Terms of Service

Effective date: 2 October 2026

These Terms of Service govern access to and use of Enji Guard purchased through this website. They are written for teams and individuals who buy credits online and use Enji Guard to audit AI-written code and related software delivery risks.

1. Who you are contracting with

Enji AI LLC provides the Service, and these Terms are your agreement with us. We develop and operate Enji Guard (“the Service”) and provide all product support. We are a limited liability company registered in the Kyrgyz Republic, taxpayer identification number 01907202310418, registered address 11 microdistrict, 14/4, Bishkek City, Kyrgyz Republic, 720049. You can reach us at contact@enji.ai or by telephone on +996 555 42 90 55. Throughout these Terms, “we”, “us” and “our” mean Enji AI LLC.

Freemius, Inc. (“Freemius”) sells you the credits. It is our authorised reseller and the merchant of record for every purchase: it takes your payment, handles tax, and issues your receipt. The charge on your card statement reads Enji Guard.

When you buy, you also accept two documents that Freemius publishes for this product:

• Terms & Conditions of Sale
• End User Licence Agreement

They are Freemius’s documents, not ours. These Terms govern your use of the Service and what it produces for you; Freemius’s documents govern the purchase. Section 24 says how they fit together.

2. What these Terms cover

These Terms cover self-service purchases made on this website: you buy credits by card, and you spend them on audits.

They do not cover enterprise agreements, private or self-hosted deployments, implementation services, or purchases made by invoice or bank transfer. Those run on a separately negotiated, signed agreement. If you have signed such an agreement, it governs your use and it overrides these Terms wherever the two differ.

3. Demo access

New accounts get a demo allowance: you can run each of the audit types included in the demo once, at no charge, so you can see what the Service produces before buying anything.

The demo allowance is per account. You may not create additional accounts, organisations, or identities to obtain further demo runs. Which audit types are included in the demo, and the size of the allowance, are described on our pricing page and may change at any time.

Demo runs produce real reports, and section 13 applies to them in the same way as to paid runs. Once your demo allowance is used, you need to buy credits to continue.

The demo is provided as-is and creates no entitlement to continued free access.

4. The Service

Enji Guard provides AI-code audit workflows, reports, runbooks, and related software designed to help teams identify security, maintainability, testing, dependency, and production-readiness risks in software projects.

5. Who may buy

You must be at least 18 years old and able to enter into a contract. You may buy as an individual or on behalf of an organisation. If you buy on behalf of a company, agency, client, or other organisation, you confirm that you are authorised to accept these Terms for it, and “you” means both you and that organisation.

6. Authority to use

You may connect, audit, or test only repositories, organisations, projects, websites, domains, and systems that you own or have permission to use for these purposes.

7. Credits

What a credit is. Credits are prepaid units you buy in advance and spend on audit runs. One credit buys 1 US dollar’s worth of Enji Guard.

Credits are not electronic money and not a stored-value instrument: they can be redeemed only against the Service, they cannot be transferred to another account, and they cannot be exchanged for cash except where the law requires it or where these Terms expressly provide for a refund.

Buying credits. Credits are sold in packs. The available packs and their prices, are on our price list.

There is no subscription, no recurring charge, and no automatic top-up — when your balance runs out, you buy more if and when you want to. We will not store a payment mandate to charge you again without a new purchase.

What audits cost. Each audit type costs a fixed number of credits, published on our price list. The price list is part of these Terms. The price that binds is the one shown when you bought; credits already in your balance are never revalued by a later change; and we keep previous versions of the price list — ask and we will send you the one in force on any date.

The cost of a run is shown to you before you start it. New audit types are added to the price list from time to time.

How credits are spent. When you start a run, the credits it costs are reserved from your balance and are deducted when the run completes. If you have bought credits more than once, the credits closest to expiring are spent first, so that nothing expires unnecessarily. A run cannot start if your balance is below its cost — there is no overdraft and no post-paid billing. Your balance never goes below zero, in any circumstance, including the reversals in sections 10 and 21.

