Terms and Conditions

1.1Startup Launchpad (the "Service") is operated by SurgoTech Solutions Ltd, a company registered in England and Wales under company number 16857943, whose registered office is 8 Rockingham Drive, Washington, United Kingdom, NE38 8BF ("we", "us", "our"). We are not currently registered for VAT.

1.2You can reach us at info@surgotechsolutions.co.uk, whether the question is about these terms, about your subscription or about the Service itself. That is also the address for any notice you have to give us under this contract.

1.3These terms, together with our privacy policy and any order confirmation issued through our checkout, form the contract between us and the business that subscribes to the Service ("you", "your", the "Customer"), whether that business is a company, a partnership or a self-employed individual. You accept these terms by ticking to confirm that you accept them, and in doing so you confirm that, where you are subscribing for an organisation, you have authority to bind it. These terms govern your use of the Service from that moment, including any period before your first payment. Your paid subscription itself begins as set out in clause 1.6.

1.4We may update these terms from time to time under clause 18. The version in force is the one published on this page at the date shown at the top of it.

1.5If these terms, our privacy policy and an order confirmation conflict, these terms prevail, except that an order confirmation prevails on the commercial terms it actually states (such as the fee and the Subscription Period), and the privacy policy prevails on how we handle personal data for which we are the controller.

1.6You conclude the contract by completing our online checkout: entering your details, ticking to confirm that you accept these terms and are subscribing for business purposes, and submitting payment by card. You can go back and correct anything you have typed at any point before you submit. Your subscription is formed when we email you an order confirmation, and the contract is concluded in English. We do not file a copy for you, so keep that email; the version of these terms in force is always the one published on this page.

1.7Because we are both acting as businesses rather than consumers, we agree that regulations 9(1) and 11(1) of the Electronic Commerce (EC Directive) Regulations 2002 do not apply to this contract.

2.1The Service is offered only to customers in the United Kingdom who are using it for work. It is not offered to consumers, and it is not offered to customers outside the United Kingdom.

2.2You do not need to be a limited company. Sole traders, freelancers, contractors and partnerships are all welcome, and so is an individual developer scanning code they write in the course of their own trade or profession. What matters is that you are using the Service for business purposes rather than as a private consumer.

2.3By subscribing you represent and warrant that:

1. you are subscribing wholly or mainly for the purposes of a trade, business, craft or profession, and not as a consumer;
2. you are based in the United Kingdom; and
3. you are subscribing on your own behalf or for an organisation you are authorised to bind, and not as agent for a consumer.

2.4The only postal address we ask for is the billing address you give at checkout, so that your invoices name your business. We rely on the confirmation you give under clause 2.3 when you subscribe, together with the billing country your card provider gives us, to establish that this contract is with a UK business customer.

2.5Because this is a business-to-business contract, the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and other consumer protection legislation do not apply to it. In particular, you have no statutory 14-day right to cancel; your cancellation rights are those set out in clause 11, and the money-back guarantee in clause 10 is offered voluntarily rather than because the law requires it.

2.6If it turns out that you are a consumer, or that you are not based in the United Kingdom, we may terminate your subscription immediately on notice and refund the fees you have paid for the unused balance of the then-current billing period.

3.1In these terms:

1. "Account" means the billable workspace you create on the Service, to which one or more Users belong.
2. "Customer Data" means data you or your Users submit to the Service, and the outputs the Service derives from your repositories, including scan reports, findings and the finding ledger.
3. "Findings" means the issues the Service reports against a Connected Repository, whether produced by the deterministic scan battery or by the AI discovery layer.
4. "Severity" means the label the dashboard gives a Finding, being one of "critical", "high", "medium", "low" or "info", in descending order of seriousness. A Finding of "low severity or above" is one labelled low, medium, high or critical.
5. "Connected Repository" means a source code repository you authorise the Service to read through our GitHub App.
6. "Subscription Period" means the period for which you have paid, beginning on the day your subscription starts and renewing at the end of each period. It is monthly unless your order confirmation says otherwise.
7. "User" means an individual you authorise to access the Account, whether as an Owner or a Member.

