Terms of Service

The service

Toevan connects to your source repository, indexes your code, evaluates the deterministic rules (blueprints and constraints) you configure, gates pull requests against them, and produces signed, auditor-ready evidence of what was enforced.

The core analysis is deterministic and runs on Toevan's EU infrastructure. Optional AI features, such as AI fix generation and the AI agents that read your code, are separate from the core analysis; how they and your code are handled is set out on the Security page and in the Data Processing Agreement.

Fees and billing

The service is offered in tiers (Free, Team, and Enterprise); the current tiers and prices are shown on our website and are not restated here. Fees are quoted and charged in euros (EUR).

Payment processor. Payments are processed by Stripe. Billing is live, and self-service billing in the product is enabled for an organisation on request. EU business-to-business sales are handled under the VAT reverse-charge mechanism where applicable, and you are responsible for accounting for VAT in your own member state.

• Billing intervals and payment terms. Fees are charged in advance for each subscription period. Toevan defines the billing intervals it offers, such as monthly or annual, and the payment terms, such as when an invoice falls due; the ones that apply to you are shown when you subscribe and on each invoice. A card payment is charged at the start of each period. Toevan may change the intervals or payment terms with at least 30 days' notice; a change applies from your next renewal, and you may cancel renewal before it applies. Fees exclude VAT and other taxes, which are added where applicable.
• Renewal and price changes. A subscription renews automatically for a period of the same length unless it is cancelled before the end of the current period. You can cancel renewal at any time in the product's billing settings; the cancellation takes effect at the end of the period already paid for. Toevan gives at least 30 days' notice of a price change, which applies from the first renewal after the notice period.
• Late payment. If an amount is not paid when due, Toevan may claim late-payment interest at the rate the Estonian Law of Obligations Act provides for transactions between businesses, and the fixed compensation for recovery costs that the Act provides.
• Suspension for non-payment. If an amount remains unpaid 14 days after Toevan has sent a payment reminder, Toevan may suspend access to the paid features after giving at least 7 days' further notice. Suspension does not delete your data, the evidence already generated stays verifiable, and access is restored once the overdue amount is paid.
• Refunds. Fees already paid are not refundable, except where these Terms or the Data Processing Agreement provide for a refund of the fees paid for the period after termination.

What a passing result means (compliance limiter)

This is the most important thing to understand about what Toevan does and does not promise.

Toevan provides enforcement and evidence for the controls that you own and configure. A passing (green) result means that the rules you defined were enforced on the code that was analysed, and that there is signed evidence of it. It does not mean that your organisation is compliant with any law, regulation, or framework.

Toevan does not certify or guarantee your regulatory compliance. Compliance is a property of your whole organisation, its processes, and controls that live outside a code repository, and it is judged by your auditors and regulators, not by Toevan. Toevan is a tool that enforces the rules you choose and proves that it did; the responsibility for choosing the right rules, and for compliance overall, remains yours.

Intellectual property

• Your code and your evidence are yours. You retain all rights in your source code and in the evidence records the service generates for you, including the copy written to your own repository. Toevan claims no ownership of them.
• The platform is ours. Toevan owns the platform, its software, and all related intellectual property, and grants you a limited, non-exclusive right to use it for the term of your subscription.
• The method is a trade secret. The conformance-predicate method that decides how rules are evaluated is an undisclosed trade secret, retained server-side and not derivable from the product's outputs. Nothing in these Terms grants any right to it, and it is not described here.

Blueprints

Blueprints are the deterministic rule sets Toevan evaluates. There are two kinds:

• Your blueprints are private to your organisation. A blueprint your organisation creates or customises is visible and usable only within your organisation. Toevan does not show, share, or offer it to any other organisation. The rules your organisation writes are yours under the intellectual-property section above; where your blueprint is based on a catalogue blueprint, Toevan keeps its rights in the catalogue content.
• Toevan's catalogue blueprints. Toevan provides a catalogue of blueprints, such as Security Essentials. Toevan owns them and licenses them to you for use within your organisation for the term of your subscription. The compliance limiter above applies to them: adopting a catalogue blueprint does not make your organisation compliant with the framework it relates to.

