PreShipDRAFT - requires attorney review. Not in effect.
PreShip Terms of Service
Last updated: [DATE] · Provider: [OWNER LLC NAME] ("PreShip", "Provider")
These Terms of Service are based on the Common Paper Terms of Service, which incorporates the Common Paper Cloud Service Agreement Standard Terms Version 2.1. Both are © Common Paper, Inc. and used under the Creative Commons Attribution 4.0 International license (CC BY 4.0). We filled in the Order Form and Key Terms below and made the changes listed under "Changes to the Standard Terms". Common Paper has not reviewed or endorsed these Terms or PreShip.
If you signed a separate Order Form with us to access PreShip with the same account, and that agreement has not ended, the terms below do not apply to you. Your separate Order Form applies instead.
This Agreement is between [OWNER LLC NAME] and the company or person accessing or using the Cloud Service. It consists of (1) the Order Form below and (2) the Framework Terms defined below. If you are accessing or using the Cloud Service on behalf of a company, you represent that you are authorized to accept this Agreement on its behalf. By signing up for, accessing or using the Product, including by checking the authorization box at checkout, Customer accepts this Agreement and agrees to be bound by it.
Order Form
Framework Terms: This Order Form incorporates and is governed by the Framework Terms, which consist of the Key Terms below and the Common Paper Cloud Service Standard Terms Version 2.1 (the "Standard Terms"), which are incorporated by reference. The Changes to the Standard Terms below control over any conflict with the Standard Terms. Capitalized words have the meanings given in this Cover Page or the Standard Terms.
| Cloud Service | PreShip: automated, point-in-time security reviews of web applications and, if Customer supplies or connects them, source code, databases and hosting settings ("Scans"), with reports, suggested fixes, re-scans, badges and trust pages ("Deliverables"). Offered as the PreShip Basic Scan, PreShip Launch Review, Guard and Agency plans described on the pricing page. |
|---|---|
| Order Date | The Effective Date, or for each later purchase, the date of that purchase. |
| Subscription Period | Basic Scan and Launch Review: one-time purchases with no subscription; access to each report lasts until it self-destructs (see Change 10). Guard and Agency: one month, renewing monthly. |
| Cloud Service Fees | As shown on the pricing page and at checkout. Basic Scan $9.99 (one-time); Launch Review $299 (one-time); Guard $49/month; Agency $199/month. A paid Basic Scan may be credited once, in full, toward one Launch Review for the same Customer; credits are non-transferable, have no cash value, and expire 60 days after the Basic Scan payment date. Provider may change prices by giving at least 30 days' notice (including by email or in the Product); changes apply from the next Subscription Period. |
| Payment Process | Customer pays at checkout, and for Guard and Agency authorizes automatic monthly charges to its payment method on file without further approval. Purchases are processed through Stripe Managed Payments: Stripe (through Link) acts as merchant of record and reseller, appears as the seller on Customer's receipt, calculates and collects applicable sales tax or VAT, and handles receipts, refunds and payment disputes under its own buyer terms, which govern the payment transaction. No Scan runs until payment is received. |
| Non-Renewal Notice Period | Customer may cancel Guard or Agency at any time from the dashboard. Cancellation takes effect at the end of the current Subscription Period. |
| Use Limitations | Scans only of targets Customer owns or is authorized in writing to test (see Change 2). One Basic Scan per domain every 30 days; additional Basic Scan purchases for the same domain within that period return the most recent cached result. Agency: up to 15 sites. Per-IP, per-account and per-domain rate limits apply. |
| Technical Support | Email support at hello@preshipsecurity.com on a commercially reasonable basis. |
| SLA | None. |
| Professional Services | None. (A human-reviewed "Verified Audit" is not currently offered.) |
Key Terms
| Customer | The company or person who accesses or uses the Product. If the person accepting this Agreement does so on behalf of a company, "Customer" means that company. |
|---|---|
| Provider | [OWNER LLC NAME] |
| Effective Date | The date Customer first accepts this Agreement. |
| Governing Law | [STATE] |
| Chosen Courts | The state or federal courts located in [COUNTY, STATE]. [Arbitration / class-action waiver: attorney to decide.] |
| Covered Claims | Provider Covered Claims: None. [Attorney to decide whether to offer the Common Paper default IP indemnity.] Customer Covered Claims: Any action, proceeding or claim (1) that the Customer Content, when used according to the Agreement, violates, misappropriates or otherwise infringes a third party's intellectual property or other proprietary rights; (2) arising from or relating to Customer's breach or alleged breach of Section 2.1 (Restrictions on Customer) or of Change 2 (Authorization), including any Scan of a target Customer was not authorized to test; or (3) arising from Customer's use or deployment of any Deliverable or suggested fix. |
| General Cap Amount | The Fees paid by Customer for the specific Scan, or for the Subscription Period, giving rise to the claim. |
| Increased Claims / Unlimited Claims | None. |
| Additional Warranties | None. |
| Notices | For Provider: hello@preshipsecurity.com. For Customer: the main email address on Customer's account. |
Attachments, Supplements & Modifications
DPA: None by default. [Attorney: offer a DPA on request for GDPR customers.] Security Policy: the data-handling commitments in the Privacy Policy. Scan Authorization: the Scan Authorization is incorporated into this Agreement.