4.1The Service reads the source code of your Connected Repositories on a recurring schedule and presents the results in a hosted dashboard as red, amber and green scores with plain-English findings and suggested fix prompts, across areas including security, accessibility, SEO, reliability and housekeeping.

4.2Findings are produced by two distinct layers, which the dashboard labels separately:

1. a deterministic battery of open-source and first-party analysis tools, which produces the same result for the same input; and
2. an AI discovery layer, which uses a large language model to derive an architecture view of your application and to reason about threats against it. Output from this layer is labelled "AI-generated" wherever it appears.

4.3Subject to these terms and to your payment of the fees, we grant you a non-exclusive, non-transferable, revocable right for the duration of your subscription to access and use the Service for your own internal business purposes.

4.4We may change, add to or remove features of the Service. We will not make a change that materially degrades its core functionality without giving you reasonable notice.

4.5Scans run on a scheduled sweep. We do not promise a particular scan frequency, a particular time of day, or that a scan will complete on any given day.

4.6If you give us the address of a live site for a Connected Repository, the Service also audits that site on a recurring schedule, by requesting its public pages and testing its TLS configuration. Clause 7.9 applies to those audits.

4.7We also offer a Free plan, for which we make no charge. An Account on the Free plan may connect one repository and receives a single scan of it, made up of one run of the deterministic battery and one run of the AI discovery layer, presented on the dashboard as scores and a count of what the AI discovery layer raised. If either run starts but does not complete, it is not run again. The Free plan does not include the individual findings or their fix prompts, any further scan, or site audits. Clauses 9 and 10 do not apply to an Account while it is on the Free plan, and the right in clause 4.3 is granted to it without payment. We may change or withdraw the Free plan at any time. In every other respect these terms apply to it in full.

5.1This clause 5 is important, and the rest of this contract is priced on the basis of it.

5.2The Service is an automated code analysis tool. It is not a penetration test, a security audit, a certification, an assurance engagement, or professional, legal or regulatory advice. It does not make your software secure, accessible, compliant or fit for any purpose.

5.3We do not warrant that the Service will identify every vulnerability, defect or issue in your code, and it will not. Automated analysis of any kind produces both false negatives (real problems it does not report) and false positives (reported problems that are not real). A green score means only that the checks we ran did not raise a finding; it is not a statement that your software is secure or correct.

5.4Output from the AI discovery layer is generated by a large language model and may be incomplete, mistaken or misleading. It must be reviewed by a competent person before it is relied on or acted upon.

5.5Fix prompts and suggested remediations are suggestions only. You are responsible for reviewing, testing and deciding whether to apply any change to your code, and for the consequences of doing so.

5.6You remain solely responsible for the security, accessibility, legal compliance and operation of your own software and systems, and for your own obligations to your customers and to regulators. Nothing in the Service transfers any of that responsibility to us.

6.1You sign in by a single-use link sent to your email address. You are responsible for keeping access to that mailbox secure, and for all activity that takes place under your Account.

6.2An Account has two roles. An Owner may manage billing, connect and disconnect repositories, invite and remove Users, and delete the Account. A Member may view findings, change target branches, accept and reopen risks, and trigger a scan.

6.3Invitations are sent by email, may be used once, and expire after 7 days. Removing a User ends that person's access to the Account immediately.

6.4You must tell us promptly if you believe an unauthorised person has gained access to your Account.

6.5You are responsible for your Users' acts and omissions in connection with the Service as if they were your own.

7.1You connect repositories by installing our GitHub App. The App requests read access to repository contents and metadata. It does not request write access, and we do not modify your code.

7.2You grant us a non-exclusive licence to access, copy, analyse and process the contents of your Connected Repositories, and to store the resulting Findings and reports, in each case only so far as necessary to provide the Service to you.