If a run does not complete. If an audit run fails, or we stop one at your request, the reserved credits are returned to your balance and are treated as unspent. You cannot stop a run yourself once it has started — there is no control for it in the product, which is why the cost is shown before you start one. We can stop one if you ask us by email, on the terms in Authorized Testing.

If your balance is empty. Your account stays open. You keep access to everything you have already produced — your reports, findings, and audit history remain visible and exportable — and you can top up credits at any time to start running audits again. An empty balance stops new runs; it does not close your account or take anything away from you.

Expiry. Credits expire 12 months after you buy them. Expired credits are not refundable and are not reinstated.

We warn you before they expire. We email the address on your account at least 30 days before any credits expire, telling you how many and when. If credits expire and that warning did not reach you, tell us and we will reinstate the time you lost.

8. Changes to the price list

We may add new audit types, withdraw audit types, and change the number of credits an audit type costs.

Changes that do not disadvantage you take effect immediately. Adding a new audit type, or reducing the number of credits an audit costs, needs no notice.

Increases take effect after 30 days’ notice. If we increase the number of credits an existing audit type costs, we will tell you at least 30 days before the change takes effect. If you do not accept the increase, you may ask us to refund your unspent credits, provided you ask within 14 days of the change taking effect. This right applies however long ago you bought the credits — the 30-day limit in section 10 does not apply to it.

Withdrawing an audit type takes 30 days’ notice too. If we stop offering an audit type you can currently run, we will tell you at least 30 days beforehand. If you were holding credits for it, you may ask us to refund your unspent credits, provided you ask within 14 days of the withdrawal taking effect — however long ago you bought them, as with an increase. Retiring an audit type that has been replaced by a direct successor you can run instead is not a withdrawal for this purpose.

A change to the price list never reduces the number of credits already in your balance, and never changes what you have already paid.

9. Prices, taxes and payment

Tax is charged on top. A credit costs 1 US dollar before tax. Prices are shown exclusive of VAT, sales tax, and equivalent taxes. Where tax applies, it is calculated from your country at the rate in force on the day you buy, added at checkout, and the total including tax is shown to you before you pay.

Tax is handled by Freemius. Freemius determines the tax for your location, collects it, and remits it to the relevant authority. We do not calculate or collect tax.

Currency. Credits are priced and charged in US dollars. Each credit pays for 1 US dollar of the Service at our listed prices, wherever you are and whatever tax you paid on it. Refunds are made in US dollars too. If your card or account is in another currency, your bank or card issuer converts the amount at its own rate, so a refund may differ slightly in your currency from what you paid.

Payment. Payments are taken by Freemius. Your card details never reach us — they go directly to Freemius, and Security & Trust sets out what our own systems hold against your account. Your purchase is complete, and your credits are added to your balance, when Freemius confirms the payment. If a payment is later reversed or charged back, we may remove the credits it paid for — see section 10.

Invoices. Freemius issues your receipt or invoice, in its own name as the seller. It is sent to you by email and is also available through Freemius.

10. Refunds and cancellation

You can ask for a refund within 30 days of buying. After 30 days a purchase is no longer refundable, though the credits remain usable until they expire 12 months after purchase — see section 7. Section 11 lists the situations where this 30-day limit does not apply.

Unspent credits only. We refund the credits you have not spent. Credits already spent on a completed audit run are not refundable, because the audit was performed.

We refund your whole remaining balance, not part of it. There are no partial refunds — if you ask for a refund, every refundable unspent credit in your balance is refunded.

Tax is Freemius’s to work out. Our prices are exclusive of tax and Freemius calculates and collects it, so Freemius also works out how much of the tax comes back with a refund. We do not hold the figure and cannot quote it to you.

How to ask. Contact contact@enji.ai from the email address on your account. We work out what is refundable from your balance and issue the refund through Freemius, which returns it to your original payment method.

How long it takes. We issue your refund through Freemius within 5 business days of your request. After that it is the payment network’s timing rather than ours: your bank or card issuer takes a few more working days to show the credit.

