you as a feature. Good-faith security research is welcome through founders@narvy.io, and this restriction does not stand in its way.
• Overload, degrade or circumvent the technical limits of the service, including by creating multiple accounts to bypass a quota.
• Resell, sublicense or expose the service to third parties as your own product without a written agreement with us.
• Reverse engineer the platform, or extract our detection rules, scoring or models for the purpose of building or improving a competing product.
• Use the service in breach of any applicable law or export control regime.

Your content and our intellectual property#

7.1 What stays yours

You keep all rights in everything you submit: your binaries, your source code, your configuration, and the findings and reports produced from them. Nothing here transfers ownership of any of it to us.

You grant us a non-exclusive, worldwide licence to host, copy, unpack, execute and analyse what you submit, strictly to provide the service you requested and for as long as the retention rules in the Privacy Policy keep it. The licence ends when the data is deleted. We do not use your code to train a general-purpose model, and it is processed only within the European Union. The one narrow exception, false-positive feedback you explicitly submit, is described in section 4.4 of the Privacy Policy, and you can opt out of it.

7.2 What stays ours

The platform, its interface, its detection rules, its scoring, its models and its documentation belong to LIMITLESS KNOWLEDGE and are protected by intellectual property law. "Narvy" and its logos are our marks. Nothing in these terms grants you a right to use them beyond using the service as intended.

7.3 Talking about your results

You may publish, share and reuse your own scan reports however you like, including with your own customers and auditors. Reports produced on the free Community plan carry a watermark identifying their origin, and you agree not to remove it. We will not name you as a customer or use your logo without your written agreement.

Billing, taxes and refunds#

8.1 Payment

Paid plans are billed in advance, monthly or annually, through Stripe. We never see or store your card number. Prices are shown excluding VAT unless stated otherwise; VAT is applied at the rate that applies to you. If you are a business in another EU member state with a valid VAT number, the reverse charge applies.

A failed payment does not delete anything. Stripe retries, we email you, and if the subscription ends unpaid the account returns to the Community plan instead of being closed. Community retention (seven days) then applies to your history after the thirty-day notice described in 8.2, so export your reports if you expect a payment problem.

8.2 Changing or cancelling your plan

Upgrade at any time; the change is immediate and prorated, and the longer retention of the new plan applies at once. Cancel at any time from your billing page. There is no cancellation fee and no notice period. When the subscription ends, the account returns to the Community plan and keeps working.

When a plan change shortens retention (a move to a lower plan, or a cancellation, which returns the account to Community and its seven-day retention), the new plan's retention applies to your whole history, but only thirty days after the change. During those thirty days the retention of your previous plan keeps applying. When the change happens we email you the exact date from which data older than the new retention will be deleted, with a link to export it, and we remind you seven days before that date. If, within those thirty days, you move back to a plan whose retention is equal or longer, the scheduled deletion is cancelled.

8.3 Refunds

We refund a new subscription in full, on request, if you ask within seven days of subscribing and you have not consumed the expensive parts of the plan in the meantime, meaning dynamic mobile analysis and automatic remediation. Those use test environments and compute that we cannot get back. Refunds are not automatic: write to contact@narvy.io and we will process it.

Outside that window we look at it case by case, and we would rather refund than argue when the service did not do what we said it would.

Separately, if you subscribe as a consumer rather than for professional purposes, Article L221-18 of the French Consumer Code gives you fourteen days to withdraw from a distance contract, no reason required. We do not ask you to waive that right, so you keep the full fourteen days even after you start using the service. If you withdraw after using it, we may retain a proportionate amount for what you actually used, as Article L221-25 allows. This statutory right is yours whatever the paragraphs above say.

Availability and support#

We aim to keep Narvy available continuously and we monitor it externally, but we do not commit to a contractual uptime figure on self-service plans, and there is no service credit scheme attached to them. Claiming a number we do not measure against a contract would be worth nothing to you. Enterprise agreements can include a negotiated service level, in writing.

Dynamic mobile analysis depends on limited test capacity, so scans queue and occasionally wait. Scheduled maintenance is announced in advance in the product where it will be noticeable.

Support is by email at support@narvy.io for every plan, in English or French. Response times are faster on paid plans.