7.3You represent and warrant that you own each Connected Repository or are otherwise authorised to grant us that access, including where the repository belongs to a client of yours or to a third party. If you connect a repository on behalf of a client, you confirm that you have their authority to do so.

7.4The AI discovery layer analyses extracts of your code using a large language model that runs inside our own hosting environment in the United Kingdom. Your code is not sent to a separate model provider, and it is not used to train any model.

7.5You should not store secrets, credentials, personal data or other sensitive material in your source code. Where the Service detects them it reports them as findings identifying the location and a masked form of the value. The secret detection in a scan of a Connected Repository never stores the detected value in full. An AI-generated Finding may quote a short fragment of code as it appears in the repository.

7.6You warrant that you are entitled to have any third-party or open-source code in your Connected Repositories read and analysed as part of the Service.

7.7Your use of the GitHub integration is also subject to your own agreement with GitHub. We use the data the GitHub App gives us only to provide the Service to you, and we do not collect it on GitHub's behalf.

7.8To scan a Connected Repository the Service takes a temporary copy of it, which is destroyed when the scan ends. We do not keep a copy of your source code: what we store is the Findings and the other results of the scan.

7.9Site audits run only against the address you enter. By entering it you represent and warrant that you own that site or are otherwise entitled to have it tested, and you must remove the address if that stops being true.

7.10You may withdraw the access in clause 7.1 at any time from your GitHub settings, by removing a repository from our GitHub App or uninstalling it. Scanning of the repositories affected then stops. Withdrawing access does not cancel your subscription, which you do under clause 11, and Findings already produced are kept as clause 11.5 describes.

7.11To check your dependencies for known vulnerabilities, a scan looks up the names and versions of the third-party packages your repository depends on in public vulnerability databases. Those lookups carry package names and versions only, never your source code, and those databases may answer them from outside the United Kingdom.

8.1You must not:

1. connect a repository you do not own and are not authorised to have scanned;
2. give us the address of a site you do not own and are not entitled to have tested;
3. use the Service to analyse software in order to attack it, or otherwise for any unlawful purpose;
4. resell, sublicense, rent or otherwise make the Service available to any third party, except that you may share findings for a repository with the client that owns it;
5. copy, modify, reverse engineer or attempt to derive the source code of the Service, except so far as that restriction is prohibited by law;
6. use the Service to build a competing product, or publish benchmarking or comparison results about it without our written consent;
7. circumvent or attempt to circumvent any usage limit, access control or rate limit; or
8. introduce malicious code into the Service or otherwise interfere with its operation or security.

8.2We may suspend your access immediately if we reasonably believe you have breached this clause 8, or that suspension is necessary to protect the Service, another customer or a third party. We will tell you when we do, and where it is practicable and does not increase the risk we will give you a chance to put the problem right. If you do so promptly we will restore access; if you do not, we may cancel under clause 11, and no refund is due for a suspension or cancellation under this clause.

9.1The subscription fee is £20 per Account per month, exclusive of VAT. We are not currently registered for VAT, so no VAT is added at present and £20 is what you pay. If we become registered for VAT, VAT will be added at the prevailing rate and payable in addition to the fee. There is no setup fee, and the Free plan described in clause 4.7 is not charged for.

9.2The fee is payable in advance by card, taken automatically at the start of each Subscription Period through our payment processor, Stripe. Card is the only way to pay. Your card details are handled by Stripe and are never held by us; of your payment details we store only the customer and subscription identifiers Stripe gives us and the state of your subscription. Card payments are also subject to Stripe's own terms.

9.3Apart from the money-back guarantee in clause 10, fees are non-refundable and we do not refund part-periods. Cancelling stops the next payment; it does not refund the Subscription Period you are in.

9.4If a card payment fails, we will keep your dashboard and your Findings readable but pause new scans, and Stripe will email you on our behalf with a link to update your card. Stripe retries the payment, and scanning resumes once a payment succeeds. If every retry fails, the subscription is cancelled and clause 11.5 applies. If a payment is reversed or charged back we may also suspend the Account until the position is resolved, and if it is not resolved we may cancel the subscription under clause 11.

