1. Who you are contracting with

Borehole is operated by AELaboratories, a business registered in the United States. Contact: support@borehole.dev. In these terms, "we" and "us" mean AELaboratories, and "you" means the person or organisation using the service.

2. What the service is

Borehole surveys a git repository and reports what it found, with evidence. We read a public repository ourselves. A private repository is read by the Borehole collector on your own systems, which sends us facts about it and never its source (section 5). Every finding carries a commit, a path or a line range that you can check yourself. Every check that ran and did not fire is published in the rejection log, with the numbers it observed.

3. What the service is not

This matters more than anything else on this page, so it is stated plainly rather than buried.

• It is not advice. A report is a set of observations about a codebase. It is not legal, financial, investment or security advice, and nothing in it is a recommendation to buy, sell, invest in, acquire or decline anything.
• It is not a security audit. Some checks look at security-adjacent facts. A clean report is not a statement that a codebase is secure, and must not be presented as one.
• It is not a substitute for professional diligence. It is a tool that makes a human's diligence faster and better informed. A repository answers roughly three and a half of seven dimensions; the report says which ones it could not answer and what a human would have to ask instead.
• It can be wrong. Every threshold is a judgement. Findings can be false positives, and an absence of findings is not proof of absence. The evidence is published precisely so you can check rather than trust.

You are responsible for any decision you make. If a decision matters, have a person who is accountable for it read the evidence.

4. Repositories you may submit

You may submit a repository only if you have the right to do so — because it is public, because you own it, or because its owner has authorised you. You must not use the service to survey a repository you obtained without permission.

Public repositories are surveyed from publicly available data. If you control a repository and would rather its report were not listed, you can delist it after proving control through GitHub, and you can write to takedown@borehole.dev.

To survey a public repository we clone it onto our infrastructure. The copy is deleted when the survey ends, including when it fails.

5. Private repositories

We never receive, clone or store the source code of a private repository. It is surveyed by the Borehole collector, which you run on your own systems:

• The collector reads the repository where it is and sends us a bundle of facts: commit metadata, file paths, where each detection pattern matched with a short excerpt of the matched text, and counts. File contents are not sent. A credential-shaped match, in the files or anywhere in the history, is sent as its location and kind only, never its text.
• Author names and email addresses are hashed on your machine before the bundle is sent. The hashes are pseudonyms: they let us count authors without receiving their names or addresses.
• You can read the entire bundle before anything is sent, by running the collector with --dry-run.
• We use the bundle to produce your report and do not store it. What we store is the report.
• No source content, and nothing from the bundle, is sent to any language model.
• A private report is not listed, does not generate a shareable card or badge, and is readable only by the account that bought it, by anybody GitHub says controls the repository, and by anyone holding a share link you chose to create.
• A share link makes the report readable by anyone who has it, with no sign-in. You choose whether one exists and you can revoke it.

Your code remains yours. We never receive it, and we claim no right to the facts the collector sends beyond producing the report you asked for.

6. Payment

Prices are shown on the pricing page and are what you pay. Payment is taken through Stripe; we never see or store your card details. A purchase grants an entitlement of one of two kinds. A Report or Raise-Ready key allows unlimited surveys of any repositories for 30 days, counted from the first survey it runs. A pack allows a counted number of surveys and does not expire.

A use is consumed only when a finished, complete report is produced. If a survey fails, or produces a partial report because the repository is larger than a survey can read in full, the use stays on your entitlement and you can run it again. A 30-day key whose first survey fails has not started its 30 days.

The email containing your entitlement key is the only copy we send. If it does not arrive, write to billing@borehole.dev and we will re-send it.

7. Refunds

A survey that does not produce a complete report does not consume a use (section 6), so there is nothing to refund for it. If a report you received is not what was described, write to billing@borehole.dev and we will refund it. We would rather refund a disappointed buyer than argue with one.

Where you are an EU consumer, your statutory right of withdrawal applies. Because a survey is delivered immediately, starting one is a request for immediate performance; once a report has been produced the service has been supplied.

8. Availability

The service is provided as it is. We do not promise it will be available without interruption. /status reports what is actually working at any moment, and it is designed to be able to say no.

9. Liability

To the extent the law allows, our total liability for any claim arising out of the service is limited to the amount you paid us for it in the twelve months before the claim. We are not liable for indirect or consequential loss, including lost profit or lost opportunity arising from a transaction you did or did not complete.

Nothing here limits liability for fraud, for death or personal injury caused by negligence, or for anything else that cannot be limited by law.

10. Verification marks

A report may carry a Borehole Official Analysis code. The code resolves to the report we actually issued, and it commits to the checks that ran at the time. It is not a certification, an endorsement or a rating, and it does not cover checks written after it was issued — the verification page says so when the two differ.

11. Acceptable use

Do not attempt to defeat quotas, probe for other people's private reports, or use the service to build a competing assessment product. Do not present a report as something it is not, including as a security certification or as our endorsement.

12. The detection ruleset

Where you run the Borehole collector on your own machine, it receives a detection ruleset for that run. The ruleset is unpublished proprietary work product, licensed to your account, provided in confidence, and not sold to you.

You may use it to survey repositories your account is entitled to survey. You may not copy it, publish it, disclose it to anyone else, or use it to build or improve a competing product. These restrictions survive the end of your account.

Every copy is individually marked. A ruleset found outside the account it was issued to can be traced back to that account. We say so here, and again in the ruleset itself, so that nobody can be surprised by it later.

13. Changes and termination

We may change these terms. A material change will be noted here with a new version and date, and we will not apply it retroactively to a purchase you have already made. You may stop using the service at any time. We may suspend access that is abusive or unlawful.

14. Governing law

Pending legal review. AELaboratories is registered in the United States, the infrastructure is in the EU, and buyers are expected in both. Choosing a forum here without advice would be a guess, and a guess that appears in a contract is worse than an honest gap.

15. Contact

General: support@borehole.dev
Billing: billing@borehole.dev
Takedown: takedown@borehole.dev

See also the Privacy Policy.