Skip to content

Terms of service

Last revised 22 September 2026. In effect from 22 September 2026.

These terms are an agreement between DEVINSEC PVT. LTD (“DevInSec”, “we”, “us”), a company in Kathmandu, Nepal, and the organization that signs up for the service (“you”, “your”, the “Customer”). MarshalCloud is a product of DEVINSEC; where these terms say “MarshalCloud”, they mean DevInSec acting through that product. By creating an account or using the service you agree to these terms. If you are agreeing on behalf of a company, you confirm you are allowed to bind that company.

1. Definitions

  • Service means MarshalCloud at marshalcloud.com and app.marshalcloud.com, its API, and the software and files we give you to run in your own environment: the Kubernetes agent, the device reporter script, the cloud setup templates, and pipeline and configuration files the Service generates for your repositories.
  • Organization (or “org”) means a workspace in the Service. Your data, users, connections, and billing plan belong to an organization.
  • Cloud account means a cloud provider account, subscription, project, or cluster you connect to the Service.
  • Customer data means everything the Service holds for your organization: billing and usage records, resource configuration, security findings, monitor results, device reports, incidents, recommendations, alerts, build and deploy records, audit records, AI conversations, and the account details of your users.
  • Action means a change to your infrastructure from our published action catalog, such as stopping a server, deleting an unattached disk, or releasing an unused IP address.
  • Build features means provisioning (planning and applying infrastructure changes), delivery (connecting a code repository and deploying it), and shell access to servers the Service built.
  • Credentials means the access you grant us: normally a cross-account role plus a secret external ID, and otherwise an API token, key, or service account access you give the Service.

2. Accounts

  1. A login belongs to one person. Do not share a password, an authenticator code, or an API key between people. Add each colleague as a separate user in your organization.
  2. Each user can turn on two-step sign-in with an authenticator app. It is optional, and an organization cannot currently require it of its users.
  3. Users hold a role in each organization: owner, admin, infosec, sre, or viewer. Roles decide what a user can see and do, including who may approve a change. You are responsible for keeping the right people in the right roles and for removing people who leave.
  4. An agency organization can be linked to a client organization. The link can only be made by an agency owner whom the client has already made an admin or owner of the client organization. Once linked, every admin and owner of the agency organization can act in the client organization up to a ceiling role set on the link. Today only the agency can remove the link; a client that wants it removed can ask the agency or write to hello@marshalcloud.com.
  5. You are responsible for everything done under your users’ logins and API keys. Tell us at hello@marshalcloud.com as soon as you think a login or key has been misused.
  6. You must be old enough to enter a contract where you live, and at least 18 years old. The Service is for organizations, not for personal or household use.

3. What the Service does

3.1 Reading your cloud

When you connect a cloud account, the Service reads billing and usage records, resource configuration, utilization metrics, change records, and security findings, and uses them to show spend, draw an architecture map, raise findings, and estimate savings. The standard AWS connection role can only read. Two optional additions change that, and you choose whether to install them: the build runner template lets the Service start and stop builds in your account, and the workload scanning template lets it create temporary disk copies and a scanner server in your account.

3.2 Monitoring

The Service can check that websites and endpoints answer, that a TCP port accepts connections, that a DNS name resolves, and that a heartbeat you send arrives on time. For monitored addresses it also checks certificate and domain expiry once a day. We do not promise that a check will always run or that an alert will always be delivered, and the Service is not a substitute for your own operational monitoring.

3.3 Recommendations and savings estimates

The Service proposes ways to reduce spend. Every estimate is an estimate. Each one records the source it was calculated from, such as your own billing combined with utilization metrics, or a recommendation returned by your cloud provider’s own API, together with a confidence level. Estimates are not a guarantee of a result, not an offer of a refund, and not a commitment to any level of saving. Your actual bill depends on your usage, your provider’s pricing, and decisions you make after the estimate is produced.

