Terms of Service

These terms govern your use of ShellOrbit, a hosted service that receives security events from systems you connect, keeps them, and raises findings and alerts from them, and Leak Alarm, which looks for leaked keys in the apps you build. In this document, “we”, “us”, and “ShellOrbit” mean the operator of the service, and “you” means the person or organisation using it. If you use the service on behalf of a company, you confirm you have authority to accept these terms for that company.

By creating an account or sending events to a source, you accept these terms. If you do not accept them, do not use the service.

Changes in version 1.8. ShellOrbit no longer forwards webhooks to destinations: endpoints become sources, and the service now receives security events from systems you connect, runs ready-made and custom rules over them, and raises findings and alerts (sections 1, 3, and 5). You can turn on tripwire overage on a paid plan, billed per extra tripwire at the rate on your plan (sections 6 and 7). On Pro and Business the SDK can report the hostnames your app connects to (section 1). Chat alerts are available from Starter. This version applies to accounts created from 25 October 2026 at once, and to every other account from 24 November 2026; until then the previous version applies to them.

Changes in version 1.7. From 22 October 2026, revoking covers the providers listed in the documentation, and you can add a revocation webhook to your own system. Azure AI services keys are regenerated only after you confirm. Webhook events are no longer billed: each plan’s event volume is a fair use figure, and the event overage charge is removed. The only usage charge is optional log overage, for logs scanned past your plan’s allowance, per whole GB, if you turn it on (sections 6 and 7). You must be 18 or older to use the service, and sign up asks you to confirm it (section 2). From 22 October 2026, Cloudflare Turnstile checks the sign up, sign in, emailed sign in, and password reset pages and the contact form for automated use (section 12), and sign up asks you to accept these terms and the privacy policy, recording when you did. The privacy policy now sets out your rights under India’s Digital Personal Data Protection Act 2023. This version takes effect on 22 October 2026 for every account.

Changes in version 1.6. From 22 October 2026, Leak Alarm no longer scans GitHub repositories, and Incident Alerts is part of Leak Alarm on every plan, under the terms below. This version also names the providers revoking covers and the reporting of leaked GitHub tokens to GitHub.

Changes in version 1.5. From 19 October 2026, transactional email goes through Amazon SES only. The Leak Alarm provisions, the fair use rule for unlimited limits in section 6, and the support targets in section 9 apply from the same date.

1. What the service does

ShellOrbit provides:

• Sources: HTTPS endpoints that accept events from systems you connect and configure yourself, such as GitHub, Amazon Web Services, Okta, Auth0, and your own systems.
• Storage of each received event, including headers and body, for the history window on your plan.
• Rules, ready-made and your own, that read those events and raise findings, including a finding when a source stops sending.
• A dashboard and API for inspecting events and findings, and for acknowledging and resolving findings.
• Notifications about findings and account state.

Leak Alarm adds, within your plan’s limits:

• Scans of domains you have verified, for keys and open data a visitor’s browser could reach.
• Scans of log lines you stream to a log drain.
• Incident Alerts: an alert when a public security advisory matches what we can see of your stack, meaning your verified domains, the runtime the SDK reports, the services your findings point to, and the stack you declare.
• Tripwires: fake links, email addresses, database rows, and AWS keys that alert you when they are used.
• A JavaScript SDK that masks keys in your logs and reports what it finds, and on Pro and Business reports the hostnames your app connects to so that a new one raises a finding, and an MCP server for AI agents.
• On Pro and Business, revoking leaked keys at the providers listed in the documentation and locking an open Supabase table, for keys and tables you allow, after a ten minute window in which you can cancel; sending a revocation request for a leaked key to a webhook you add, so your own system rotates it; and, once you turn it on, reporting a leaked GitHub or Hugging Face token to that company’s token revocation service.

The service is an alarm and a record. A source only receives: we never act in a system you connect through it. The service does not replace your own monitoring, judgement, or response.

