Terms

1Scope and contracting party

This English version is a courtesy translation. Only the German version is legally binding.

These terms and conditions apply to all contracts for the use of Vallit, a service that checks and monitors web apps at app.vallit.net. The provider and your contracting party is Theo Reichert, sole proprietor, trading as Vallit, Parkstraße 1, 76131 Karlsruhe, Germany (“we”). This text carries version 2026-10-08.

The paid plans and one-off fixes are for businesses only within the meaning of § 14 BGB: natural or legal persons and partnerships with legal capacity acting in the exercise of their trade, business or profession when the contract is made, and legal persons under public law. This applies to customers in Germany and abroad. By ordering you confirm that you act for a business and may bind it. Consumers cannot order paid services.

Anyone may use the free check; these terms apply to it with the particulars in section 2 and section 11 paragraph 6.

Your own or additional terms apply only if we expressly agree to them in text form. Individual agreements take precedence over these terms.

2Service per plan

Vallit opens a web app the way a browser does and checks automatically what it shows to every visitor: among other things reachability, certificate, security headers, exposed keys and files. If you connect a repository, the code checks read its contents as well. Each report names the checks it covers under “What we checked”. The result is a report with findings, what they mean and, where we have one, instructions to fix them (a “fix kit”).

Every app in a workspace is on one of these plans:

• Free check and Free: a daily check of the app’s site, the full report with fix kits, and the trust page. Code checks and the five-minute watch are not included. You can order one-off fixes at the price on the pricing page (section 7).
• Watch: every check of the site and, with a connected repository, of the code; once the domain is confirmed, a reachability check every five minutes with one alert per incident; trust page and badge. Fixes are not included and can be ordered one at a time.
• Care: everything in Watch, plus our work on every confirmed finding of the app, with no monthly limit, under section 7; we answer critical findings under section 8.

Prices, the number of checks you can start yourself and every other limit of a plan are on the pricing page and in the app on the “Billing” page; what they say when you order applies. The five-minute pace is for reachability; the other checks run daily or when you start them. We develop the checks further and may change them as long as the agreed scope of a plan essentially remains and the change is reasonable for you.

3What a check does and does not do

We check and report; we do not guarantee that your app is free of errors or secure. A report describes what our automatic checks observed at a given time with the access you gave us. It is not a penetration test, not a complete security audit, not a certification and not legal or compliance advice.

Automatic checks recognise certain patterns. They can miss errors and vulnerabilities and occasionally flag something that is not one; new vulnerabilities can appear at any time. A report without findings only means that the completed checks found nothing. Checks that could not run are named as such and do not count as passed.

In particular, the checks do not cover:

• server code in languages other than JavaScript and TypeScript, and code that runs in the browser beyond what the website checks see;
• code in packages that are not in the repository, and the contents of middleware, whose name we only take as a sign of protection;
• pages and interfaces behind a sign-in;
• business logic, race conditions and your app’s intended permission model beyond the listed rules;
• active attacks, exploiting vulnerabilities, and load or denial-of-service tests;
• live cloud accounts and infrastructure beyond the configuration files in the repository, and whether a vulnerable library version is actually used;
• whether code in the repository is actually deployed;
• mobile and desktop apps.

The page What Vallit checks, and what not describes the checks and what they do not cover.

We owe careful performance of the agreed checks and notifications, not a particular level of security of your app. You remain responsible for your app, its data and its operation. Section 11 governs our liability.

4Only apps you may have checked

You may only have apps checked that you run yourself or whose operator asked you to have them checked. You confirm this before the check. For the five-minute watch you also confirm with a DNS record that you control the domain. Connect a repository only if you are entitled to.

If you culpably have an app checked without this permission, you indemnify us against third-party claims arising from it, including reasonable costs of legal defence. This does not apply to the extent we caused the damage ourselves. We tell you about such a claim without delay and agree the defence with you.

5Ordering and conclusion of the contract

A plan needs an account and a workspace in the app. Only admins of a workspace can order, change or cancel a plan.

On the “Billing” page you choose the plan for each app and the billing interval, confirm in a box that you order for a business and accept these terms and the Data Processing Agreement in the version shown, and send the order. For a one-off fix this happens on the finding. This is a binding offer. The contract is concluded when we accept the order: for a new plan or a one-off fix with the payment confirmed by our payment provider Stripe, for a plan change when Stripe confirms it. The app then shows the plan.

For every order we record which version of these terms and of the Data Processing Agreement was accepted, by whom and when. You see this in the app on the “Billing” page; the current text can be opened, saved and printed here. We send you earlier versions on request.

Keep your login details secret. You are responsible for actions taken through your account to the extent you are at fault. The language of the contract is German.

6Prices, trial and payment

The prices shown in the app when you order apply. We are a small business under § 19 of the German VAT Act (UStG) and charge no VAT; the prices shown are final prices, and our invoices show no VAT.

You pay monthly or yearly in advance by card through Stripe. If you change the plan, the difference for the rest of the current billing period is charged or credited pro rata; the app shows the amount before you send. We provide invoices electronically.

A workspace’s first Watch plan starts with a free 14-day trial. Stripe takes the card at the start and charges it when the trial ends, unless you cancel before. A plan with Care is paid from the start.