9.5We may change the fee. We will give you at least 30 days' notice by email, and the new fee applies from your next Subscription Period after that notice. If you do not accept the change you may cancel under clause 11 before it takes effect.

9.6All sums payable under this contract are payable in pounds sterling and are exclusive of VAT and any other applicable tax, which you pay in addition. We will tell you before we begin charging VAT, but adding VAT on registration is not a fee change and clause 9.5 does not apply to it.

10.1If the first scan of your subscription finds nothing, you should not pay for it. This clause sets out exactly when that applies.

10.2You may claim a full refund of your first month's subscription fee if the first scan of a Connected Repository after your subscription starts reports no Findings of "low" severity or above. That scan is made up of one run of the deterministic battery and one run of the AI discovery layer, each being the first to complete after your subscription starts, and the guarantee applies only if neither run reports such a Finding. A scan that completed before your subscription started, including the scan an Account receives on the Free plan, does not count, whatever it reported. Findings labelled "info" are informational and do not count against the guarantee. If you have paid for a longer period in advance, the refund is the equivalent of one month of that fee.

10.3To claim, email us at info@surgotechsolutions.co.uk within 14 days of the later of those two runs completing. We will refund it to the card you paid with, normally within 14 days.

10.4The guarantee may be claimed once per Account, applies only to the first month's fee, and is not available where either run did not complete, where the repository connected contained no code the Service was able to analyse, or where the Account is one you have previously held and cancelled.

10.5Claiming the refund does not end your subscription. If you do not want the Service to continue, cancel it under clause 11 as well.

10.6For the avoidance of doubt, a scan that reports no Findings of low severity or above means only that the checks we ran did not raise one. It is not a statement that your software is secure or correct, and clause 5 applies to it in full.

11.1The subscription runs for the Subscription Period stated in your order confirmation, which is monthly unless we have agreed otherwise, and renews automatically at the end of each Subscription Period until it is cancelled.

11.2You may cancel at any time from the billing portal in your Account. Cancellation takes effect at the end of the Subscription Period you have already paid for, and the Service remains available until then.

11.3We may terminate this contract on 30 days' written notice, or immediately if you materially breach these terms and, where the breach can be put right, do not put it right within 14 days of us asking you to.

11.4When a cancellation takes effect, or the subscription ends in any other way, scanning stops.

11.5Your Findings, reports and finding ledger stay readable in your Account for 30 days after the subscription ends, so that you can resubscribe or ask us for a copy of them. At the end of that period the Account reverts to the Free plan, without a further scan, the Findings are no longer available to you, and we delete them along with the rest of your Account data. Ask us for a copy before that period ends if you need one.

11.6Clauses which by their nature are intended to survive termination do so, including clauses 5, 10, 12, 13, 15, 16, 17, 19 and 20.

12.1You own your Customer Data, including your source code and the Findings derived from it. We claim no ownership of it.

12.2We own the Service, including its software, scan engine, rules, scoring, dashboard, documentation and branding, and all intellectual property rights in them. Nothing in these terms transfers any of those rights to you.

12.3We may use aggregated and anonymised statistics about how the Service is used (counts, timings, rule hit rates) to operate and improve it. Such statistics will never identify you, your Users or your code.

12.4The Service is hosted on Amazon Web Services in the London (eu-west-2) region, and Customer Data is stored there. The AI discovery layer runs in that same region, so your code is analysed inside our own environment and never goes to a separate model provider. Operational logs are retained for 30 days.

12.5Each party will comply with the UK GDPR and the Data Protection Act 2018. In relation to any personal data contained in Customer Data, you are the controller and we are the processor. We will process that personal data only on your documented instructions (of which these terms and your use of the Service are the initial instructions), ensure that our personnel are subject to a duty of confidence, implement appropriate technical and organisational security measures, assist you with data subject requests and with your obligations under Articles 32 to 36 of the UK GDPR so far as is reasonable, delete or return the personal data at the end of the contract in accordance with clause 11.5, and make available the information reasonably necessary to demonstrate compliance with Article 28.