Blueprints are included in your subscription. Toevan does not charge for a blueprint separately, and blueprints are not bought or sold.

There is no public marketplace: blueprints are not published to, adopted by, or sold between organisations. If Toevan opens one, it will be offered under terms added to these Terms, with notice as set out under Changes to these terms.

Acceptable use

When using Toevan you agree not to:

• connect or analyse repositories you are not authorised to govern, or direct the service at code you do not have the right to process;
• attempt to reverse-engineer, decompile, or otherwise derive the analysis engine or the conformance-predicate method;
• probe, scan, or test the security of the service except through the responsible-disclosure channel, or interfere with its integrity or availability;
• use the service in violation of applicable law or to infringe another party's rights.

Warranties and disclaimers

Toevan warrants that the service performs materially as described in its documentation and on this website: it evaluates the rules your organisation configures deterministically, gates pull requests against them, and records signed evidence of the result. Toevan provides the service with reasonable skill and care.

If the service itself does not perform as described, tell us. Toevan then corrects the defect in its own service within a reasonable time; if it cannot, you may terminate the affected subscription and Toevan refunds the fees paid for the period after termination. These remedies concern the service, not your code: Toevan does not undertake to change your code. This is without prejudice to remedies that cannot be excluded under applicable law.

• Toevan does not warrant that the service will be uninterrupted or error-free, or that it will detect every defect, vulnerability, secret, or rule violation in your code.
• Suggestions from the optional AI features, including AI-generated fixes, are proposals that can be wrong. Review them before you apply them; Toevan does not warrant their accuracy.
• Features marked Pilot, beta, or preview are provided as they are, may change, and are excluded from the warranty above.
• Third-party services you connect, such as GitHub, Slack, Jira, Linear, or Kosli, are governed by your own agreements with their providers, and Toevan gives no warranty for them.
• Except as stated in these Terms, and to the extent permitted by law, all other warranties and conditions, express or implied, are excluded.

This section is read together with the compliance limiter above, which is a deliberate and binding statement of scope, not a disclaimer of the product working as described.

Limitation of liability

Each party's total liability arising out of or in connection with these Terms and the Data Processing Agreement, in contract, in tort, or otherwise, is limited to the greater of (a) the fees paid and payable for the service in the twelve months before the event that gave rise to the claim, and (b) EUR 1,000, and in no case exceeds EUR 50,000.

Neither party is liable for loss of profit, revenue, business, or goodwill, or for indirect or consequential loss.

These limitations do not apply to liability that cannot be excluded or limited under applicable law, including liability for intentional or grossly negligent breach and for death or personal injury, nor to the obligation to pay fees.

A claim for compensation is made in writing and states the loss and how its amount is calculated. Toevan pays compensation it owes within 30 days after the amount is finally established, by a written settlement or a final court decision, by bank transfer to the account you name. With your written agreement, Toevan may instead pay it as a credit against your future fees.

Indemnification

• Toevan's obligation. Toevan defends you against a claim by a third party alleging that the platform, as provided by Toevan and used in accordance with these Terms, infringes that third party's intellectual-property rights, and pays the damages and costs finally awarded against you or agreed in a settlement Toevan approves. If such a claim is made or likely, Toevan may modify the platform so that it no longer infringes, obtain a licence for your continued use, or, if neither is reasonably possible, end the affected subscription and refund the fees paid for the unused period. This does not apply to a claim arising from your code, data, or blueprints, from a modification Toevan did not make, or from a combination with anything Toevan did not provide.
• Your obligation. You defend Toevan against a claim by a third party arising from code or data you direct the service at without the right to have it processed, or from a breach of the acceptable-use terms, and pay the damages and costs finally awarded against Toevan or agreed in a settlement you approve.
• Procedure. The party seeking a defence notifies the other promptly in writing, gives it control of the defence and any settlement, and cooperates reasonably at the other's expense. No settlement may admit fault on behalf of the defended party without its consent. These obligations are subject to the limitation of liability above.

Term and termination

These Terms apply from the moment you accept them and for as long as you use the service. A subscription runs for the period you select and renews as described under Fees and billing; you can cancel renewal at any time, and the cancellation takes effect at the end of the paid period.

