RowAttest Terms of Service

Operated by RW Digital Ventures LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA ("we", "us"). By creating an account you agree to these terms.

1. What RowAttest does. RowAttest connects to a Supabase project you register, runs security tests against it, and produces a report about how well your project keeps each user's and each organization's data apart. The tests are real: RowAttest creates its own test users, and test organizations where your project has them, signs in as them, and attempts to read and write rows across those boundaries. Write attempts target only rows RowAttest itself created.

2. Your account. You must be at least 18 years old (or the age of majority where you live) and able to enter contracts. You must provide accurate information and keep your credentials safe. One person or company per account. You are responsible for activity under your account. RowAttest API keys you create are account credentials: keep them secret, and runs started with them count as your activity.

3. Ownership and authorization. You may only connect projects you own or control. Connecting a project is your statement, repeated each time, that: (a) you own or control it; (b) you have the right to authorize security testing against it; and (c) if anyone else owns part of the system (an employer, a client, a partner), you have their permission too. Testing systems without authorization is illegal in most countries. If you connect a project you were not allowed to connect, that is your responsibility, not ours.

4. Staging only. RowAttest is built for staging and test environments. You agree not to connect production databases containing real customer data. If our checks suggest a project may be production-scale, we will warn you and require an explicit confirmation; continuing after that warning is at your own risk.

5. Your credentials. To run tests we need access to your project: either the project URL, Supabase API keys and database connection string you enter by hand, or, if you connect with Supabase, the authorization you grant on Supabase's consent screen plus your database password. We encrypt what we store, decrypt it only while it is in use (inside an isolated worker during a run or a fit check, and on our server for the moments it takes to save or check a connection), never write it to logs or reports, and use it only against the project you registered. For projects connected with Supabase we store no Supabase API keys; each run or fit check fetches them from Supabase for that run or check only. You can delete a project and its stored credentials at any time; deletion is permanent. To end our access to a Supabase-connected project entirely, also revoke RowAttest in your Supabase organization. Full policy: https://rowattest.com/credentials

6. What we create and clean up. Each run creates clearly-marked test users and test rows. At the end of each run we delete everything we created and check that the deletion worked. If a run is interrupted before that step, its test data is removed when that project's next run starts. For every finished run that created test data, the run page shows the result of this check: clean, what remains together with the SQL to remove it, or that the check could not be confirmed. A signed report records whether this check passed and how many items, if any, remained.

7. Reports and the verify page. Free runs show results in your browser. Paid attestation reports are signed by us and can be checked by anyone at our public verify page. You may share your reports and verify links freely. You may not alter a signed report; an altered report will fail verification. Signed reports and their verify pages stay valid even if you later close your account — people you gave a report to can still verify it. Reports contain no credentials and no real customer data.

8. What a report means — and what it does not. A report describes the checks RowAttest actually executed against your project at the time of the run, and nothing more. A PASS is not a guarantee that your application is secure, cannot be breached, or complies with any law or standard. Checks listed as NOT EVALUATED or ERROR were not verified. Your schema can change one minute after a run. You remain fully responsible for your application's security.

9. Liability. The service is provided "as is". To the maximum extent the law allows: we are not liable for indirect, incidental, or consequential damages; our total liability for any claim is limited to the amount you paid us in the twelve months before the claim. Nothing in these terms limits liability that cannot be limited by law.

10. Payment and refunds. Prices are shown at checkout. Attestation purchases are for a specific run's report. If a run fails for a reason on our side, we re-run it or refund it. We do not refund reports because you disliked the results.

Pro subscription. Pro is billed monthly in advance for one connected project. You may cancel at any time from the billing page; your plan stays active until the end of the period you have paid for, and that charge is not refunded except to correct a billing error. Your run allowance resets at the start of each calendar month (UTC) and unused runs do not carry over. Signed reports issued during your subscription remain available to you on the same terms as bought reports. If a subscription charge is disputed, Pro access ends at once.

11. Fair use. No connecting projects you do not control, no attempting to test our own infrastructure without written permission, no reselling runs, no exceeding your plan's run limits through multiple accounts.

12. Termination. You can close your account at any time by emailing info@rowattest.com; we then hard-delete your stored project credentials. Signed reports you purchased and their verify pages remain available (Section 7). We can suspend accounts that violate Section 3, 4, or 11, with notice unless the violation creates risk to others.

13. Changes. We may update these terms; material changes are announced by email at least 14 days before they take effect. Continuing to use the service after that date means you accept the new terms.

14. Governing law. These terms are governed by the laws of the State of Wyoming, USA. Disputes go to the state or federal courts located in Wyoming, unless the law where you live gives you mandatory rights to a different venue.