Terms of Service

1. Who these terms are between

These Terms of Service (“Terms”) form a binding agreement between you (“you”, “Customer”) and Luann de Carvalho Sapucaia, trading as „Ephyra“ (“Ephyra”, “we”, “us”). Our full details are in our Impressum. By creating an account or running a scan, you agree to these Terms and to our Privacy Policy.

2. The service

Ephyra is an automated, software-only security-scanning product. You connect a GitHub repository with read-only access; we analyse the source code and return a ranked report of potential security issues with suggested fixes. The report is produced by software, with no human audit as part of the standard product.

The report is informational and advisory. It is a best-effort automated assessment. We do not warrant that it identifies every vulnerability, that every finding is accurate, or that applying the suggested fixes will make your application secure. You remain solely responsible for your application, for reviewing findings, and for deciding what to change. Ephyra is not a substitute for a full professional security audit.

3. Your authorisation to scan (important)

You may only submit an application or repository that you own or are explicitly authorised to test. By starting a scan you represent and warrant that you have all necessary rights and permissions to allow Ephyra to access, read, and analyse the target, including any third-party rights, and that doing so does not violate any law, contract, or acceptable-use policy. Scanning systems you are not authorised to test may be unlawful. You are solely responsible for ensuring you have authorisation, and you will indemnify us against claims arising from a breach of this section.

4. AI analysis and processing outside the EU (your agreement)

To produce your report, Ephyra sends relevant parts of the source code from the GitHub repository you authorise to a third-party AI provider for automated analysis. You acknowledge and expressly agree that this AI provider may be located outside the European Union — in particular in the People's Republic of China (currently DeepSeek, model DeepSeek V4 Flash), a country that does not have an EU adequacy decision under Art. 45 GDPR. This means the source code from your authorised repository is transmitted to and processed in a third country. To be clear, this concerns only the repository source code you authorise us to read for a scan — your account details, login credentials, and payment information are never sent to the AI provider.

By starting a scan you confirm that:

• you consent to this transfer and processing, and you have the authority to consent on behalf of anyone whose data may be contained in your code;
• you will not submit material whose transfer to such a provider is prohibited by law, contract, export-control rules, or your own confidentiality obligations; and
• you understand that the safeguards we apply (Standard Contractual Clauses and supplementary measures, as described in our Privacy Policy) reduce but cannot entirely eliminate the risks inherent in third-country processing.

If you do not agree to your code being analysed by a non-EU (including Chinese) AI provider, do not submit a scan. We process only what is necessary for the analysis and discard the cloned working copy once the scan completes, as set out in the Privacy Policy.

5. Accounts

You must provide accurate information, keep your credentials secure, and are responsible for activity under your account. You must be at least 18 years old and able to enter into a binding contract. Notify us promptly of any unauthorised use.

6. Plans, pricing, and payment

• Free scan — €0. A deterministic-tools scan with no paid reasoning layer.
• Full scan — €49, one-time. Unlocks the AI reasoning layer for a single scan.
• Monthly plan — €99 per month. Recurring re-scans and trend tracking; renews automatically until cancelled.

Prices are stated inclusive or exclusive of VAT as shown at checkout and may be updated for future purchases. Payments are processed by our payment provider (Stripe); by paying you also agree to the processor's terms. The monthly plan renews automatically at the then-current price until you cancel; you can cancel at any time, effective at the end of the current billing period. We do not provide pro-rata refunds for partial periods except where required by mandatory law.

7. Right of withdrawal for consumers (Widerrufsrecht)

If you are a consumer in the EU, you normally have a 14-day right to withdraw from a contract for digital services. However, because a scan is a digital service that we begin performing immediately, you expressly request that we begin performance before the end of the withdrawal period and acknowledge that you lose your right of withdrawal once the service has been fully performed (§ 356 (4) BGB, implementing the EU Consumer Rights Directive). You confirm this consent at checkout before a paid scan starts. Full withdrawal instructions and the model withdrawal form are set out in Annex A below.

