Terms of Service

Slipmark Cloud is provided by Reply Intelligence Group Ltd (“we”, “us”, “our”), a company registered in England and Wales with company number 17040048. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

You can contact us at hello@replyintelligencegroup.co.uk. Our website is www.replyintelligencegroup.co.uk.

These terms apply to Slipmark Cloud, the hosted service at app.slipmark.dev (the “Service”).

The open-source Slipmark command-line tool and GitHub Action are licensed under the Apache License 2.0. Your use of them is governed by that licence, not by these terms.

“You” means the organisation or person that signs up for the Service. If you accept these terms for an organisation, you confirm that you have authority to bind it.

You accept these terms when you install the Slipmark GitHub App, sign in to the Service or start a subscription, whichever happens first.

The Service is for businesses. It is not offered to consumers and must not be used by anyone under 18.

Our Data Processing Agreement forms part of these terms. Our privacy notice explains how we handle personal data where we decide how it is used.

The Service:

records verification runs sent by your GitHub Actions workflow, authenticated by GitHub OIDC tokens;

keeps those records in an append-only, hash-chained ledger;

re-verifies attestations by reading the attested files from GitHub through the GitHub App you install. We read file contents only to hash them in memory. We do not store file contents;

posts checks to GitHub and enforces the rules you set;

provides insights, alerts and webhooks to the destinations you choose, and evidence packs, depending on your plan; and

publishes a daily signed digest of ledger heads to Sigstore's public Rekor transparency log. The digest contains only opaque identifiers and hashes.

You need a GitHub account to use the Service. You are responsible for who can reach the Service through your GitHub organisation, and for the permissions you grant to the GitHub App.

Slipmark shows what an agent checked against which files. It does not guarantee that your code is secure, correct or fit for any purpose.

Using Slipmark does not make you compliant with any law, standard or framework. You remain responsible for your own code, reviews and compliance.

We offer these plans:

Prices are in pounds sterling and exclude VAT where VAT applies.

The features in each plan are described on our plans and seats page.

A seat is a distinct GitHub account, other than a bot, whose push or pull request ran Slipmark on one of your private repositories in the last 30 days.

If more people use the Service than you pay for, we do not block them. We may ask you to add seats to match your use.

Paid plans start with a 14-day free trial.

You give card details at checkout. We charge your card when the trial ends unless you cancel before then.

Paid plans are billed in advance, monthly or annually, through our payment provider Stripe.

You authorise us, through Stripe, to charge your payment method for each billing period until you cancel.

You can cancel at any time from the billing portal.

Cancellation takes effect at the end of the period you have paid for. You keep paid features until then.

We do not refund partial periods, except where the law requires us to. When you add or remove seats or change plan during a period, Stripe works out the difference pro rata and adds it to, or credits it against, your next invoice. That adjustment is not a refund.

Business customers can ask to be invoiced annually instead of paying by card. We agree the invoice terms with you in writing.

To close your account completely, email us from an address linked to your account. We will remove your plan, settings, alert endpoints and the GitHub logins of your committers. Append-only records stay in the pseudonymised form described in clause 11, and you should uninstall the Slipmark GitHub App from your GitHub settings.

When a paid plan ends, your account returns to the Free plan. Your ledger is kept, for the reasons in clause 11.

You own the data you send to the Service. You give us permission to use it only to provide, secure and support the Service, and as described in our Data Processing Agreement.

For personal data in your repository and committer records, you are the controller and we are your processor. The Data Processing Agreement sets out how we handle it.

Attestation notes are free text written by your agents. You must keep secrets, credentials and personal data out of them.

You confirm that you have the rights you need to send us the data you send, and to let us read your repositories through the GitHub App.

The ledger, run records, policy results, verification results and account log are append-only by design. Entries cannot be edited or deleted, by you or by us through the Service. This is what keeps them verifiable.

We keep these records indefinitely, including after a paid plan ends.

Committer identities are stored as a pseudonymous identifier. The GitHub login linked to it is held separately and can be erased on request. After erasure, records show “erased” and cannot be linked back to the person.

The daily digest published to the Rekor transparency log is public and cannot be removed. It contains only opaque identifiers and hashes.

You must not, and must not let anyone else:

attack, overload or disrupt the Service, or try to get around its security;

put unlawful content in attestation notes or anything else you send us;

try to forge, alter or insert ledger records other than through genuine verification runs; or

copy, decompile or reverse engineer the hosted Service. This does not restrict what you may do with the open-source parts of Slipmark under their licences.

We may suspend or restrict access to the Service if you seriously breach this clause, or if we reasonably need to in order to protect the Service or other customers. We will tell you why, unless the law prevents us.

The Service works with GitHub and, if you choose, with Slack, Microsoft Teams, Discord, Google Chat, PagerDuty or any other destination you send events to. Your use of those services is governed by their own terms. We are not responsible for them.

Payments are processed by Stripe under Stripe's terms.

On the Free plan, the Service is provided “as is”, without any promise about its quality, availability or fitness for purpose, to the extent the law allows.

On paid plans, we will provide the Service with reasonable skill and care.

Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

Subject to clause 15.1, we are not liable for any indirect or consequential loss, or for any loss of profits, whether arising in contract, tort (including negligence) or otherwise.

Subject to clause 15.1, our total liability to you for all claims arising out of or in connection with these terms is limited to the fees you paid us for the Service in the 12 months before the claim arose. If you are on the Free plan, it is limited to £100.

We will give you at least 30 days' notice of any material change to these terms. If you do not agree to the change, you can cancel before it takes effect.

The date at the top of this page shows when these terms were last updated.

These terms, together with the Data Processing Agreement, are the whole agreement between you and us about the Service.

No one other than you and us has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.

If any part of these terms is found to be unenforceable, the rest stays in force.

These terms, and any dispute or claim arising out of or in connection with them, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.