One limit comes from the card networks. Refunds go back to the card you paid with, and that is only possible for a limited period after the payment.

If a refund happens, the credits go with it. Whenever a payment is reversed — a refund we issued, a refund Freemius granted at its own discretion, or a successful chargeback through your bank — the credits that payment bought are removed from your balance. You cannot keep both the credits and the money. If those credits have already been spent on completed audits, we may set your balance to zero and pause new runs until it is resolved.

If a refund cannot reach your original payment method — the network’s window has closed, the card is closed, a transfer is rejected — that does not extinguish what you are owed. Tell us and we will agree another way to pay it.

If you are a consumer. If you bought as an individual rather than for a business, you may have a statutory right to cancel a digital purchase within 14 days. Nothing in these Terms removes that right or any other right you have under the law of your country of residence that cannot be excluded by agreement. Where such a right applies, we will honour it. Note that by starting an audit run you are asking us to begin performing immediately, and to the extent the law allows, credits spent on a completed run are not refundable even within that period.

Deleting your account. You can delete your account yourself, together with its data and audit results, and we can do it for you if you ask. Deletion is permanent — there is no recovery window and no undo. It removes what belonged to your account alone; a project with other authorised owners stays with them. It does not by itself create a refund right: purchases made within the last 30 days are refunded as above, and older ones are not. What survives and why is on the Data Retention & Deletion page.

Export first. You can export your reports and audit history at any time while your account is open. Once the account is deleted there is nothing left to export.

11. When the 30-day limit does not apply

The 30-day limit covers refunds you ask for because you changed your mind. It does not apply where the reason for the refund is something we did. In each of the following, we refund all your unspent credits however long ago you bought them:

• We increase what an audit costs and you do not accept the increase — section 8.
• We withdraw an audit type you can currently run and you ask within 14 days of the withdrawal taking effect — section 8.
• We discontinue the Service or a material part of it — section 20.
• We suspend or close your account for a reason other than your breach of these Terms — section 21.
• We materially change these Terms to your disadvantage and you do not accept the change — section 26.
• You object to a new sub-processor on reasonable data protection grounds and we cannot resolve it — Data Processing Agreement section 5.
• We materially reduce your protection under the Data Processing Agreement and you do not accept the change — DPA section 11. The DPA forms part of these Terms, so a material change to it is also a material change to them.

12. Your content and code

You retain ownership of your code, repositories, project data, credentials, policies, and other materials you provide to the Service.

The licence you give us. You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, transmit, display and process your content for these purposes and no others:

• running the audits and workflows you start, and producing reports and findings from them;
• sending selected task context to the AI providers named on the Subprocessors page;
• storing your reports and audit history so you can use them;
• emailing you notifications of results, which carry a summary of what a run found;
• helping you when you ask for support, and troubleshooting failures;
• keeping the Service secure, reliable and free of abuse.

It does not let us sell your content, share it outside those purposes, use it for advertising, train Enji-owned models on it, or use it to build features unrelated to serving you. The licence lasts as long as we hold the content and ends when it is deleted.

You are responsible for removing or limiting access to data that should not be submitted to the Service.

13. Output the Service generates

The Service generates reports, findings, proposed changes, pull-request branches, comments, and similar output for you.

We do not claim it. We make no claim of ownership over the output the Service generates for you, and to the extent any rights in it arise for us, they are yours. You may use, modify, publish, and distribute that output without restriction and without needing our permission. We will not assert any right in it against you or anyone you give it to.

Publishing it through the Service is your decision. Enji Guard gives you two controls for making results public, and nothing is public unless you turn one on:

• a public project view — the project owner picks which repositories appear, and we generate a read-only link. It exposes those repositories’ names, audit reports, history, recon context and activity;
• a public link for a finished repository summary, chosen when the summary is generated or switched on later.

The two are independent, and both can be made private, revoked, or deleted at any time.

Look at what is in a report before you publish it. Reports can contain file paths, code snippets, diffs, observed responses, and details of weaknesses that have not been fixed yet. Publishing is a disclosure decision about your own code and your own security posture, and it is yours to make — we do not review it, and we do not publish anything on our own initiative. If a report contains someone else’s personal data, publishing it is your act as the controller of that data, not ours.