8. Acceptable use

You agree not to:

• scan targets you are not authorised to test;
• use the service to develop or deploy malware, or to attack any system;
• attempt to disrupt, overload, reverse-engineer, or circumvent limits of the service;
• resell or provide the service to third parties without our written agreement; or
• use the service unlawfully or in breach of these Terms.

We may suspend or terminate accounts that breach this section.

9. Warranties and limitation of liability

The service and reports are provided with reasonable care but without any guarantee that they are error-free, complete, or that they will detect all security issues. To the extent permitted by law, the following applies to our liability:

• We are liable without limitation for damages arising from injury to life, body, or health, for intent and gross negligence, and under the German Product Liability Act (Produkthaftungsgesetz), as well as to the extent we have given a guarantee.
• For slight negligence, we are liable only for breach of a material contractual obligation (a “cardinal obligation” whose fulfilment makes proper performance possible and on which you may reasonably rely), and then only for the foreseeable, contract-typical damage.
• Any further liability is excluded.

In particular, we are not liable for security incidents, breaches, data loss, or other damage resulting from vulnerabilities the scan did not detect, from inaccurate findings, or from how you choose to act on a report. The above limitations also apply in favour of our staff and sub-processors.

10. Intellectual property

We own the Ephyra service, brand, and software. You own your application and source code; you grant us a limited licence to access and process them only to provide the service, as described in our Privacy Policy. The report we generate for you is yours to use for your own security purposes.

11. Availability and changes

We aim for high availability but do not guarantee uninterrupted service; maintenance and factors beyond our control may cause downtime. We may modify or discontinue features, and may update these Terms; for material changes affecting ongoing plans we will give reasonable notice, and your continued use after the change takes effect constitutes acceptance.

12. Term and termination

You may stop using the service and close your account at any time. We may suspend or terminate access for breach of these Terms or where required by law. Sections that by their nature should survive termination — including authorisation, liability, and governing law — survive.

13. Governing law and jurisdiction

These Terms are governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods. If you are a consumer, this choice of law does not deprive you of the protection of mandatory provisions of the law of your country of residence in the EU. The place of jurisdiction, where legally permissible, is Berlin; mandatory consumer jurisdiction rules remain unaffected.

14. Dispute resolution

We are not obliged and do not undertake to participate in dispute resolution proceedings before a consumer arbitration board (Verbraucherschlichtungsstelle).

15. Severability

If any provision of these Terms is or becomes invalid, the remaining provisions remain in effect, and the invalid provision will be replaced by a valid one that comes closest to its intended commercial purpose.

Annex A — Withdrawal instructions (Widerrufsbelehrung)

Right of withdrawal

You have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period is 14 days from the day of conclusion of the contract. To exercise your right of withdrawal, you must inform us —

Luann de Carvalho Sapucaia, trading as „Ephyra“, Ringbahnstraße 56, 12099 Berlin, Germany, email contact@ephyra.tech

— of your decision to withdraw from this contract by an unequivocal statement (for example, a letter sent by post or an email). You may use the model withdrawal form below, but it is not obligatory. To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal

If you withdraw from this contract, we will reimburse all payments received from you without undue delay and no later than 14 days from the day on which we are informed of your decision to withdraw, using the same means of payment you used for the initial transaction unless expressly agreed otherwise; in no event will you be charged any fees as a result of the reimbursement.

Early performance and loss of the right of withdrawal

If you requested that the service begin during the withdrawal period, you must pay us an amount proportionate to what has been provided until you communicated your withdrawal, in comparison with the full coverage of the contract. Where you expressly consented to the service beginning before the end of the withdrawal period and acknowledged that you would lose your right of withdrawal once the contract has been fully performed, the right of withdrawal lapses on full performance (§ 356(4) BGB). A paid scan is typically fully performed as soon as the report is generated.

Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract.)

To: Luann de Carvalho Sapucaia, trading as „Ephyra“, Ringbahnstraße 56, 12099 Berlin, Germany, contact@ephyra.tech

— I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service (*):

— Ordered on (*) / received on (*):

— Name of consumer(s):

— Address of consumer(s):

— Signature of consumer(s) (only if this form is notified on paper):

— Date:

(*) Delete as appropriate.

Questions about these Terms? Email contact@ephyra.tech.