Skip to main content

Terms of service

Last updated 16 October 2026

Questions about these terms: hello@vulkro.com. Also read the privacy policy.

The service​

Vulkro is a security product for application code and Salesforce, provided by Reveriext Inc., a Delaware corporation ("Reveriext", "we", "us"). It includes the vulkro and vulkro-sf scanners, the local console, the VS Code extension and the MCP server that come with them, Vulkro Cloud, and the customer portal at app.vulkro.com. These terms are the agreement between Reveriext Inc. and the person or organization that uses Vulkro ("you"). By installing, signing in to or using Vulkro, you agree to them.

Vulkro is offered to businesses and professionals for use in their work. You must be at least 18 years old to use it. If you accept these terms for an organization, you confirm that you are allowed to do so, and "you" then means that organization. A written agreement signed by both of us, such as an order form, takes precedence where it differs.

Vulkro, its software and its name belong to Reveriext Inc. Vulkro is closed source. These terms give you the right to use it while your trial or plan is active. They do not transfer ownership of any part of it.

Accounts and workspaces​

You sign in with an account at app.vulkro.com. You are responsible for your sign-in, and for everything done under your account. Tell us at security@vulkro.com if you think someone else has used it.

A Vulkro Cloud workspace belongs to the organization that asked for it. You decide who is a member and what each role may do, and you are responsible for what your members, and the workspace API tokens you create, do in it. Our support team enters a workspace only while a member has granted access, for the time they chose.

Trial and plans​

Vulkro is a paid product: the scanners run only under an active trial or plan. A Pro plan starts with a 14-day trial when you check out on the Billing page of the portal. A card is needed to start it. Nothing is charged during the trial, and you can cancel before it ends. If you do not cancel, the plan you chose begins when the trial ends and the card is charged.

The trial is one per person and one per machine. Signing in on a machine does not start a trial. A Vulkro Cloud workspace is set up by our team on request from vulkro.com/cloud/start, with a 14-day trial. Enterprise plans are arranged with us directly.

Plans are billed by the month or by the year, in US dollars, and the price is shown before you pay. Plans renew automatically at the end of each period, and the card is charged, until you cancel.

Price changes. If we change the price of your plan, we email you at least 30 days before the new price applies. It applies from your next period, never to a period already paid for. If you do not want the new price, cancel before that period starts.

Seats​

A Pro plan is for one person, with one machine per product. A Vulkro Cloud plan includes a number of members, and each member above that is billed monthly. An upgrade takes effect at once; a downgrade at the end of the period you have paid for.

Payment, tax and refunds​

Payments are taken by Clerk Billing through Stripe, on the card you gave at checkout or have since replaced.

Tax. Prices exclude tax. You are responsible for any sales, use, value-added or similar tax that applies to your purchase, other than taxes on our income. Where we are required to collect a tax, it is added to the charge and shown to you.

Refunds. We do not give refunds, except where the law requires one. Cancelling stops the next charge; it does not return a charge already made, and your plan keeps working until the end of the period it paid for.

When a plan ends or a payment fails​

If a charge fails, we email you and the card is retried. If it is not resolved, or your trial or plan ends:

  • The scanners. The licence already on your machine keeps working for 14 days. After that, scanning stops until you start or renew a plan. Nothing on your machine is deleted: your results and reports stay readable.
  • Vulkro Cloud. The workspace becomes read-only: scanning stops, and your data stays readable and exportable. Choosing a plan again opens it as it was left.
  • Cloud scans on Pro. These scans and their results are always deleted 14 days after they ran.

Cancelling​

You can cancel online at any time, from the Billing page of the portal. No email or call is needed. The cancellation takes effect at the end of the period already paid for, and your plan works as normal until then.

Acceptable use​

You agree not to use Vulkro to:

  • scan, probe or connect any code, system, application or Salesforce org that you do not own and are not authorized to test (this includes vulkro probe, which sends real requests);
  • attack, gain unauthorized access to, or harm any system, person or organization;
  • reverse-engineer the product, or extract its source code, signing keys or rules, beyond what applicable law permits;
  • test the security of Vulkro itself, except under our security policy;
  • interfere with or overload the service, or try to reach another customer's data;
  • redistribute the binaries, the vulnerability data or the rules, or build a competing product;
  • share your licence, take more than one trial, or get around the licence checks.

Your data​

On your machine. The scanners scan on your own machine. A scan never sends us your source code, your findings or anything about your files. The few network calls the scanners make (sign-in, licence refresh, a usage heartbeat with no code, paths or findings, and the downloads you ask for) are listed in the privacy policy, and VULKRO_OFFLINE=1 turns them all off.

