Terms of Service

1. Introduction

These Terms of Service ("Terms") govern your use of the website at soracin.com ("Site") and the Soracin application at app.soracin.com ("Service"), offered by Soracin ("we", "our", "us"), operated by its founder from Sri Lanka. By creating an account or using the Service you agree to these Terms. If you do not agree, do not use the Service.

2. The Service

Soracin is a read-only monitoring service. When you connect an account at a supported provider (currently Vercel, Supabase, Netlify, Cloudflare, Neon, Railway, GitHub, GitLab, OpenAI, Amazon Web Services and DigitalOcean), Soracin periodically reads its configuration and billing metadata, evaluates it against security and configuration checks, records changes ("drift"), tracks spend, and sends you alerts and reports.

Soracin does not create, modify, deploy or delete anything in the accounts you connect, and does not read your application data (database rows, stored files, environment variable values, secrets, LLM prompts or completions). The exact permissions used for each provider are listed on our Trust page, which forms part of these Terms.

3. Accounts & Eligibility

You must provide accurate information, keep your sign-in credentials safe, and are responsible for activity under your account. You must be at least 18 years old and able to form a binding contract. You may only connect provider accounts you own or are authorised to connect.

4. Access to Your Provider Accounts

• By connecting an account you authorise Soracin to read it using the credential you grant: read-only OAuth scopes (Vercel, Supabase), a read-only API token (Cloudflare, DigitalOcean), a read-only GitHub App, a read_api-only token (GitLab), a read-only IAM role (AWS), or an admin or API key (OpenAI, Neon, Netlify, Railway).
• OpenAI admin keys and Neon, Netlify and Railway tokens are not read-only by construction: none of these providers offers a read-only key, and such a key can also change your account. Soracin only calls the read endpoints listed on the Trust page, stores the key encrypted, never logs it, and deletes it when you disconnect. You decide whether to provide such a key.
• You can revoke access at any time by disconnecting the source in Soracin and, on the provider side, uninstalling the integration, removing the OAuth app, deleting the IAM role's stack, or deleting the key.
• You remain responsible for the security, configuration and costs of your provider accounts.

5. Plans, Billing & Renewals

Plans are Free, Indie (US$9 per month or US$90 per year) and Pro (US$19 per month or US$190 per year), with the limits described on the Pricing page. Prices are in US dollars; applicable taxes may be added at checkout. Payments are processed by our payment provider, Creem; we never see or store your card number.

• Renewal. Paid plans renew automatically at the end of each monthly or yearly period until cancelled.
• Cancellation. You can cancel at any time in the billing portal. Your paid plan continues until the end of the period you have paid for, then your workspace returns to Free.
• Changes. Upgrades, downgrades and switches between monthly and yearly take effect immediately, with any proration calculated by the payment provider.
• Failed payments. If a renewal payment fails, your plan stays active for a 7-day grace period. After that, Free limits apply and sources beyond them are paused. Your data is not deleted because of a billing problem.
• Refunds. If the Service materially fails to work for you, contact support@soracin.com within 14 days of a charge and we will work with you in good faith on a resolution or refund.

6. The Free Plan

The Free plan is offered at our discretion. To keep it sustainable we may limit the number of active Free workspaces, pause checks for Free workspaces nobody has signed in to for 30 days (they resume when you sign in), and cap the size of what a Free workspace scans. We may change Free plan limits with notice.

7. Your Data

• Data Soracin collects from your connected accounts is kept for your plan's retention period (listed on the Trust page).
• When you disconnect a source, its credential is deleted immediately and its data is deleted 30 days later.
• You can ask us to delete your account and all associated data at any time by emailing support@soracin.com.
• Our Privacy Policy explains how we handle personal data.

8. Alerts, Findings & Spend Figures

Alerts, findings, posture scores, spend figures and estimates are provided for information. They depend on data the providers make available, which can be delayed, incomplete or restated. Checks run at the intervals described on the Site; Soracin may not detect every change or issue, and an alert is not a guarantee that a problem exists. Soracin is not a substitute for the spend limits and security controls your providers offer. References to frameworks such as SOC 2 or ISO 27001 are indicative mappings, not a certification or a statement that you comply with them.

9. Acceptable Use

You agree not to use the Service unlawfully; to connect accounts you are not authorised to access; to point alert webhooks at systems you do not control; to probe, overload or attempt to bypass the Service's security; or to resell the Service without our written consent. We may suspend accounts that misuse the Service.

10. Intellectual Property

The Site, the Service, its checks, written content, design and branding belong to Soracin. You keep all rights in your accounts and their data. We grant you a limited, non-exclusive, non-transferable right to use the Service while your account is active.

11. Disclaimer of Warranties

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted, error-free or detect every issue.

12. Limitation of Liability

To the maximum extent permitted by law, Soracin is not liable for any indirect, incidental, special, consequential or punitive damages, or for charges you incur with your providers, data loss, or downtime of your systems. Our total liability for any claim relating to the Service is limited to the fees you paid to Soracin in the twelve (12) months before the claim.

13. Governing Law

These Terms are governed by the laws of Sri Lanka. Disputes are subject to the exclusive jurisdiction of the courts of Sri Lanka, without prejudice to any mandatory consumer protections in your country of residence.

14. Changes to These Terms

We may update these Terms. Material changes will be emailed to account owners or announced in the Service before they take effect. Continued use after that means you accept the updated Terms.

15. Contact

Questions about these Terms: support@soracin.com.