Revoking a link does not undo a disclosure. Making a page private, revoking it, or deleting the report stops future access through our link. It cannot retrieve anything that was downloaded, copied, cached, or screenshotted while the link was live. Treat a published report as published.

Auto-pentest reports deserve particular care — see Authorized Testing for why, and do not publish one unless you have the authority to disclose the target and its weaknesses.

We keep a licence to run the Service. The licence in section 12 covers the output as well as the content you provide — same terms, same purposes, and no others. See the AI Data Use page for what we do and do not do with customer content.

We do not warrant that the output is original or free of third-party rights. Output is produced by AI, and AI can generate material that resembles or reproduces work belonging to someone else. We do not represent that output is original, that it does not infringe anyone’s copyright, patent, or other rights, or that you are free to use it in any particular way. Review generated code and findings before you use them, exactly as you would review a contribution from any outside source. Section 15 applies to output in full.

Owning the output does not oblige us to keep it. Nothing in this section requires us to store your output indefinitely or to keep it available to you after your account closes. Retention is described on the Data Retention & Deletion page, and you can export your reports at any time while your account is open.

None of this gives you rights in the Service. You get no rights in Enji Guard itself, in the software that produced the output, or in anything we create independently of your use.

14. Security and credentials

You are responsible for protecting your account access, API keys, repository permissions, deployment credentials, and administrative users.

Do not submit production secrets, regulated personal data, or client-confidential materials unless the relevant deployment, permissions, and contractual safeguards are in place.

If you believe your account, keys, or deployment have been compromised, notify us promptly so we can help reduce risk.

15. AI and automation

Enji Guard relies on AI and automated agents. Their output can be incomplete, inaccurate, unsafe, or outdated, and should not be treated as a substitute for professional engineering, security, legal, or compliance judgment. It may also resemble or reproduce material belonging to someone else — see section 13.

You remain responsible for reviewing findings, validating fixes, testing changes, approving releases, and complying with laws, contracts, and security requirements.

The Service never merges pull requests and never deploys code. Not by default, not as an option, not with a setting. Everything it proposes waits for a person.

16. Connecting your repositories

You can connect repositories from GitHub or GitLab. How you grant access differs by provider.

GitHub — through an app. Enji Guard connects through a GitHub App, named Enji Guard on GitHub. You choose which repositories it can reach, and its permissions are declared upfront and shown to you before you install. The app belongs to no individual, so it does not stop working when someone leaves your team. See GitHub App Permissions.

GitLab — through a token you create. GitLab has no equivalent app installation, so you create an access token in GitLab and give it to us. What we can reach is whatever that token can reach, so the scope is set by the token you issue rather than by a list you tick. We store it encrypted, use it only to run the audits you ask for, and delete our copy when you disconnect. You can revoke it at any time in GitLab, which cuts off access immediately. Use a service account or a project or group token rather than your own personal account, and see GitLab Access for the scopes involved and for the webhooks Enji Guard adds to your projects.

Either way, Enji Guard may read code and metadata to run audits and, where enabled, open issues, open merge or pull requests with proposed changes and the branches behind them, and comment on them.

Having permission to write is not the same as writing. Audits do not write to your code — they read it. Code review posts only its own reply.

Enji Guard is told when an issue, comment or merge/pull request changes, instead of polling you. On GitHub that needs no change to your repository: event subscriptions belong to the GitHub App, and GitHub delivers them to it. On GitLab, where you give us sufficient authority, Enji Guard creates webhooks in your project settings — a write to your project configuration rather than to your code, made at connection time rather than per audit. Details: GitHub App Permissions and GitLab Access.

Anything that proposes a change requires the write mode to be enabled for that workflow and must pass the safety checks built into it, and Auto-pentest needs its own separate consent on top of repository access.

