Terms of Service

1. Agreement

These Terms of Service ("Terms") form a binding agreement between you ("Customer") and ShiftLeft AS, a Norwegian limited company ("ShiftLeft"). By creating an account or using the ShiftLeft MCP Gateway service ("Service"), you accept these Terms in full.

If you are accepting on behalf of a company or other legal entity, you represent that you have authority to bind that entity.

2. The service

ShiftLeft provides an MCP (Model Context Protocol) policy enforcement layer that sits between AI agents and MCP servers. The Service evaluates each tool call against your configured policies and produces a structured audit log of all decisions.

ShiftLeft operates entirely on your infrastructure: the gateway binary runs on machines you control. ShiftLeft-hosted infrastructure manages your account, license state, policy configuration, and audit log storage.

3. Plans and pricing

Free plan

The Free plan is available at no charge and includes a limited number of managed MCP servers and policy evaluations per month as shown on the pricing page. Free plan limits may change with 30 days' notice.

Pro plan

The Pro plan is a paid monthly subscription that unlocks higher server and evaluation limits. Current pricing is shown on the pricing page.

Subscriptions renew automatically each billing period. You may cancel at any time from your dashboard; access continues until the end of the paid period with no prorated refund.

All payments are processed by Stripe. By subscribing you also agree to Stripe's terms.

Overages

If your usage exceeds your plan limits, the gateway will continue to evaluate tool calls but policy enforcement may fall back to the default-deny posture for limits that are capacity-based. We will notify you by email before enforcing hard limits.

4. Acceptable use

You must not use the Service to:

• Violate any applicable law or regulation.
• Circumvent, test, or probe security controls of systems you do not own.
• Resell access to the Service without written permission.
• Attempt to reverse-engineer, decompile, or extract the source code of the ShiftLeft-hosted components.
• Generate excessive load that degrades service availability for other customers.

We reserve the right to suspend accounts that violate these rules without prior notice.

5. Your data

You retain ownership of all data you submit to the Service, including audit log contents and policy configuration. You grant ShiftLeft a limited licence to store and process that data solely to provide the Service.

On account termination, your data is deleted within 30 days except where we are required to retain it by law (e.g., billing records under Norwegian accounting law).

How we handle personal data is described in our Privacy Policy.

6. Availability and support

We aim for high availability but do not guarantee a specific uptime percentage. Planned maintenance will be announced with reasonable advance notice. Unplanned downtime will be communicated via the status page.

Support is provided on a best-effort basis by email for Free plan customers. Pro plan customers receive prioritised email support with a target first-response time of one business day.

7. Intellectual property

ShiftLeft retains all rights to the Service, including the gateway software, hosted infrastructure, and documentation. Nothing in these Terms transfers ownership of any ShiftLeft intellectual property to you.

The ShiftLeft MCP Gateway client binary is distributed under the terms described in its software licence. Your right to use it is contingent on compliance with these Terms and an active account in good standing.

8. Limitation of liability

To the maximum extent permitted by Norwegian law, ShiftLeft's total liability for any claim arising from these Terms or the Service is limited to the amount you paid us in the three months preceding the claim.

ShiftLeft is not liable for indirect, consequential, or incidental damages, loss of profits, or data loss, even if we have been advised of the possibility.

These limitations do not apply to liability arising from gross negligence, wilful misconduct, or where mandatory consumer protection law prohibits such exclusions.

9. Changes to the Service and Terms

We may update these Terms or change the Service with 30 days' notice delivered by email or posted on this page. Continued use after the effective date constitutes acceptance. For material changes that reduce the value of a paid subscription, you may cancel within 30 days of the notice for a prorated refund of the unused period.

10. Termination

Either party may terminate the agreement at any time. You may close your account from the dashboard. We may suspend or terminate accounts for violations of these Terms, non-payment, or where required by law.

Provisions that by their nature should survive termination — including intellectual property, limitation of liability, and governing law — will do so.

11. Governing law and disputes

These Terms are governed by Norwegian law (norsk rett). Any dispute that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of Oslo tingrett (Oslo District Court) as the venue of first instance.

If you are a consumer resident in the EEA, mandatory consumer protection rules in your country of residence apply regardless of the above choice of law.

12. Contact

Questions about these Terms: legal@shiftleft.no