12.6For the purposes of Article 28(3) of the UK GDPR, the subject matter of the processing is the provision of the Service; its duration is your subscription plus the retention period in clause 11.5; its nature and purpose is the automated reading and analysis of your Connected Repositories and the generation of Findings; the personal data processed is whatever personal data is incidentally present in your source code; and the data subjects are the individuals to whom that data relates.

12.7We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and give you the information you reasonably need to meet your own obligations under Articles 33 and 34 of the UK GDPR. We will also tell you without undue delay about any other security incident that materially affects the confidentiality, integrity or availability of your Customer Data, whether or not personal data is involved.

12.8If we consider that an instruction you give us infringes the UK GDPR or other data protection law, we will tell you, and we may pause the processing concerned until you withdraw or confirm the instruction.

12.9You may audit our compliance with this clause 12 once in any 12-month period, on 30 days' written notice, during business hours, at your own cost and subject to confidentiality, and more often if a supervisory authority requires it or following a personal data breach affecting your Customer Data. We may answer an audit with a current third-party report or certification where that reasonably addresses what you have asked.

12.10At the end of the contract you may choose whether we return your Customer Data to you or delete it. We will send you a copy if you ask us at info@surgotechsolutions.co.uk before the retention period in clause 11.5 ends, and unless you ask before that period ends we will delete the data.

12.11You give us general authorisation to appoint sub-processors, which at the date of these terms are Amazon Web Services (hosting, scanning, storage, email and AI analysis) and Neon (the database and sign-in service). We will give you at least 30 days' notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds; if we cannot resolve your objection you may cancel under clause 11. We impose on every sub-processor, by written contract, data protection obligations equivalent to those in this clause 12, and we remain fully liable to you for the acts and omissions of our sub-processors. Stripe and GitHub are not sub-processors: Stripe handles payment data only, and we send no Customer Data to GitHub, where your repositories already sit under your own agreement with it.

12.12Customer Data is stored and processed in the United Kingdom, and we do not transfer it abroad. The package lookups in clause 7.11 may be answered from outside the United Kingdom, but they carry no source code and no personal data. If that changes we will tell you beforehand and put in place an appropriate transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

12.13Our privacy policy explains how we handle personal data for which we are the controller, such as the account and billing details of your Users.

13.1Each party will keep the other's confidential information confidential, use it only to perform this contract, and disclose it only to those of its personnel, advisers and, in our case, sub-processors appointed under clause 12.11 who need it and who are bound by equivalent obligations. Your source code and your Findings are your confidential information.

13.2These obligations do not apply to information that is or becomes public through no breach of this clause, that the receiving party already held without a duty of confidence, or that it is required to disclose by law or by a regulator, in which case it will tell the other party first where it is lawfully able to.

14.1We will use reasonable endeavours to keep the Service available, but we do not commit to any service level, uptime percentage or support response time, and we do not offer service credits.

14.2The Service may be unavailable during planned maintenance, which we will try to schedule outside UK business hours, and during unplanned outages, including those caused by third parties such as Amazon Web Services, GitHub or Stripe.

14.3Support is provided by email during UK business hours, on a reasonable endeavours basis.

15.1We warrant that we will provide the Service with reasonable care and skill.

15.2Except as expressly set out in these terms, and to the fullest extent permitted by law, all warranties, conditions and other terms implied by statute or common law are excluded from this contract. In particular, and without limiting clause 5, we do not warrant that the Service will be uninterrupted or error-free, that it will detect any particular issue, or that it is fit for any purpose you have in mind unless we have agreed that purpose in writing.

16.1Nothing in these terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded.