3.4 Approval-gated fixes

  1. Automated fixes are optional and need a separate remediation role installed in your AWS account, whose permissions match our action catalog. Workload scanning uses its own separate scanning role. If you install neither, no catalog action can run.
  2. Before any action, the Service shows a plain-language plan, the resource it affects, an estimated dollar impact, and whether the change can be undone.
  3. When you approve an action, you instruct and authorize MarshalCloud to make that change in your cloud account using the credentials you granted us. Approval is per action, by a user holding the infosec, admin, or owner role. We act on your instruction, for that action only. An approval can also come from Slack, from a Slack user your organization has allowed to approve; high-risk actions cannot be approved from Slack. A proposal that nobody approves expires: after 7 days for low risk, 3 days for medium risk, and 1 day for high risk.
  4. The Service can propose actions without a person asking, for example when a budget is exceeded or during a scheduled review, but every action still waits for a person’s approval. There is no setting today that lets an action run without one.
  5. Some actions cannot be undone, and we label them before you approve. Each action is shown as reversible (it can be put back), compensating (undo recreates an equivalent, but the original is gone), or irreversible. Releasing an IP address, deleting a snapshot, deleting a network interface, and buying an AWS savings plan are irreversible and ask you to type a confirmation first. Buying a savings plan commits your money to AWS for the plan’s term.
  6. Before deleting an unattached disk, the Service takes a snapshot of it in your account and tags it to be kept for 14 days. We do not delete that snapshot: after 14 days the Service tells you it is still there, and your cloud provider bills you for it until you delete it. Before deleting a DigitalOcean, Linode or Hetzner server, the Service takes a snapshot of the server and deletes the server only once the snapshot has finished; that snapshot is kept, and billed by size, until you delete it. No other irreversible action keeps a copy.
  7. Workload scanning creates temporary resources in your account, which your cloud provider bills you for.
  8. You are responsible for deciding whether a change is safe for your business. We are responsible for carrying out the approved change as described, and for recording who proposed it, who approved it, and what happened.
  9. An owner can turn off any kind of action, and you can remove the remediation role at any time.

3.5 Build features

  1. Provisioning creates, changes, and destroys infrastructure in your cloud account from stacks you define, using a separate build role you install. Every change is first planned, and a person must approve a plan before it is applied: infosec or above for development and staging environments, admin or above for production, and an owner to destroy production. For staging, production, and any high-risk change, the approver must be a different person from the one who asked, and the approval must be given in the product rather than from Slack. Runs execute either on MarshalCloud’s hosted runners in our AWS account, using short-lived credentials for your build role, or on a runner in your own account.
  2. Before applying a change, the Service takes a restore point: provider snapshots in your account, and where the run uses our storage, a copy of the infrastructure state and the reviewed files. If it cannot take the backup, it makes no change. Restore points are kept for 7 days for development, 14 days for staging, and 30 days for production, then the Service deletes the snapshots it made and its own copies.
  3. Delivery connects to your code repository through our GitHub App. It reads your repository, opens pull requests on its own branches, and never merges them. A deploy to your servers or clusters runs only after a person approves it.
  4. Shell access opens an interactive session on a server the Service built. A user with the sre role or above requests it, and a different user with the infosec role or above approves it, except in development environments, where it is approved automatically. The session is recorded by the session logging in your own cloud account, which must be turned on first.
  5. Build features are available only on plans that include them.

3.6 AI features

  1. The Service uses AI models to explain your data, summarize incidents, review plans, and draft answers. See the privacy policy for what is sent to which provider.
  2. The AI can read your data and propose an action for a person to approve. It cannot approve, apply, merge, or execute anything. For users with the sre role or above, it can also leave drafts that a person reviews: incident records, status updates and postmortem drafts, and draft environments, migrations, stack input proposals, plan-only runs, and draft pull requests. Every item the AI writes is marked as written by the AI.
  3. An admin can connect your own AI provider account or endpoint instead of ours. Your data then goes to the provider you chose, under your agreement with that provider.
  4. AI output can be wrong. Check anything important before acting on it.

4. Your responsibilities and acceptable use

  1. Only connect cloud accounts, repositories, monitor targets, and computers you own or are authorized to manage. You confirm you have that authority.
  2. If you install the device reporter on computers used by your staff, you are responsible for telling those people, and for having a lawful basis to do so. See section 2.6 of the privacy policy.
  3. Do not use the Service to attack, scan, or load-test systems you do not control. Do not point monitors or webhooks at private or internal addresses: the Service refuses them, and trying is also a breach of these terms.
  4. Do not attempt to reach another customer’s data, bypass rate limits, reverse engineer the Service, or resell access unless we have agreed to it in writing.
  5. Do not upload unlawful content, malware, or anything that infringes someone else’s rights.
  6. Automated use through the API must stay within the rate limits the Service enforces and your plan’s limits.