In Vulkro Cloud. The data from your Salesforce orgs, your repositories and your workspace is yours. We process it only to run the service for you, as described in the privacy policy. We never sell it, and we do not use it to train a model. You can export it at any time, including while a workspace is read-only.

Findings, reports and other output Vulkro produces for your code and your orgs belong to you.

Vulkro Cloud​

  • Salesforce. You may connect only orgs you own or administer, with the authority to let Vulkro Cloud read them. It reads settings, metadata, code and user activity, and never changes your org.
  • Repositories. You may connect only repositories you are authorized to scan. Each scan clones the branch into its own container and deletes the copy when it ends. Vulkro Cloud writes to your git host only what you turn on: commit statuses, checks and comments on pull requests, and, when a member asks, a pull request that raises a vulnerable package to its fixed version. It never merges.
  • Vulnerability lookups. While this workspace setting is on (the default), the name, ecosystem and version of your dependencies are checked against the public OSV database (api.osv.dev). Code is never sent. An admin can turn it off.
  • You run your org and your code. Deciding whether to act on a finding, and every change you make, including one that follows a suggested fix, is yours.

On your own servers. If you hold an on-premises licence, you host the workspace and its data and are responsible for that infrastructure. A connected installation sends a licence heartbeat with counts only, never names, findings or scan content. Fourteen days after its lease ends, an unrenewed installation stops scanning; nothing is deleted.

Offline licence files. For machines that cannot reach the internet, a customer with an active paid plan can generate an offline licence file. It is valid until its expiry date and is not renewed automatically.

Results and AI​

Security analysis is not perfect. Vulkro can miss real issues and report issues that are not real, and a clean result does not mean code or an org is secure. Findings, grades, attack paths and compliance mappings are aids to your own judgement, not a certification or an audit opinion. Suggested fixes, including any an AI model explains, can be wrong: check every change before you apply it. Optional AI features send data to the AI provider you configure, not to us.

Third-party services​

Vulkro works with services we do not run, such as Salesforce, your git host, Slack, Microsoft Teams, Jira, your AI provider and your editor. Each is governed by its own terms. Once data reaches a service you chose, we are not responsible for how that service handles it.

Availability​

We aim to keep the hosted parts of Vulkro available and reliable, but the service is provided "as is" and "as available," without warranties of any kind, express or implied, including any warranty of merchantability, fitness for a particular purpose, or non-infringement. We don't guarantee uninterrupted or error-free operation. No service level applies unless we have agreed one with you in writing. The scanners keep working without the hosted services, except for features that need the network.

Limitation of liability​

To the maximum extent the law allows, neither side is liable to the other for indirect, incidental, or consequential damages, such as lost profits, lost data, or a security incident caused by a vulnerability Vulkro did not report, arising from using or being unable to use Vulkro. Each side's total liability under these terms is capped at the amount you paid us for the service in the twelve months before the claim arose, or US$100 if that is greater.

Nothing in these terms limits liability that the law does not allow to be limited, or your obligation to pay what you owe for the service.

Claims caused by your use​

If someone else brings a claim against Reveriext because you scanned or connected something you were not authorized to, broke the acceptable-use rules above, or because of changes you made to your systems, you will cover the reasonable costs and damages that result. We will tell you promptly about any such claim and let you take part in answering it.

Termination​

Either side can stop using the service, or end this agreement, at any time. You end it by cancelling your plan or deleting your account. We may suspend or terminate access that breaches these terms, with notice where reasonably possible. On termination your licence to run the scanners and your access to Vulkro Cloud end; data the scanners stored on your machine stays yours, and Cloud data is handled as described in the privacy policy.

Changes to these terms​

We may update these terms as the product changes. We'll update the date at the top of this page. For a material change, we email active customers at least 30 days before it takes effect. If you keep using Vulkro after that date, the updated terms apply. If you do not agree to them, you can cancel before they take effect.

Governing law​

These terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-law rules. Any dispute arising from these terms or from Vulkro is brought in the state or federal courts located in Delaware, and both of us submit to their exclusive jurisdiction.

Before either side goes to court, it will write to the other and allow 30 days to try to settle the matter. Nothing in these terms removes a right that the law where you live gives you and does not allow to be waived.

General​

These terms, with the privacy policy and any plan you have agreed with us in writing, are the whole agreement between us about Vulkro. If a court finds part of them unenforceable, the rest stays in force. Not enforcing a term at one time does not give up the right to enforce it later. You may not transfer this agreement without our written consent; we may transfer it as part of a merger or a sale of the business, and will tell you if we do. Neither side is responsible for a failure caused by events beyond its reasonable control.

We send notices by email to the address on your account. You send notices to us at the addresses below.

Contact​

Vulkro is provided by Reveriext Inc. Questions about these terms go to hello@vulkro.com. About a charge, an invoice or a plan, write to billing@vulkro.com.