2. Accounts and authentication

Authentication is handled by WorkOS. Creating an account means an identity record is created with WorkOS on our behalf, and session credentials are issued through it. You are responsible for the security of your login method, for any credential you connect through a single sign on provider, and for every action taken through your account.

You must give accurate account information and keep the contact address current. Product update email is sent only if you opt in, and you can unsubscribe at any time. Transactional notices about your account, security, and billing are part of the service and are sent whether or not you opt in. Finding alerts, security notices, and billing notices go to that address, and a stale address is not a defence against a notice we sent.

You must be at least 18 years old, and at least the age of legal majority where you live if that is higher, and legally able to enter a contract. Sign up asks you to confirm this. The service is not offered to anyone under 18, and if we learn an account holder is under 18 we close the account.

3. Source secrets and keys

Source URLs, source secrets, and API keys are credentials. Treat them as such. Anyone who holds a source URL can post events to it, and anyone who holds an API key can read your stored events and manage your sources. Rotate any credential you believe is exposed, from the dashboard or the API, and tell us at security@shellorbit.com if you think our systems are involved.

4. Your responsibilities

You are responsible for:

• The systems you connect as sources, including that you are authorised to send their events to us.
• The content of the events you send us, including any personal data in them, such as account names, email addresses, and IP addresses, and for having a lawful basis to send and store that content.
• Acting on findings. The service alerts you; you decide what to do.
• Complying with the terms of the providers whose events you send us, and with the terms of any channel you send alerts to.
• For Leak Alarm: that every domain you verify, log source you drain, and place you plant a tripwire is yours or one you are authorised to protect, and that you have a lawful basis for the tripwire hit records collected for you.
• For any key or table you allow us to revoke or lock, and any revocation webhook you add: choosing it, running and securing your endpoint, keeping the provider access you gave us current, and rotating a key your app still uses before you allow it. You accept that revoking a key or locking a table can interrupt your own service, that the ten minute window exists so you can cancel, and that an action you allowed and did not cancel is not a failure of the service.

5. Acceptable use

You may not use the service for any malicious purpose, meaning any use intended to attack, deceive, defraud, or damage us, another customer, or a third party. That includes, without limiting the general rule:

• Point an alert channel or a revocation webhook at a system that has not consented to receive it. Using the service as a load generator, amplifier, or proxy for denial of service is prohibited.
• Send content that is unlawful in the jurisdiction where it is stored or received, including material that infringes intellectual property, child sexual abuse material, or content that is unlawful to transmit.
• Distribute malware, ransomware, or phishing content, stage or coordinate an attack on a third party system, or use a source or an alert to deliver an exploit payload to anyone.
• Impersonate a person, provider, or organisation, or forge a source event’s origin or signature in order to deceive us or anyone else about where it came from.
• Circumvent plan limits, including by creating multiple accounts to obtain additional free volume, or by sharing one account’s sources across unrelated organisations in order to avoid plan limits.
• Probe, scan, or test the vulnerability of the service without written permission, or interfere with another customer’s sources, data, or alerts.
• Resell the service as if it were your own infrastructure, unless we have agreed that in writing.
• Use Leak Alarm on a domain, log source, or system you do not own or are not authorised to protect, or try to get around domain verification.
• Use a tripwire to track a person, for example in an email to a customer, or to identify people rather than to detect a leak.
• Build a tripwire that asks anyone to enter a password, a card number, or another credential, or use one for phishing.
• Use a tripwire hit, or anything else from the service, to access, attack, or retaliate against the source of a hit. A tripwire records a request; it never runs anything on the visitor’s machine, and you may not make it.
• Store payment card data, government identity numbers, or health records in events you send us where doing so puts either of us under a compliance regime we have not agreed to. If your events carry data of that kind, the data processing addendum applies and you must tell us before you begin.

We may set technical protections, including per source rate limits and maximum event sizes, and publish them in the documentation. Traffic that threatens the stability of the platform may be throttled without notice, and we will tell you when we do.

Malicious use of the service, including anything in this section, is grounds for immediate suspension or termination of the account under section 15, without the notice period that applies to an ordinary breach and without refund of fees already paid, at our discretion and in addition to any other remedy available to us in law.