We may suspend an organization, or end its access, at any time if we reasonably believe its use threatens the security, integrity, or availability of the Service or of another customer, breaks these terms, or exposes us to legal risk. We do not promise advance notice beyond what the law requires. While suspended, nobody in the organization can sign in to it. Whether and when access is restored is our decision, and we owe no refund or credit for the time suspended.

5. Fees and billing

  1. The Service has a Free plan, paid plans bought online (Startup and Growth), and plans we quote individually (Scaled). Each plan has published limits, such as how many cloud accounts and monitors you can have and which features are included. When a feature is outside your plan, the Service refuses it rather than returning partial data.
  2. Paid plans are bought through Stripe’s hosted checkout. Card details are entered on Stripe’s pages and never reach us. To create the subscription we give Stripe your organization’s name and the email of the owner buying it. Online prices are in US dollars per month and exclude all taxes. You bear every tax, duty, levy, and withholding that applies to your purchase, other than tax on our income. If we are required to collect a tax, it is added to your charge; if you are required to withhold one, you pay us enough that we receive the full price.
  3. Startup and Growth start with a 15-day trial, and no card is collected to start it. If no payment method has been added when the trial ends, the subscription is cancelled and the organization returns to the Free plan. Checkout accepts promotion codes. We may also issue codes that grant a plan for a set period without payment; when that period ends, the organization returns to its paid plan if it has one, or to the Free plan.
  4. A subscription renews automatically each month until it is cancelled.
  5. Cancellation. An owner cancels from the billing page, which opens Stripe’s billing portal. Cancellation takes effect at the end of the current paid period, and paid features continue until then.
  6. Refunds. We do not give refunds or credits of any kind, including for the rest of a period after you cancel, for time the Service was unavailable, or for a feature you did not use. A change between paid plans during a paid period takes effect through Stripe; no part of a fee already paid is returned.
  7. Paid features stop as soon as Stripe reports the subscription as anything other than active or in trial, including when a payment fails. There is no grace period. The organization then has the Free plan’s features. Your data is not deleted by a downgrade.
  8. We may change prices for a future billing period by giving you at least 30 days’ notice by email to your organization’s owners.
  9. You pay your own cloud provider directly. MarshalCloud never pays, receives, or takes a share of your cloud bill, and does not charge a percentage of savings.

6. Intellectual property

  1. We own the Service, including its software, interfaces, documentation, templates, and brand. These terms give you a limited, non-exclusive, non-transferable right to use the Service during your subscription.
  2. You own your customer data. You grant us the right to process it only as needed to provide, secure, and support the Service for you, and as described in the privacy policy and the data processing addendum.
  3. Files, pipeline configuration, and pull requests the Service generates for your repositories are yours to use, change, or discard. They are provided without warranty of any kind, and you are responsible for reviewing them before you merge, run, or deploy them. Your repository stays your own GitHub account under your agreement with GitHub; we act in it only through the GitHub App you install and can uninstall at any time.
  4. If you send us feedback, we may use it without obligation to you.
  5. We do not publish your name as a customer without your permission.

7. Disclaimers

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT, TO THE EXTENT THE LAW ALLOWS.

We do not promise any level of uptime or availability for the Service, or that it will be uninterrupted, error-free, or secure. There is no service level agreement unless we sign one with you separately. Uptime figures the Service reports about your systems describe your systems, not ours.

We do not warrant that savings estimates will be achieved, that recommendations are complete or correct, that monitoring will detect every outage, that security findings identify every risk, that a provisioning plan or deploy will succeed, or that AI-generated text or generated code is accurate, safe, or fit for your purpose. The Service supports your judgement. It does not replace it, and it is not legal, financial, tax, or compliance advice.

