Terms of Service

These terms are between you and Veristria, a Norwegian aksjeselskap (AS) under incorporation (24 August 2026), based in Norway, which operates KeyDrift. “We” and “us” mean that company; “the service” means keydrift.dev and everything on it.

Using the service means you accept these terms. If you are agreeing for a company, you are confirming you are allowed to.

KeyDrift fetches a page you name and the JavaScript it references, reads them for exposed API keys and secrets, and reports what it finds. A free scan needs no account. Paid plans add scheduled re-scans, more projects and alerting.

It is a bundle scanner. It does not authenticate, does not read your repository, and does not run your code.

By submitting a URL you confirm that you own the site or have permission from the owner to have it scanned. You are responsible for that permission and for the consequences of scanning something you were not entitled to scan.

Our scanner is deliberately narrow — it issues only GET and HEAD requests and reads only what is already served in public — so pointing it at a site is impolite rather than harmful. That is a constraint on us, not a license for you.

We may refuse or stop a scan where we believe this is being broken, and we will cooperate with a site owner who reports unauthorized scanning of their property.

A report generated from a URL can be opened by anyone with the link, names the site scanned, and may be indexed by search engines. This is on purpose: a finding a site owner cannot open is a finding they cannot check.

If you do not want that, use the paste scanner — the pasted text is not stored and the report is private and not indexed — or run the scan from an account. Ask us and we will delete a public report.

Everything you submit stays yours. We claim no ownership over your code, your site or your findings, and the reports we generate are yours to keep, publish and share.

We own the service, the detection rules and the brand. You get a license to use them while your account is in good standing, and nothing more. We may use aggregate, de-identified statistics about scans — rule hit rates, timings, counts — to improve detection.

Sign-in is a magic link, so your email account is your account. Keep it secure, and tell us promptly if you think someone else is in yours. You are responsible for what happens under it. Invite colleagues to your organization rather than sharing one login.

Paid plans are billed through Stripe and renew at the price shown when you subscribed, monthly or annually, until you cancel. Taxes are added where they apply.

Cancel any time from the billing portal in your settings — no email, no retention conversation. Cancelling stops the next renewal; you keep the plan until the end of the period you have paid for, and the account then continues on the free tier with the free tier’s limits. If a price changes we tell you before it applies to you.

Payments are not automatically refundable, but we will not argue with you over a period you did not use. If the product did not work, if you were billed after cancelling, or if you subscribed by mistake and have not used it, email us and we refund it. Where consumer law gives you a right of withdrawal, that applies on top of this.

Do not use the service to:

• scan a site you do not own or have permission to test;
• work around the rate limits, overload our infrastructure, or use the scanner as a relay to reach a third party;
• resell, white-label or redistribute the service, or scrape it to build a competing dataset of findings;
• break the law or infringe anyone else’s rights.

We can suspend an account doing any of this. Where the situation allows, we will tell you first and give you a chance to fix it.

Finding nothing means we found nothing. It is not a certificate, an audit, or a statement that your application is secure. Detection is pattern, entropy and context across a documented set of secret formats: a key assembled at runtime from fragments is not found, code behind a login is not reached, and a partial read is reported as partial rather than dressed up as a pass. The limits are written out in the scanner documentation, and we would rather you read them than trust a green result.

We do not provide legal, financial or compliance advice, and nothing we produce is a compliance certification.

The service is provided as it is, without warranties beyond those the law gives you and does not let us exclude. We work hard on uptime; we do not promise a specific availability level.

If we cause you loss, what we owe is capped at what you paid us in the twelve months before the event — or nothing, if you have paid us nothing. We are not liable for indirect losses: lost profit, lost revenue, lost data, or a breach that a scan did not catch.

This does not limit liability we are not allowed to limit — death or personal injury caused by negligence, fraud, or anything mandatory law reserves. If you are a consumer, your statutory rights come first.

You can stop using the service and delete your account at any time. We can end this agreement with reasonable notice, or immediately if you break the acceptable-use rules. If we end it for our own reasons, we refund the unused part of what you paid.

We update this page as the product changes and move the date at the top with it. For a change that materially affects a paying customer we give notice by email before it takes effect, and you can cancel if you do not accept it.

Norwegian law governs this agreement and the Norwegian courts have jurisdiction. If you are a consumer in the EEA you keep the protection of the mandatory law of the country you live in, and you can bring a claim there.