Terms of service

These Terms of Service (“Terms”) govern the use of the vulnerability detection platform operated under the commercial name “Musha Security” (“Musha”, “we”), under the laws of the Republic of Colombia, available at mushasec.com and app.mushasec.com (the “Service”). When you create an account or use the Service, you accept these Terms in full. If you do not agree with them, please do not use the Service.

01. Definitions

• Customer: the organization (company, legal entity) contracting the Service
• User: natural person authorized by the Customer to access the Service
• Subscription: the contracted plan (Starter, Team, Business, Enterprise) with its associated tier
• Trial period: 14-day initial trial, no card required. One trial per corporate email domain; paid access requires an active subscription when the trial ends
• Findings: vulnerabilities, misconfigurations or secrets detected by the Service
• Customer Data: all information the Customer uploads, connects or processes through the Service (including repository URLs, branches, findings and audit logs)
• Confidential Information: all non-public information exchanged between the parties in the context of the Service, marked or reasonably understood as confidential
• Business day: Monday through Friday, excluding Colombian official holidays, in UTC-5 hours

02. The Service

Musha is a SaaS platform for automatic vulnerability detection covering static analysis of source code (SAST), software composition analysis (SCA), static analysis of infrastructure as code (IaC) and secrets detection (Secret Scanning). The Service integrates with your Git provider through a webhook, clones your repository in an ephemeral environment, runs the analyses and reports findings through an automated pull request comment and a dashboard.

The Service is an automated tool. It does not replace a manual, human-driven pentest, a formal security audit or CISO advisory. We do our best to detect known vulnerabilities, but we cannot guarantee that we will catch every one.

03. Subscription and tiers

The Service is offered in four tiers (Starter, Team, Business, Enterprise) with active developer and monthly scan limits documented on the pricing page. The Customer may choose monthly billing (no commitment, cancellable at any time) or annual billing with a 20% discount (upfront payment for 12 months).

Auto-renewal: subscriptions renew automatically at the end of the billed period unless the Customer cancels before. We notify by email 7 days before each renewal.

Upgrade: allowed at any time; proration is applied automatically. Downgrade: applies at the start of the next billed cycle.

04. Payments

Payments for Starter, Team and Business are processed through an authorized third party that issues invoices, collects applicable taxes (IVA, VAT, sales tax) and acts as seller to the Customer according to the Customer’s jurisdiction.

All currency is USD (US dollars). Accepted payment methods: Visa, Mastercard and American Express cards, and local methods supported by the authorized third party.

The Enterprise tier is billed by invoice with Net 30 or Net 60 terms per individual contract.

05. Cancellation and refunds

Monthly plan: cancellable at any time. The plan remains active until the end of the paid month. No refund of the current month.

Annual plan: cancellable at any time. The plan remains active until the end of the paid year. 30-day money-back guarantee from the initial charge date: if you cancel within those 30 days, we refund the full payment (subject to the fair use policy).

Fair use policy: the 30-day refund applies to customers evaluating the Service in good faith. Excessive use during the refund period (defined as exceeding 2x your tier’s monthly scan limit, or scanning more than 50 repositories in 30 days) voids refund eligibility.

06. Behavior on exceeding limits

If the Customer exceeds the monthly scan limit of their tier:

• 80% of the limit: yellow notice and informational email
• 100% of the limit: red notice; scans continue during a 7-day grace period
• Day 8 after 100%: hard block; new scans are blocked until an upgrade or the start of the next cycle

Musha never charges overage automatically. Upgrading is voluntary.

07. Acceptable use

The Customer agrees to use the Service only to analyze source code that it owns or has legal authorization to analyze. The following is prohibited:

• Reverse engineering, decompilation or attempting to extract Musha’s source code
• Using the Service for denial of service, abusive scraping or creating anomalous loads
• Circumventing technical tier limits (for example, multiple accounts for the same project)
• Using the Service for illegal activities or violating third-party rights
• Sharing account credentials among multiple people not authorized by the Customer

08. Intellectual property

Musha retains all intellectual property rights over the platform, the Service code, the analysis engines and algorithms, the SAST and IaC rules and the secrets detection patterns. These are not transferred to the Customer under any circumstance.

The Customer retains all rights over its source code, its data and the findings generated about its code. Musha processes this data solely to deliver the Service.

Musha does not share or transfer the Customer’s source code to third parties under any circumstance. Code is processed temporarily during each analysis and is automatically deleted when it ends. When someone in the Customer’s organization opens a finding, the token the Customer granted reads the lines around it. Those lines are not stored, each read is logged, and an administrator can turn this off.