8. Limitation of liability

  1. To the maximum extent permitted by law, DevInSec is not liable to you or to anyone claiming through you for any loss or damage of any kind arising out of or relating to the Service or these terms, whether the claim is in contract, tort (including negligence), under statute, or otherwise. This covers direct, indirect, incidental, special, consequential, and punitive damages, lost profits, lost revenue, lost savings, lost business, lost or corrupted data, cloud provider charges, and the cost of substitute services, even if we were told such loss was possible.
  2. The exclusion above includes, without limit, loss caused by an action, plan, deploy, or shell session you or your users approved or requested; a change that could not be undone; a safety copy that was not taken or did not restore; a savings estimate that was not achieved; a monitor that did not alert or a finding that was missed; a suspension; AI output or generated code; a subprocessor; and any interruption or loss of the Service or of your data.
  3. A total exclusion of liability may not be enforceable in some jurisdictions. Where the law does not allow the exclusion above, DevInSec’s total liability for all claims together, however arising, is limited to the fees you paid to DevInSec for the Service in the three months before the event that gave rise to the first claim. For an organization on the Free plan, in a trial, or on a plan granted by code, that amount is zero.
  4. Nothing in these terms excludes or limits a liability that cannot be excluded or limited by the law that applies, or your obligation to pay fees and to indemnify us under section 9.

9. Indemnification

You will defend, indemnify, and hold harmless DevInSec and its directors, employees, and contractors from every claim, demand, loss, liability, cost, and expense (including reasonable legal fees) arising out of or relating to: your customer data and the accounts, repositories, clusters, and computers you connect; any action, plan, deploy, shell session, or pull request you or your users approved or requested; installing the device reporter on any computer, including a failure to tell the people who use it or to have a lawful basis for monitoring them; a breach of these terms or of the law by you or your users; and any other use of the Service under your organization. We will tell you about such a claim and let you control its defence, and we may take part at our own cost. DevInSec gives you no indemnity of any kind.

10. Term, suspension, and termination

  1. These terms apply from the day you create an account until your organization is deleted or your account is erased.
  2. You may stop using the Service at any time. You can end our access to your cloud without us, by deleting the roles or setup stacks you installed, uninstalling the Kubernetes agent, uninstalling our GitHub App, or removing a device.
  3. Either party may terminate for material breach that is not fixed within 15 days of written notice.
  4. Deleting your account. Any user can erase their own account from the account page, unless they are the only owner of an organization. See the privacy policy for what that removes and what stays.
  5. Deleting an organization. An organization is deleted by our staff on request, not from a button in the product. Write to hello@marshalcloud.com. Deletion cancels any Stripe subscription immediately, erases the organization’s records from our primary database, deletes its billing, usage, and uptime rows from our analytics store, clears its cached data, and deletes the files its build runs left in our storage. Each of those steps reports cleared or not cleared and a failed step is retried once; the report names any step that did not clear. The privacy policy lists what remains afterwards, including backups.
  6. Sections on intellectual property, disclaimers, liability, indemnification, and governing law survive termination.

11. Confidentiality

Each party will protect the other’s non-public information with at least reasonable care, use it only for this agreement, and share it only with people and subprocessors who need it and are under similar obligations. This does not cover information that is public, already known, independently developed, or lawfully received from someone else, and it does not prevent a disclosure required by law where notice is given if allowed.

12. Governing law and disputes

These terms, and any dispute arising out of or relating to them or to the Service, are governed exclusively by the laws of Nepal, without regard to its conflict of law rules. The courts at Kathmandu, Nepal have exclusive jurisdiction over every such dispute, and each party submits to that jurisdiction and waives any objection to it. There is no arbitration. If the law where you are gives you a right that a contract cannot take away, that right is not affected by this section.

13. Changes to these terms

We may update these terms. If a change materially reduces your rights or increases your obligations, we will give at least 30 days’ notice by email to your organization’s owners. Continuing to use the Service after the change takes effect means you accept it. If you do not accept it, stop using the Service and ask us to delete your organization.

14. General

  • Whole agreement. These terms, the privacy policy, and the data processing addendum are the whole agreement between us on this subject.
  • Assignment. Neither party may assign this agreement without the other’s consent, except to a successor in a merger or sale of substantially all assets.
  • Severability. If a clause is unenforceable, the rest stays in force.
  • No waiver. Not enforcing a right once does not waive it.
  • Notices. We will contact you at the email addresses of your organization’s owners. Notices to us are given by email only, to hello@marshalcloud.com, which is also our address for privacy requests and security reports.
  • Force majeure. Neither party is liable for a delay caused by events outside its reasonable control, other than a failure to pay.

Questions about these documents, privacy requests, legal notices and security reports all go to one monitored inbox: hello@marshalcloud.com.