Safe Hands
Book your audit
Legal

Terms of Service

DRAFT — not legal advice. This is a plain-language working draft for review. Have a qualified lawyer review it before you rely on it or publish it. Anything in [BRACKETS] is a placeholder or a decision still to make (see our open-questions list).

Last updated: [DATE]
Operator: HOC Techlabs LLP ("Safe Hands", "we", "us"), trading as Safe Hands at safehands.dev.

These terms explain what you get when you buy a Safe Hands security audit, what we need from you, and where our responsibility ends. By paying for an audit, you agree to them.

1. What we do

Safe Hands reviews the code of apps built with AI app builders (for example Lovable, Bolt or Emergent) and fixes the security problems we find.

With your permission, we connect to your GitHub repository, read the code, and look for vulnerabilities, such as:

  • weak or missing login and access checks
  • database access rules that let the wrong people read or change data (for example Supabase row-level security)
  • secrets and API keys exposed in code
  • unprotected API endpoints and file storage
  • risky or outdated dependencies

A person checks every finding. This is a review of your code, not an automated scan of your website.

2. What's included

For one app (one GitHub repository) you get:

  1. An audit report. Each finding is listed in plain language with a severity (critical, high, medium or low), what could go wrong, and how to fix it.
  2. Pull requests for critical and high findings. We write the fix, test it, and open a pull request (PR) in your repo for you to review.
  3. Fix prompts for medium and low findings. Ready-to-paste instructions you can give your AI app builder, or a developer, to fix them yourself.
  4. One free re-test. After you've merged the fixes, we check once more that the problems are gone. Ask for it within [30] days of receiving the report.

We aim to deliver the report within 5 business days of getting access to your repo. We'll tell you up front if your app is larger than usual and needs longer.

3. What's not included

  • Apps or repositories beyond the one you paid for.
  • A penetration test of your live website or servers, or any testing of systems we don't have permission to access.
  • Pull requests for medium or low findings (you get fix prompts instead), unless we agree otherwise in writing.
  • Ongoing monitoring after the re-test. Monthly plans will come later.
  • Hosting, deployment, or merging changes for you.
  • Fixing problems in third-party services you use (for example your database or payment provider). We'll tell you about them, but we can't change those services.
  • Legal or compliance certification (for example SOC 2, HIPAA, or GDPR sign-off).

4. Price and payment

  • Founding price: $499 per audit for the first 10 customers. Standard price: $999 per audit after that.
  • You pay the full amount up front through Dodo Payments, which acts as our merchant of record: it processes the payment and issues your invoice. We don't see or store your card details.
  • Prices are in US dollars and don't include any taxes that apply where you are.
  • We start work once payment has cleared and you've given us access to your repo.

5. Refunds

  • We can't start: if we can't start your audit (for example your stack is something we can't review, or we can't get access to your repo), you get a full refund.
  • You change your mind before we start: if you cancel before you've given us repo access, you get a full refund.
  • We find nothing material: if our audit finds no critical or high issues, you can ask for a 50% refund within 14 days of getting the report. You keep the report: a clean result is still useful proof that your app is in good shape.
  • Otherwise: once the audit has started, the fee isn't refundable, because the work has been done. If you're unhappy with the work, tell us and we'll try to put it right.

To ask for a refund, email support@safehands.dev. Refunds go back to your original payment method through Dodo Payments, usually within 5–10 business days.

6. What we need from you

  • Permission. You confirm that you own the app and repository, or are authorised to let us access and change them.
  • Access. You install our GitHub App on the repository to be audited (see Data handling) and keep it installed until the work is done.
  • Information. You answer our questions about how your app works and tell us about anything sensitive in it, such as health or payment data.
  • Your decisions. You decide whether to merge each pull request. Merging is your choice and your responsibility. Review the changes (or ask a developer to) and test them before they go live. We never merge into your main branch ourselves.
  • Backups. Keep your own backups. We work on separate branches, but you're responsible for your production app and data.

7. No guarantee of zero vulnerabilities

We'll do a careful, professional review. But no audit can find every problem, and new problems can appear when your code, your dependencies, or the services you rely on change. We don't promise that your app will be completely secure, that it can never be hacked, or that it meets any particular law or standard.

8. Limit of our liability

To the extent the law allows:

  • Our total liability for anything connected with an audit is limited to the fees you paid us for that audit.
  • We're not liable for indirect losses, such as lost profits, lost revenue, lost data, or harm to your reputation.
  • We're not responsible for problems caused by changes you or others make, by code you merge without reviewing, or by third-party services.

Nothing in these terms limits liability that can't legally be limited, such as liability for fraud.

9. Confidentiality

  • We treat your code, your data, and our findings about your app as confidential.
  • We only use them to do your audit. We don't share them, publish them, or use them to train AI models.
  • We may mention that you're a customer only if you say we can.
  • If you'd like a signed non-disclosure agreement (NDA), ask us before we start and we'll sign one.

How we handle your code and data is explained in Data handling.

10. Ownership

  • Your code is yours. So are the fixes in our pull requests once you've paid. You can use, change, and keep them.
  • The audit report is yours to use for your app. We keep the general know-how, methods and tools we use to do audits.

11. Responsible use

We only test the repository you give us access to. We don't attack your live systems, and we don't access other people's data. If we come across personal data while reviewing code, we only look at what we need to explain the issue.

12. Ending the service

  • You can remove our access at any time by uninstalling the GitHub App (see Data handling). If you do this before we deliver, we'll deliver what we can with the access we had.
  • We can decline or stop an engagement if we find the app is used for something illegal or harmful, or if we're asked to do something we aren't authorised to do. If we stop for reasons that aren't your fault, we'll refund you.

13. Changes to these terms

We may update these terms. The version in effect when you paid applies to your audit. We'll show the date of the latest version at the top.

14. Governing law

These terms are governed by the laws of India. Any disputes will be handled by the courts of Bengaluru, Karnataka, India, unless the law where you live gives you the right to use your local courts.

15. Contact

HOC Techlabs LLP · Kethana Accolage, Sarjapur Main Road, Bengaluru, Karnataka 560035, India · support@safehands.dev