Terms of Service

Workspace

The organization-level container that holds your projects, users, credentials, infrastructure targets, runbooks, and audit history.

Customer Data

Everything you or your users submit to the Service: secret material, infrastructure metadata, runbook definitions, project names, and the audit records generated by your activity.

Brokered Credential

A short-lived credential the Service issues to an authenticated CLI at the moment of use, in place of a standing, long-lived credential.

User

A person you authorize to access your Workspace, whether an employee, contractor, or automated principal holding a scoped token.

Documentation

The technical documentation we publish at https://docs.shortspan.dev and within the product.

Shortspan stores credential material under envelope encryption, brokers short-lived credentials to authenticated clients, enforces the access policy you configure, and records an audit trail of every credential issued.

We may add, change, or remove features. We will not materially reduce the core security guarantees of a paid plan during a paid term without giving you at least thirty (30) days’ notice and the option to terminate for convenience with a pro-rata refund of prepaid, unused fees.

Shortspan is an access broker, not a backup service. You are responsible for retaining your own recoverable copies of any credential or configuration whose loss would disrupt your operations.

You must provide accurate registration information and keep it current. You are responsible for all activity that occurs under your Workspace, including the actions of your Users and of any token or device you have authorized.

Your responsibilities

• Enforce multi-factor authentication or passkeys for every User with administrative rights.
• Revoke Users, devices, and scoped tokens promptly when someone leaves your team or a device is lost.
• Configure roles, grants, and approval requirements to match your own least-privilege policy - we enforce what you configure, not what you intended.
• Keep the CLI reasonably current; we support the two most recent minor releases.
• Report suspected compromise of your Workspace to security@shortspan.dev without undue delay.

You must be at least sixteen (16) years old, or the age of digital consent in your jurisdiction if higher, to hold an account. The Service is not directed at children.

As between you and us, you own all Customer Data. You grant us a limited, non-exclusive, worldwide licence to host, process, transmit, encrypt, and display Customer Data solely to operate, secure, and support the Service for you, and to comply with law.

We do not sell Customer Data, do not use it to train machine-learning models, and do not use it for advertising. Secret material is encrypted before it reaches persistent storage and is decrypted only in memory, in-request, to serve an authorized retrieval.

You are responsible for having the right to place any credential you upload into the Service, and for ensuring that brokering access to your infrastructure through Shortspan does not breach an obligation you owe to a third party.

On termination we retain Customer Data for thirty (30) days so you can export it, then delete it. Encrypted backups age out within a further sixty (60) days. Audit records may be retained longer where we are legally required to keep them.

Your use of the Service is subject to our Acceptable Use Policy. In summary, you may not use Shortspan to access systems you are not authorized to access, to store or distribute unlawful content, to attack or degrade the Service or any third party, or to evade the Service’s audit and approval controls.

We may suspend a Workspace, a User, or a specific credential immediately and without prior notice where we reasonably believe continued operation presents an imminent risk to the Service, to other customers, or to a third party. We will tell you why as soon as it is safe and lawful to do so.

Paid plans are billed in advance on a recurring basis at the price shown on our pricing page at the time of purchase. Subscriptions renew automatically for successive periods of the same length until cancelled.

Payments are processed by Paddle.com Market Ltd., which acts as the merchant of record for the transaction. Paddle’s own terms apply to the payment itself, and your invoice, receipt, and applicable sales tax or VAT are handled by Paddle.

Cancellations and refunds

• You may cancel at any time from the billing settings. Cancellation takes effect at the end of the current billing period; the Workspace then reverts to the Free plan.
• If you change your mind, you have fourteen (14) days from a payment to request a refund of it, no reason needed. Beyond that window we refund pro-rata where we materially reduce a core security guarantee during your paid term, where we terminate your account other than for cause, or where the law requires it. See the Refund & Cancellation Policy for the full detail and how to ask.
• Downgrading may make your usage exceed the limits of the lower plan. Existing data is preserved and readable, but you may not be able to create new resources until you are back within the limit.

We may change prices with at least thirty (30) days’ notice before the change applies to your next renewal. Continuing to use a paid plan after the change takes effect constitutes acceptance of the new price.

Overdue amounts may accrue interest at the lower of 1.5% per month or the maximum permitted by law. We may suspend paid features on an account that remains unpaid more than fourteen (14) days after we notify you.

We publish current and historical availability at https://status.shortspan.dev. Free plans are provided without an availability commitment. Paid plans receive commercially reasonable efforts to maintain availability, and Enterprise customers may contract for a written service-level agreement.

Scheduled maintenance is announced in advance where practicable and is excluded from availability calculations, as are outages caused by your systems, your network, or factors outside our reasonable control.