What a scan does not guarantee#

Security testing is sampling, not proof. Narvy is provided as is and as available. Within the limits French law allows, we exclude all implied warranties, and specifically we do not warrant that:

• a scan detects every vulnerability in your application, or every instance of a class it detects;
• every reported finding is a real vulnerability, since static and dynamic analysis both produce false positives;
• an automatically generated fix is correct, complete, or safe to merge without review;
• a report satisfies any regulator, auditor, certification body or customer questionnaire;
• the service is uninterrupted or error-free.

An empty report means our rules found nothing, and nothing more. It is not evidence that your application is secure, and you should not present it as such. Critical systems deserve an independent manual review in addition to automated testing.

This section does not exclude the warranties French law makes mandatory, including the legal guarantee of conformity for consumers.

Liability#

To the fullest extent permitted by law, our total liability arising from or connected to the service is capped at the amount you actually paid us in the twelve months before the event giving rise to the claim. Where you pay nothing, on the Community plan, the cap is fifty euros.

We are not liable for indirect or consequential loss, loss of profit, loss of business, loss of data, or reputational harm, nor for damage resulting from a vulnerability we did not detect, a finding you chose not to act on, or an automatically generated fix you merged without review.

These limits do not apply, and cannot under French law, to death or personal injury caused by our negligence, to our fraud or wilful misconduct, to gross negligence (faute lourde), or to any liability that cannot lawfully be limited. Nothing here reduces the rights a consumer has by law.

Indemnity#

You will indemnify us against claims, damages and reasonable costs, including legal fees, arising from:

• a scan you ran against a target you were not authorised to test;
• your breach of these terms or of any applicable law;
• content you submitted that infringes a third party's rights;
• a third party's claim relating to your use of the service.

We will tell you promptly about any such claim, will not settle it without your agreement, and will let you take over the defence if you want it.

Data protection#

How we handle personal data is set out in the Privacy Policy, which is part of this contract. The essentials: everything is hosted in the European Union, retention is set per plan (seven days on Community), and account deletion executes automatically at the latest three days after you request it.

Where the material you submit contains personal data belonging to your own users, you are the controller and we are your processor. The Data Processing Agreement governs that relationship as Article 28 GDPR requires, and it prevails over this section for it.

You are responsible for what you upload. If you can run a scan against a redacted dataset or a build without production data in it, do that.

Term, suspension and termination#

This contract runs from the day you create your account until you or we end it.

You can leave at any time: cancel the subscription from your billing page, or delete the account from your settings, which erases your data as described in the Privacy Policy.

We can suspend or close your account if you materially breach these terms, particularly section 5 or section 6, if your use threatens the platform or another customer, or if we are legally required to. Except where the breach is serious enough to require immediate action, or where the law compels us, we will warn you first and give you a reasonable chance to fix it. If we close a paid account for a reason that is not your breach, we refund the unused part of the period.

After termination you can request an export of your data for thirty days. After that, the deletion rules in the Privacy Policy apply. Sections 7, 10, 11, 12 and 16 survive termination.

Changes to these terms#

We will change these terms as the product and the law change. For a material change we email every account holder at least thirty days before it takes effect. If you do not accept it, you can cancel before that date and we refund the unused part of any prepaid period. Continuing to use the service after the date means you accept the new version.

Minor corrections, a broken link, a clearer sentence, happen without notice and never change your rights or obligations. The date at the top of this page always tells you which version you are reading and which one it replaces.

Governing law and disputes#

French law governs these terms, without regard to conflict-of-law rules.

Contact contact@narvy.io first: almost everything is resolved that way. If it is not, disputes go to the competent courts of the jurisdiction of our registered office, except that consumers keep every right the law gives them to bring proceedings elsewhere, including where they live.

Consumers may also use the free consumer mediation scheme provided under Article L612-1 of the French Consumer Code, and the European Commission's online dispute resolution platform. Ask us and we will point you to the competent mediator.

General#

• Whole agreement. These terms, the Privacy Policy, the Data Processing Agreement where it applies, and the pricing page are the entire agreement between us, and replace anything said earlier.
• Severability. If a clause is held invalid, the rest stays in force and the invalid clause is read down to what the law permits.
• No waiver. Not enforcing a clause once does not waive it.
• Assignment. You may not assign this contract without our written agreement. We may assign it in a merger or sale of the business, and will tell you.
• Force majeure. Neither side is liable for a failure caused by an event beyond its reasonable control, as French case law defines it.
• Language. These terms exist in English and in French. If the two versions differ, the French version prevails, since the company is French and French law governs.