Changes to the Standard Terms
The following changes modify the Standard Terms and control over any conflict with them.
1. What the service is not
Scans are not a penetration test, not a security audit, and not a compliance certification or attestation of any kind (including SOC 2, ISO 27001, HIPAA, PCI DSS or GDPR). A Scan, report, grade, badge or trust page is not a guarantee that Customer's application is secure or free of vulnerabilities. Automated checks can miss issues and can produce false positives.
2. Authorization and ownership verification
Customer may only request Scans of domains, applications, repositories, databases and hosting projects that Customer owns or is expressly authorized in writing to test, and represents and warrants that every Scan it requests is authorized. Before any active check (a check beyond loading the homepage and the resources it references, such as testing whether a database is readable with the app's public key or requesting files like /.env), Customer must complete ownership verification by serving a verification token at /.well-known/preship.txt or in a preship-verification meta tag. Without verification, a Basic Scan runs passive checks only, and a Launch Review or Guard scan does not run. Agencies must hold each client's written authorization before scanning a client's site and must provide it on request. The checks performed are described in the Scan Authorization.
3. Suggested fixes and pull requests
Fixes, code patches, configurations and pull requests are suggestions. If Customer connects GitHub and asks for one, Provider opens a pull request on a new branch of the connected repository; Provider never pushes to existing branches, merges, or deploys. Customer is solely responsible for reviewing, testing, merging and deploying any fix. Provider does not access, modify or deploy to Customer's production systems.
4. Warranties
Section 6.3 (Representations & Warranties from Provider) and Section 6.4 (Provider Warranty Remedy) are deleted. Section 7 (Disclaimer of Warranties) is supplemented as follows: THE SERVICE AND ALL DELIVERABLES ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY LAW.
5. Limitation of liability
In addition to Section 8.2 (Damages Waiver), and to the maximum extent permitted by law, Provider is not liable for lost data or for any breach, intrusion or incident affecting Customer's systems, whether or not a Scan detected or could have detected the underlying issue. Provider's total cumulative liability is limited to the General Cap Amount.
6. PreShip Basic Scan
The Basic Scan provides a grade, issue counts by severity and general issue areas only, without specific findings or fixes. Its results state whether active checks were included. If Customer verifies ownership after a passive-only Basic Scan, Customer may re-run that order once with active checks at no extra charge.
7. Refunds
Section 4 (Payment & Taxes) is modified so that refunds follow this policy and the merchant of record's buyer terms: [Refund policy, e.g. full refund within 7 days if no report has been delivered; attorney to reconcile with Stripe's refund window, the Basic Scan credit and cached repeat Basic purchases.]
8. Badges and trust pages
A badge shows only that a Scan on a specific date found no open critical or high findings. A badge from a Launch Review is valid for 90 days after the most recent Launch Review or re-scan for that site. While a Guard (or Agency) subscription covering the site is active, the badge remains valid on an ongoing basis; when it ends, the badge is valid until 90 days after the most recent Launch Review, re-scan or Guard scan. After that the badge and trust page show it as expired. Provider may revoke a badge if a later Scan finds open critical or high findings. Customer may not represent a badge as a certification. White-label reports must keep the disclaimers in Change 1.
9. Acceptable use
In addition to Section 2.1 (Restrictions on Customer), Customer will not use the Product to attack, probe or harass third parties, or to circumvent the security of systems Customer does not own or is not authorized to test.
10. Ephemeral reports
Launch Review reports, PDFs and patches are encrypted and automatically deleted 24 hours after delivery. Customer is responsible for downloading its copy. Section 5.5 (Effect of Termination) does not require Provider to retain or return deleted reports.
Contact
[OWNER LLC NAME], [MAILING ADDRESS], hello@preshipsecurity.com
Attribution: Based on the Common Paper Terms of Service and Cloud Service Agreement Standard Terms Version 2.1 by Common Paper, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Changes: completed the Order Form and Key Terms for PreShip and added the Changes to the Standard Terms above.