09. SLA and service credits

SLA commitments per tier are documented on the pricing page. Summary:

Tier	Uptime	Response time
Starter	Best effort	24-48 h
Team	99.5%	12 h
Business	99.9%	4 h
Enterprise	99.95%	1 h

Service credits apply only to the Enterprise tier per individual contract. No credits apply to Starter, Team or Business.

10. Limitation of liability

To the maximum extent permitted by law:

• Musha’s total liability to the Customer for any claim is limited to the amount paid by the Customer in the 12 months prior to the event giving rise to the claim
• Musha is not liable for indirect damages, lost profits, data loss, reputational damage or consequential damages
• The Service is provided “as is”, without express or implied warranties of merchantability, fitness for a particular purpose or non-infringement
• Musha does not guarantee that the Service will detect all vulnerabilities. A vulnerability not detected by Musha does not constitute a breach of these Terms

Liability for Customer security incidents: if the Customer suffers a security incident, data breach, ransomware, credential compromise or any adverse event arising from a vulnerability in its source code, dependencies, infrastructure, configuration or operational practices, and such vulnerability was not detected, was reported late, misclassified or ignored by the Service, this does not constitute a breach by Musha nor give rise to any liability on its part. The Service is an automated, complementary tool; responsibility for the security of the Customer’s software, systems and infrastructure lies solely with the Customer, who must maintain additional security practices (manual pentesting, code review, monitoring, defense in depth).

11. Customer indemnification

The Customer agrees to indemnify, defend and hold harmless Musha and its holder from and against any claim, demand, liability, damage, cost, expense or legal fee (including reasonable attorney’s fees) arising from or related to:

• Use of the Service to analyze source code or infrastructure for which the Customer does not hold the corresponding legal authorization from the rights holder
• Violation of intellectual property rights, trade secrets or privacy rights of third parties through the Service
• Use of the Service in violation of these Terms, the Privacy Policy or any applicable law
• Willful misconduct or gross negligence of the Customer, its employees, contractors or agents

This indemnification obligation survives termination of the contractual relationship.

12. Confidentiality and data

Processing of personal data is governed by our Privacy Policy. For Business and higher tiers we offer a signed Data Processing Agreement (DPA) upon request.

Musha keeps all Customer information accessed during Service delivery confidential. Employees and providers are subject to equivalent confidentiality obligations.

13. Modification of the Terms

Musha may modify these Terms. Material changes are notified to the Customer’s registered email with at least 60 days’ notice. If you do not accept the changes, you may cancel your subscription without penalty before the effective date. Continued use after the effective date implies acceptance.

Pricing: Musha may adjust prices. Price changes never apply to existing customers without 60 days’ notice. Existing customers keep their price unless they renew on a different tier.

14. Termination

The Customer may terminate the relationship at any time by cancelling its subscription.

Musha may suspend or terminate the Service for cause, including (without limitation): breach of these Terms, prohibited use of the Service, non-payment for more than 17 days, fraudulent activity or legal requirement. We will notify the Customer with as much notice as is reasonable.

After cancellation or termination, the account becomes read-only for 30 days: the Customer can sign in and view its information, but cannot create scans or new resources. Five days before deletion we notify the account administrators by email. On day 31 the data is permanently and automatically deleted, per the Privacy Policy.

15. Governing law and jurisdiction

These Terms are governed by the laws of the Republic of Colombia. Any dispute arising from or related to these Terms shall be submitted to the exclusive jurisdiction of the courts of Bogotá D.C., Colombia, unless the mandatory law of the consumer’s domicile provides otherwise.

Controlling language: in case of discrepancy between the Spanish and English versions of these Terms, the Spanish version prevails.

16. General provisions

• Entire agreement: these Terms, together with the Privacy Policy and the DPA (if applicable), constitute the entire agreement between the parties
• Severability: if a clause is declared invalid, the rest remain in full force
• Assignment: the Customer may not assign these Terms without Musha’s written consent. Musha may assign them in case of a merger, acquisition or corporate restructuring
• No waiver: a party’s failure to exercise a right does not constitute a waiver of that right
• Force majeure: neither party is liable for breaches caused by events beyond its reasonable control

17. Contact

Commercial name	Musha Security
Address	Bogotá D.C., Colombia
General support	[email protected]
Privacy / Habeas Data	[email protected]
Enterprise sales	[email protected]
Legal and contracts	[email protected]
Security / vulnerability disclosure	[email protected]

The full legal identification of the holder (legal name, registrations, tax ID, physical address) is provided in writing to customers who sign a Service contract, or to competent authorities (SIC, DIAN, courts) upon written request to [email protected].