If a payment fails, the plan stays active at first. If payment is still outstanding after a reminder with a reasonable deadline, we may suspend the plan’s services until it arrives. We do not hold back your data.

7Fixes by Vallit

One-off fix: on any plan you can order a fix for a finding in your report at the fixed price on the pricing page. Care: for apps on Care, our work on every confirmed finding is included, with no monthly limit. A finding is confirmed when our check reported it and our investigation does not show it to be a false alarm.

A person at Vallit investigates the finding and prepares the change: if it is in your code, as a pull request on a branch of its own in your repository, otherwise as exact instructions. We do not change your main branch, your hosting or third-party services ourselves; you decide whether to apply and publish a change. The next check shows whether the finding remains. The app shows the status of every request.

Work we expect to take more than two hours we agree with you before we start: scope, approach and date. If the fix lies only with your hosting provider or another third party, if a necessary access is missing, or if a finding cannot be fixed in your code with reasonable effort, we tell you so, with the concrete reason and the next possible step.

We deliver a paid one-off fix within two business days (section 8) of your order, as a pull request or as exact instructions. While we wait for something from you, such as access or an answer, this period stands still; the app shows when it does. If we agreed a different date for longer work, that date applies.

We carry out fixes with care and according to the state of the art. You review a proposed change before applying it and back up your data and code appropriately. If we do not deliver a paid one-off fix, even after a reasonable grace period, or if we decline it, we refund its price in full. Further statutory rights, in particular for defects, remain unaffected.

8Support and response times

Our support hours are Monday to Friday, 09:00 to 18:00 (time zone Europe/Berlin), excluding public holidays in Baden-Württemberg (“business days”). You reach us at info@vallit.net.

Care: we answer a critical finding of an app on Care by 18:00 on the next business day after your request arrives or after our check reports the finding, whichever is earlier. The answer says how we assess the finding, its priority and the next step; it is not yet the fix. For other requests and other plans we promise no particular response time.

We strive for uninterrupted operation but promise no particular availability of the app. Maintenance, outages at our providers and events beyond our control can limit the service at times. status.vallit.net shows the current state.

9Term and cancellation

A plan runs for the chosen billing interval, a month or a year, and renews for the same interval unless cancelled before. You can cancel at any time to the end of the current billing period, in the app under “Billing” with “Manage billing”, or by email to info@vallit.net. We can cancel with one month’s notice to the end of a billing period.

Both parties keep the right to terminate for good cause. If we permanently fail to provide an essential service of a plan, even after a reasonable deadline, you can end the plan at once and receive a pro-rata refund of the amount prepaid for the remaining time.

When a plan ends, your apps stay in the workspace on Free: they are still checked daily, and your reports stay readable until you delete the workspace. On request you receive your reports and findings in a common machine-readable format. What we delete and when is in the privacy policy.

10Your obligations

You do not use Vallit to

• check apps without permission (section 4),
• overload other systems or circumvent our limits,
• use the results against third parties, for example to exploit vulnerabilities, or
• query the service automatically to an extent the app does not provide for.

If you seriously breach these obligations, we may temporarily block the use concerned, tell you why, and, if the breach is not remedied, terminate the contract for good cause.

11Liability

1. We are liable without limitation for intent and gross negligence, for injury to life, body or health, for fraudulently concealed defects, to the extent of an expressly given guarantee, under the German Product Liability Act and in every other case in which the law does not allow liability to be limited.
2. For slight negligence we are liable only if we breach an essential contractual obligation, that is an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment you may regularly rely. Liability is then limited to the damage foreseeable and typical for the contract when it was concluded.
3. That a carefully performed check does not detect an error or vulnerability is not in itself a breach of duty (section 3). For damage from an undetected error or from attacks by third parties we are liable only to the extent we culpably breached a duty, and then within paragraphs 1 and 2.
4. Contributory fault, in particular a lack of reasonable backups of data and code or applying a change without review, is taken into account under § 254 BGB.
5. These rules also apply to the personal liability of the people we engage. Otherwise liability is excluded to the extent the law permits.
6. For the free check, which is free of charge, we are liable only for intent and gross negligence and in the cases of paragraph 1.

12Data protection, processing on your behalf and confidentiality

How we process personal data is set out in the privacy policy. Where we process personal data on your behalf when checking, monitoring or fixing, the Data Processing Agreement under Art. 28 GDPR applies, which you accept with your order. The subprocessors we use are listed on the subprocessors page.

You keep all rights to your code and your data. We use them only to provide the agreed services and do not train AI models with them. We treat your reports and findings confidentially and share them only with the service providers we need to run Vallit. A report or trust page you share by link or publish can be read by anyone with the link.

13Changes to these terms and to prices

We publish new versions of these terms here with a new version number. For a running contract a new version or a new price applies only once you agree, for example with your next order in the app. Silence does not count as agreement. If you do not agree, your contract continues on the previous terms; we may then cancel it with notice under section 9.

14Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods.

If you are a merchant, a legal person under public law or a special fund under public law, or have no general place of jurisdiction in Germany, the place of jurisdiction for all disputes arising from the contract is Karlsruhe, Germany, to the extent the law permits. We may also sue you at your general place of jurisdiction.

If a provision of these terms is invalid, the others remain valid; the statutory provision takes the place of the invalid one.