6. Plan limits, fair use, and overage

Each plan includes a monthly volume of source events, under fair use, and a history window. Source events are not charged. Volume is measured by events received. Findings, incident matches, tripwire hits, scans, and SDK reports are not events and are never charged.

Every account has a monthly fair use ceiling for source events: ten times the included volume on a paid plan, and twice on the free plan. It exists to stop a misconfigured or looping sender, not to sell an upgrade. Past it, new events are refused at the edge with a 429 status until the month turns. Some senders retry a refused event later; others, including GitHub, do not resend it on their own, and a refused event is not checked against your rules. We tell you once a month at 80 percent of the ceiling, and you can ask us to raise it. Events already accepted are processed and retained as normal.

Each paid plan includes a monthly volume of logs scanned. If an owner or admin turns on log overage, scanning continues up to twice that volume, and each whole GB scanned past the included volume in a calendar month is billed at the per GB rate published for your plan, as one charge on the invoice after the month closes. A part GB is not billed. Log overage is off unless you turn it on, and turning it off applies from that moment.

Each plan includes a number of tripwires. On a paid plan, if an owner or admin turns on tripwire overage, you can hold up to twice that number, and each tripwire past the included number is billed at the per tripwire monthly rate published for your plan, on the highest number you held at any point in the calendar month, as one charge on the invoice after the month closes. Tripwire overage is off unless you turn it on. Turning it off stops further tripwires past the included number from that moment; the month is still billed on its highest count.

Where a plan says unlimited, fair use applies: usage in line with one business operating its own products. If usage is far outside that, or threatens the stability of the platform, we will contact you to agree a plan or a limit before restricting anything, except where section 5 applies.

We do not delete stored events as a consequence of exceeding a plan limit. Events leave storage when they age out of your retention window, when you delete them, or when the account is closed as described in section 15.

7. Billing through Dodo Payments

Payments are processed by Dodo Payments as merchant of record. Dodo Payments is the seller of record for your purchase, handles the payment instrument, and collects sales tax, VAT, or GST where it applies. We never see or store your full card details.

• Your payment relationship for the transaction is with Dodo Payments, and its buyer terms apply to it alongside these terms.
• Subscriptions renew automatically for the period you selected until cancelled. Cancel from the dashboard before the period ends to stop the next renewal.
• Log overage and tripwire overage, if you turn them on, are calculated from our metering records and added to your next invoice, as section 6 describes. Source events are not charged.
• Prices are stated and charged in United States dollars and exclude tax. Tax is added at checkout where it applies and shown on your invoice.
• An upgrade takes effect immediately and starts a new billing period. A downgrade is scheduled: you keep the plan you paid for until the end of the period, and the lower plan starts on the renewal date. The refund policy sets out both.
• If a renewal payment fails, Dodo Payments retries it and we notify you. If it keeps failing, the subscription is put on hold, the account moves to the free plan limits, and eventually to suspension under section 15. Events already stored stay inside the retention window that applied when they were received, unless the account is closed.
• All fees are final and non refundable, as set out in the refund policy. Annual plans are paid up front for the year.

We may change prices. For an existing subscription we will give at least 30 days notice by email before a price change takes effect, and you may cancel before it does.

8. Free plan, free trial, and beta features

The free plan exists so you can run a real project without paying. It carries the same availability commitment as every other plan under section 9, and we may change its limits with notice.

A first time subscriber starts a paid plan with a 7 day free trial. A payment method is needed to start it, nothing is charged during the trial, and the first payment is taken when it ends unless you cancel before then, in which case you pay nothing. The trial is offered once per customer, and creating further accounts to obtain another one is prohibited under section 5.

Features labelled beta, preview, or experimental are provided as they are. They may change or be withdrawn, and they carry no uptime or support commitment. Do not put a beta feature on a path where a failure would hurt you.