Shortspan denies rather than fails open. If the broker is unreachable, the CLI will not issue a credential from cache. This is a deliberate security property, and you should plan a break-glass procedure that does not depend on Shortspan being available.

The Service connects to infrastructure you control - servers, databases, cloud accounts, and clusters - and to third-party services you choose to integrate. We are not responsible for those systems, their availability, or their security posture.

Where the Service brokers access to a third-party system, your agreement with that third party continues to govern that system. Nothing in these Terms grants you rights in a third-party service.

We retain all right, title, and interest in the Service, the CLI, the Documentation, and our trademarks. Subject to these Terms and to payment of applicable fees, we grant you a non-exclusive, non-transferable, revocable right to use the Service and to install and run the CLI for your internal business purposes.

You may not reverse engineer, decompile, or attempt to derive the source code of any part of the Service except to the extent that restriction is unenforceable under applicable law; resell or sublicense the Service; or use it to build a competing product.

If you send us feedback or suggestions, you grant us a perpetual, irrevocable, royalty-free licence to use them without obligation to you. We will not identify you as the source without your permission.

Each party may receive non-public information from the other. The receiving party will protect it with at least the care it uses for its own confidential information, will use it only to perform under these Terms, and will disclose it only to personnel and advisors bound by comparable obligations.

These obligations do not apply to information that is or becomes public through no fault of the receiving party, was already known to it without a duty of confidence, or is independently developed. Disclosure compelled by law is permitted where the receiving party gives prompt notice, unless legally prohibited from doing so.

These Terms run from your first use of the Service until all Workspaces you control are closed. You may terminate at any time by closing your Workspace.

We may terminate or suspend for cause if you materially breach these Terms and do not cure the breach within fifteen (15) days of notice, if you fail to pay, if you become insolvent, or if we are required to do so by law. We may terminate a Free plan account for convenience on thirty (30) days’ notice.

On termination your right to use the Service ends immediately. Sections covering Customer Data, intellectual property, confidentiality, disclaimers, limitation of liability, indemnification, and governing law survive.

Each party warrants that it has the authority to enter into these Terms. We warrant that we will provide the Service with reasonable skill and care and in accordance with the security practices described in our published security documentation.

Except as expressly stated, the Service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or that it will prevent every unauthorized access to your systems.

Shortspan reduces the exposure created by long-lived credentials. It is one control among many and is not a substitute for your own security programme, monitoring, or incident response.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility.

Each party’s total aggregate liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid or owed us in the twelve (12) months before the event giving rise to the claim, and (b) one hundred US dollars (US$100).

Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for a party’s breach of its confidentiality obligations, for your payment obligations, or for any liability that cannot be limited under applicable law.

You will defend and indemnify us against third-party claims arising from your Customer Data, your use of the Service in breach of these Terms or the Acceptable Use Policy, or your access to systems you were not authorized to access.

We will defend and indemnify you against third-party claims that the Service, used as permitted, infringes that party’s intellectual property rights, and will pay damages finally awarded or agreed in settlement. This does not apply where the claim arises from Customer Data, from modifications you make, or from use in combination with something we did not supply.

We may update these Terms. For material changes we will give at least thirty (30) days’ notice by email to the Workspace owner and by notice in the product before the change takes effect.

If you do not accept a material change, your remedy is to stop using the Service and close your Workspace before the effective date; we will refund prepaid, unused fees for the remainder of the current term.

These Terms are governed by , without regard to its conflict-of-laws rules. The parties submit to the exclusive jurisdiction of , except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

Before filing a claim, each party agrees to attempt in good faith to resolve the dispute by writing to the other and allowing thirty (30) days for a response. Nothing in this section removes a consumer’s right to bring proceedings in their country of residence where local law grants it.

• Entire agreement - these Terms and the documents they incorporate are the whole agreement between the parties on this subject and supersede prior discussions.
• Assignment - you may not assign these Terms without our written consent, except to a successor in a merger or sale of substantially all assets. We may assign on the same basis.
• Severability - if a provision is held unenforceable, it is modified to the minimum extent necessary and the rest remains in force.
• No waiver - failing to enforce a provision is not a waiver of the right to enforce it later.
• Force majeure - neither party is liable for delay caused by events outside its reasonable control, excluding payment obligations.
• Independent contractors - nothing here creates a partnership, agency, or employment relationship.
• Notices - we send notices to the Workspace owner’s email address; you send notices to the legal address below.

Shortspan Technologies, -.

Legal notices: legal@shortspan.dev · Support: support@shortspan.dev · Security: security@shortspan.dev