Enji Guard does not merge or deploy code, does not reach repositories you have not connected, and does not use your repository access for unrelated accounts. One qualification on the second of those: GitHub grants any installed app read access to an account’s public repositories, whichever ones you selected. We do not audit or act on them, but the access exists — see GitHub App Permissions.

What we commit, and where. We do write commits, but only to branches we create for a change we are proposing, and only where you have enabled that workflow. We never write to a branch you already have — not your default branch, not your feature branches. A proposed change arrives as a new branch and a pull or merge request, and it stays there until you act on it. A human always reviews and merges — we never merge for you.

17. Authorized testing

Some features run active checks against websites, APIs, and web resources (for example, runtime checks and Auto-pentest). Active checks run only with your explicit consent and only against targets you own or are authorised to test.

By enabling active checks, you confirm that you have authority over the target, that your organisation and hosting providers permit the testing, and that the target is in scope. Prohibited testing includes denial-of-service or load testing, credential attacks, data exfiltration, malware or destructive payloads, and scanning unrelated or out-of-scope systems.

Active checks can produce temporary errors, higher request volume, or security alerts on the target. See the Authorized Testing page for the full conditions.

18. No security guarantee

Enji Guard reports are decision-support tools. They are not a guarantee that software is secure, compliant, defect-free, or production-ready.

The Service may produce false positives, false negatives, incomplete findings, or recommendations that require engineering judgment before implementation. You remain responsible for your security, compliance, and release decisions.

19. Acceptable use

You may not use Enji Guard to attack systems, evade security controls, extract third-party secrets, violate laws, infringe rights, or process data you are not authorised to access.

You may not misuse agents or prompts to cause unauthorised actions, run unauthorised scanning, violate a provider’s terms, interfere with the Service, bypass rate limits, reverse engineer hosted components except where allowed by law, or use the Service to build a competing product from confidential or non-public features.

You may not buy credits for the purpose of reselling them, and you may not transfer credits between unrelated accounts.

You are responsible for your use of the Service. To the extent permitted by law, you will defend and indemnify us against third-party claims, losses, and expenses arising from your use of the Service in breach of these Terms — including active testing or data submission you were not authorised to perform. If you are a consumer, this paragraph applies only to the extent the law allows.

20. Availability and changes

We may improve, modify, suspend, or discontinue parts of the Service. We aim to avoid unnecessary disruption, but we do not offer an uptime commitment or service credits on self-service purchases, and we do not promise uninterrupted or error-free operation. Scheduled audits and recurring checks run on a best-effort basis.

If we discontinue the Service or a material part of it, we will tell you at least 30 days beforehand and refund all your unspent credits, however long ago you bought them.

Uptime commitments, support response targets, and service credits are available under enterprise agreements. See section 2.

21. Suspension and termination

We may pause, suspend, or limit access to protect the Service or others — for example, in cases of abuse, suspected compromise, risk to a provider limit, legal or security risk, fraud, or violation of these Terms.

On chargebacks specifically. Disputing a charge with your bank is your right and we will not suspend you for using it. What we may act on is a pattern — repeated disputes of charges for audits that ran, or disputes raised without ever contacting us. If a payment is reversed, the credits it bought come off your balance; if they are already spent, section 10 applies — the balance is set to zero and new runs pause until it is resolved.

If we suspend or close your account for a reason other than your breach of these Terms, we refund all your unspent credits, however long ago you bought them.

If we close it because you breached these Terms, we may withhold unspent credits. We will write to you setting out what we say you did and what we are withholding. You have 14 days to reply, and a person who was not involved in the decision reviews it. We will only withhold an amount proportionate to the breach and to any loss it caused us. Your statutory rights are unaffected, and nothing here lets us withhold where the law says we may not.

22. Disclaimers and liability

To the maximum extent permitted by law, the Service is provided without warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted operation.

To the maximum extent permitted by law, we will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost revenue, loss of data, business interruption, or security incidents not directly caused by our breach of a written obligation.

To the maximum extent permitted by law, our total liability to you arising out of or in connection with these Terms and the Service is limited to the greater of the amount you paid for credits in the 12 months before the event giving rise to the claim.

Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited. If you are a consumer, nothing in this section affects your statutory rights.

This section is also subject to the three exceptions in DPA section 11, which override it: liability to data subjects under Clause 12 of the Standard Contractual Clauses, statutory liability under Article 82 GDPR, and regulatory fines or enforcement directed at us.

23. Enterprise and signed agreements

Our Data Processing Agreement forms part of these Terms and applies where we process personal data on your behalf. You accept it when you accept these Terms.

Signed customer-specific agreements may contain additional or different terms, including data processing terms, service levels, governing law, and dispute resolution. Section 2 sets out which of the two governs where they differ.

24. General terms

Severability. If a court finds part of these Terms unenforceable, the rest stays in force and that part applies as narrowly as the law allows.

No waiver. A delay in enforcing a term is not a waiver of it.

Entire agreement, and what sits alongside it. These Terms, the pages they link to, the DPA and the published price list are our whole agreement with you, and they replace anything said beforehand. Nothing here limits liability for fraudulent misrepresentation.

What survives the end. Sections on your content and output, acceptable use and the indemnity that goes with it (section 19), disclaimers and liability, governing law, these clauses, and any payment obligation already due continue after the Terms end, along with the DPA’s deletion obligations until they are performed.

Notices. We write to the email address on your account, and a notice counts as received the next business day. Write to us at contact@enji.ai. Keep your address current: a notice sent to an address that no longer works is still a notice.

Assignment and change of control. You may not transfer these Terms without our consent. We may transfer them to a group company or to a buyer of the business, and if that happens we will tell you. If you do not wish to continue with the transferee, ask and we will refund your unspent credits in full, whenever you bought them.

No third-party rights. Nobody who is not a party may enforce these Terms under the Contracts (Rights of Third Parties) Act 1999. Data subjects’ rights under the DPA and the Standard Contractual Clauses are not affected by this and are expressly preserved.

Things outside anyone’s control. Neither of us is liable for failing to perform because of something genuinely beyond our control — infrastructure or provider outages, network failures, natural events, war, or new legal restrictions. This does not excuse paying money that is owed, and if such an event stops us providing the Service for a sustained period you may end the Terms and take a refund of your unspent credits.

Sanctions and export control. We are a Kyrgyz company using United States AI providers and selling worldwide. You confirm you are not subject to sanctions that would prohibit us dealing with you, and that you will not use the Service where sanctions or export-control law forbids it. If the law stops us serving you, we will say so and refund your unspent credits rather than keep the money and stop the service.

25. Governing law and disputes

These Terms are governed by the laws of England and Wales. They do not govern the purchase. Your purchase is from Freemius Inc — one company for every buyer, wherever you are — and Freemius’s Terms & Conditions of Sale govern it under the law of the State of New York. Those terms also send most disputes with Freemius to arbitration, in New York City or Tel Aviv-Jaffa depending on where you live, with small claims court still open to you. See the Imprint.

If you are buying for a business, the courts of England and Wales have exclusive jurisdiction.

If you are a consumer, that exclusive jurisdiction does not apply to you. You keep the protection of the mandatory law of the country you live in, and you can bring a claim in your own local courts. We may only bring one there too. Nothing in these Terms removes a right you have where you live.

Online dispute resolution. If you are a consumer in the European Union and we cannot settle something between us, you may use an approved alternative dispute resolution body in your country. We are not currently signed up to a particular ADR scheme. You are free to use one, and we will engage with it.

If something goes wrong, please contact contact@enji.ai first — most issues are resolved faster that way than through a formal dispute.

26. Changes to these Terms

We may update these Terms as the product, deployments, or legal requirements change. The updated version is posted here with a new effective date.

Every notice period we owe you, in one place:

What counts as material: anything that reduces what you get, increases what you pay or owe, narrows your rights, shortens a deadline in your favour, widens what we may do with your content, or adds a recipient for it. If we are unsure, we treat it as material.

Continued use after an update means you accept the revised Terms. If you do not accept a material change, stop using the Service and ask us — you get all your unspent credits back.