9. Uptime, support, and maintenance

Every plan, including the free plan, carries a 99.9 percent monthly availability commitment on the source intake, measured as the proportion of well formed requests that receive a 2xx acknowledgement. Availability excludes:

• Scheduled maintenance announced at least 48 hours in advance on the status page.
• Failures caused by your configuration, or by a system you connect.
• Traffic throttled under section 5 or rejected under section 6.
• Events outside our control, as described in section 19.

If we miss that commitment in a month, tell us within 30 days and we will credit the affected month in proportion to the shortfall, up to one month of the plan fee. Service credit is the only remedy for missed availability, and credit is applied to future invoices rather than paid out. On the free plan there is no fee to credit, so the commitment is a published target we hold ourselves to rather than one that carries a credit.

The availability commitment covers the source intake. Rules, findings, Leak Alarm scans, Incident Alerts, alerts, and revoke actions are not part of it.

Support reply targets are 7 working days on Hobby, 5 on Starter, 3 on Pro, and 1 on Business, counted Monday to Friday from when your message reaches support@shellorbit.com or a ticket is created in the dashboard. Starter support is by email, Pro by priority email, and a Business account has a named account manager. These are targets, not guarantees, and missing one does not give rise to a credit.

10. Security

We take the measures set out in the data processing addendum, including encryption in transit, encryption at rest, least privilege access to production systems, and audit logging of administrative access. No system is immune to compromise, and nothing in this section is a warranty against it. A key Leak Alarm finds is stored only in masked form and is never used, not even to test it.

Report a suspected vulnerability to security@shellorbit.com. Do not test against other customers’ sources, do not exfiltrate data belonging to anyone else, and give us reasonable time to fix an issue before publishing it. We will not pursue a researcher who follows those conditions in good faith.

11. Your data and our use of it

You keep all rights in the events, payloads, and configuration you send us. We do not sell your data, do not use payload content to train models, and do not share payload content with third parties except the subprocessors listed in the subprocessors page, and then only to run the service.

We use aggregate operational metrics, such as counts, sizes, status codes, and latency, to run and improve the service and to bill usage. Those metrics describe traffic shape, not payload content.

You grant us the limited licence needed to store, transmit, transform where you configure it, and display your content back to you for the purpose of providing the service. That licence ends when the content is deleted.

12. Third party services

The service runs on Amazon Web Services, and all transactional email goes through Amazon SES. Authentication uses WorkOS. Payments use Dodo Payments. Zoho Corporation runs our CRM, product update email, and support desk. Cloudflare Turnstile checks the sign up, sign in, emailed sign in, and password reset pages and the contact form for automated use. These providers are subprocessors, listed with their purpose and start dates on the subprocessors page. We are responsible for their performance as part of the service, and we are not responsible for services you connect to on your own account, including the providers whose webhooks you route, the destinations you deliver to, and the services you connect to Leak Alarm, such as GitHub’s token revocation service, a log platform, or an account we may revoke keys in. Their own terms apply to them, and we act in them only through the access you grant.

13. Intellectual property

The service, including the dashboard, the API, the documentation, and the ShellOrbit name and mark, belongs to us. These terms grant you a right to use the service, not a right to our software or brand. You may say you use ShellOrbit. You may not present the service as your own product, or use our name or mark in a way that suggests endorsement.

Feedback you send us may be used without obligation to you, and sending feedback does not transfer any rights in your own product.

14. Confidentiality

Each side may learn non public information about the other. Neither side will disclose the other’s non public information except to people who need it to perform this agreement and who are bound to keep it confidential, or where disclosure is legally required. Your payload content is treated as confidential regardless of whether it is marked as such.

15. Suspension, termination, and what happens to your data

You may cancel at any time from the dashboard. Cancellation takes effect at the end of the current paid period, and the refund policy applies to money already paid.

We may suspend or limit the account, with notice where practical:

• For non payment that survives the dunning process.
• For a breach of section 5 that is serious or that we asked you to fix and you did not.
• Where continuing would expose us or another customer to legal risk or platform instability.