16.2Subject to clause 16.1, we are not liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for:

1. loss of profit, revenue, business, anticipated savings, goodwill or reputation;
2. loss or corruption of data, other than our cost of restoring it from our own backups;
3. any security incident, breach, defect or non-compliance in your own software or systems, and its consequences for you or for your customers, except so far as it results from our failure to meet clause 15.1;
4. any action you take or do not take on the basis of a Finding or a suggested fix; or
5. any indirect or consequential loss.

16.3Subject to clause 16.1, our total liability arising out of or in connection with this contract in any 12-month period is limited to the total fees you paid us in the 12 months immediately before the first event giving rise to the claim.

16.4You acknowledge that the fee for the Service is set on the basis of the allocation of risk in clauses 5 and 16, that the Service is an automated tool sold at a low fixed monthly price, and that a separately negotiated contract or your own insurance is available to you if you need a different allocation. Both parties consider these limits reasonable in the circumstances known to them when this contract was made.

16.5You must bring any claim under this contract within 12 months of the date on which you first became aware, or ought reasonably to have become aware, of the facts giving rise to it.

17.1You will indemnify us against all losses, damages, costs and expenses (including reasonable legal fees) we incur arising out of a third-party claim that a Connected Repository was connected to the Service without the authority you warranted in clause 7.3. This is the only indemnity you give us; a breach of clause 8 is dealt with by suspension under clause 8.2 and termination under clause 11.3.

17.2We will defend you against any claim that your permitted use of the Service infringes a third party's UK intellectual property rights, and pay any amounts finally awarded against you or agreed in settlement by us, provided that you tell us promptly, do not admit liability or attempt to settle, let us control the defence and any settlement, and give us reasonable assistance at our cost.

17.3If such a claim is made, or we reasonably expect one, we may at our own cost obtain the right for you to continue using the Service, or modify or replace it so that it no longer infringes. If neither is reasonably achievable, we may terminate this contract on notice and refund the fees you have paid for the unused balance of the Subscription Period.

17.4Clause 17.2 does not apply to a claim arising from your own code or Customer Data, from your breach of these terms, or from use of the Service other than as permitted by them.

17.5Our total liability under clause 17.2 is limited to £25,000, in place of the cap in clause 16.3.

18.1We may change these terms, for example to reflect changes to the Service, to our sub-processors or to the law.

18.2For any change that is materially adverse to you, we will give at least 30 days' notice by email to your Account Owners and by publishing the new version on this page. The change takes effect at the start of your next Subscription Period after that notice, and if you do not accept it you may cancel under clause 11 before it takes effect. Continuing to use the Service after the change takes effect means you accept it.

18.3Minor changes that do not adversely affect you, such as corrections, clarifications and updated contact details, take effect when published.

19.1You may not assign or transfer this contract without our written consent. We may assign it to a successor to our business, or subcontract any of our obligations, but we remain responsible to you for anything a subcontractor does.

19.2These terms, our privacy policy and your order confirmation are the entire agreement between us about the Service, and replace anything said or written beforehand. Neither party relies on any statement not set out in them, though nothing limits liability for fraudulent misrepresentation.

19.3A person who is not a party to this contract has no right to enforce it under the Contracts (Rights of Third Parties) Act 1999.

19.4If a term is found to be unenforceable it is severed, and the rest of the contract continues in force.

19.5A delay in enforcing a right is not a waiver of it, and waiving one breach does not waive another.

19.6Neither party is liable for a failure to perform caused by an event beyond its reasonable control, provided it tells the other party and tries to resume performance. If such an event continues for more than 30 days, either party may terminate on notice.

19.7Notices to us must be sent to info@surgotechsolutions.co.uk. Notices to you are sent to the email addresses of your Account Owners, and are treated as received on the day they are sent unless the sender receives a delivery failure.

19.8Nothing in these terms creates a partnership, joint venture or employment relationship between us.

20.1This contract, and any dispute or claim arising out of or in connection with it or its subject matter (including non-contractual disputes and claims), is governed by the law of England and Wales.

20.2The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.