Either party may terminate these Terms with immediate effect by written notice if the other party materially breaches them and does not remedy the breach within 30 days of a written notice describing it, or if the other party is declared bankrupt or enters liquidation. If you terminate for Toevan's breach, Toevan refunds the fees paid for the period after termination.

Toevan may suspend access, limited in scope and time to what the situation requires, if your use poses an immediate risk to the security or availability of the service or to other customers, or breaches the acceptable-use terms. Toevan tells you the reason without undue delay and restores access once the cause is removed.

Ending a paid subscription does not delete your data: your organisation continues on the free plan. Your data is deleted when an administrator deletes your organisation in the product, as set out in the Data Processing Agreement; export your evidence first. For 30 days after a deletion, an administrator can restore the organisation. On termination, fees accrued before it remain payable, and evidence written to your own repository remains yours and is unaffected.

The sections on intellectual property, the compliance limiter, limitation of liability, indemnification, and governing law and disputes survive termination.

Changes to these terms

These Terms are versioned. The current version and the date it last changed appear at the top of this page, and the changelog below records the history.

Toevan gives notice of a material change at least 30 days before it takes effect, by email to the organisation's administrators and by a notice in the product. A change required by law, or needed to address a security risk, may take effect sooner, with notice as early as possible. A change that is not material, such as a correction or clarification, takes effect when published.

If a material change is to your detriment and you do not accept it, you may terminate before it takes effect, and Toevan refunds the fees paid for the period after termination. If you continue to use the service after the change takes effect, you accept the changed Terms.

Governing law and venue

These Terms, and any non-contractual obligation arising from them, are governed by the laws of Estonia, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

The parties first try to resolve a dispute through good-faith negotiation, starting with a written notice that describes it. If the dispute is not resolved within 30 days of that notice, it is settled by Harju County Court (Harju Maakohus) in Tallinn, Estonia, as the court of first instance, which has exclusive jurisdiction. Either party may seek interim relief from any competent court.

These Terms are concluded in English.

Änderungsverlauf

• v1.0.02026-08-25

  Initial draft: service description (deterministic analysis versus optional AI fixes), fees and billing (Stripe intended, currently simulated, EUR, reverse-charge VAT), the compliance limiter (a passing result is not a compliance certification), the intellectual-property split with the conformance-predicate method as an undisclosed trade secret, the blueprint marketplace (a buyer's access survives the publisher leaving and Toevan may keep serving the existing, frozen versions), and acceptable use. Warranties, liability cap, indemnities, term and termination, and the enforceable marketplace licence terms were left to counsel. Estonian governing law.

• v1.1.02026-09-30

  The description of optional AI features now names the AI agents that read your code alongside AI fix generation, matching the Security page and the DPA.

• v1.2.02026-10-29

  The enforceable clauses are drafted: business-to-business scope; the tiers named as on the pricing page (Free, Team, Enterprise); billing intervals and payment terms defined by Toevan (changed with 30 days' notice, from the next renewal), renewal, price-change notice, late-payment interest and suspension under the Estonian Law of Obligations Act; billing is live through Stripe, with self-service billing enabled on request; the service warranty (the service evaluates your rules deterministically, gates pull requests, and records signed evidence; if it does not, Toevan corrects its own service or you may terminate with a refund) and its disclaimers; the limitation of liability (the greater of twelve months' fees and EUR 1,000, never more than EUR 50,000) with the carve-outs Estonian law requires, and how a claim is made and paid (within 30 days after the amount is finally established, or as a fee credit if the customer agrees); mutual indemnities; term, termination, suspension and survival (ending a subscription keeps the data; deleting the organisation deletes it, with 30 days to restore); 30 days' notice of material changes; Estonian law, negotiation first, then Harju County Court in Tallinn. The blueprint marketplace section is replaced by Blueprints, matching the product: an organisation's own blueprints are private to it, Toevan's catalogue blueprints are licensed for the subscription and included in it with no separate charge, and there is no public marketplace, so the earlier marketplace and departing-publisher wording is removed.