We may terminate for a material breach that is not fixed within 14 days of written notice, or immediately and without notice for unlawful use or for a malicious use described in section 5. If we discontinue the service entirely, we will give at least 90 days notice and provide export access during that period.

After the account closes, stored events and configuration are retained for 30 days so you can export them, then deleted from live systems. Backups age out within a further 35 days. Billing records are kept for as long as tax and accounting rules require.

16. Disclaimers

The service is provided as it is and as it becomes available. To the extent the law allows, we exclude implied warranties of merchantability, fitness for a particular purpose, and non infringement.

We do not warrant that an event will be processed, or an alert sent, within any particular time, that the service will be uninterrupted, or that stored data can never be lost.

Rules read the events your sources send. We do not warrant that they will detect every attack or risky change, that every finding is a real incident, or that a connected system sends every event that matters. An alert is information to act on, not an assurance that you are safe.

Leak Alarm detects and helps contain leaks. It does not prevent them, and it does not make an app secure. We do not warrant that it will find every exposed key, that every finding is a real leak, or that a tripwire will be touched when data is taken. Fix what it finds, and keep your own security practices. Incident Alerts depends on public advisories and on what we can see of your stack. We do not warrant that it will report every incident that affects you, or report one within any particular time, and an alert is information to act on, not an assurance that applying the fix makes you safe.

17. Limitation of liability

To the extent the law allows:

• Neither side is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, lost business, or lost goodwill, even if warned that they were possible.
• Our total liability arising out of or related to these terms is limited to the greater of the fees you paid us in the 12 months before the event giving rise to the claim, or 50 United States dollars.
• Where a service credit is available under section 9, it is the exclusive remedy for the unavailability it covers.

Nothing here limits liability that cannot be limited by law, including liability for death or personal injury caused by negligence, or for fraud.

These limits reflect the price of the service. The free plan and the lower paid plans are priced on the basis that this allocation of risk applies.

18. Indemnity

You will defend and indemnify us against third party claims arising from your content, your use of the service in breach of section 5, or your infringement of a third party’s rights. We will tell you promptly about such a claim, let you control the defence of it, and cooperate at your expense.

19. Events outside our control

Neither side is liable for a failure to perform caused by an event beyond its reasonable control, including a failure of an upstream provider, a network outage, a state action, or a natural event. This does not excuse an obligation to pay for service already provided.

20. Changes to the service and to these terms

We improve and change the service continuously. We will not remove a material feature from a paid plan without at least 30 days notice by email.

We may update these terms. For a material change we will give at least 30 days notice by email and publish the effective date at the top of this page. Continuing to use the service after the effective date means you accept the change. If you do not accept it, cancel before that date.

21. General

• These terms, together with the privacy policy, the data processing addendum where it applies, the refund policy, and the plan you selected, are the whole agreement between us about the service. How we handle your personal data, and your rights over it, including under India’s Digital Personal Data Protection Act 2023, are set out in the privacy policy.
• If a provision is unenforceable, the rest stays in force.
• Not enforcing a right on one occasion does not waive it.
• You may not assign this agreement without our consent. We may assign it as part of a merger, acquisition, or sale of assets, with notice to you.
• Notices to you go to the account email address. Notices to us go to legal@shellorbit.com.
• Nothing here creates a partnership, agency, or employment relationship.

22. Governing law and disputes

This agreement is governed by the laws of India, including the Information Technology Act, 2000. The competent courts of West Bengal, India, have exclusive jurisdiction over any dispute arising from it, except that either side may seek injunctive relief where its intellectual property or confidential information is at stake. Where you contract with Dodo Payments for payment, its own terms govern that payment relationship.

Before filing a claim, contact legal@shellorbit.com and give us 30 days to resolve it. Most disputes about billing or alerts come down to a record we can both read.

23. Contact

• General and account questions: support@shellorbit.com
• Billing: billing@shellorbit.com
• Privacy and data rights: privacy@shellorbit.com
• Security reports: security@shellorbit.com
• Legal notices: legal@shellorbit.com