MergeSignalMERGE SMART.

Terms of Service

Effective Date: March 16, 2026

1. Acceptance of Terms

By accessing or using MergeSignal (the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree to these Terms, do not use the Service.

2. Description of Service

The Service includes:

  • Web-based user interface
  • RESTful API
  • Command-line interface (CLI)
  • GitHub App integration (optional)

3. Our commitments; nature of the Service; warranties and limitations

3.1 How we treat Customer Content

We handle Customer Content (as defined in the Privacy Policy) only to provide, secure, bill for, and improve the Service within the limits stated there. In particular, for the official hosted Service, we do not sell Customer Content to data brokers, and we do not use Customer Content to train generalized machine-learning models for unrelated third parties, as further described in the Privacy Policy.

3.2 Informational analyses (not professional advice)

MergeSignal produces automated upgrade impact findings. That output is informational and decision-support only. It is not legal advice, not a professional penetration test or audit, and not a certification that a system is free of vulnerabilities or fit for any regulated purpose. You remain responsible for how you use outputs, for compliance with your own policies and laws, and for validating material decisions (for example, production releases or incident response).

3.3 No guarantee of specific results

To the maximum extent permitted by applicable law, MergeSignal does not warrant that the Service will be uninterrupted, error-free, or free of harmful components; that it will detect every vulnerability or misconfiguration; or that scores or recommendations will meet any particular business outcome or compliance standard. Third-party data sources (registries, advisories, hosting platforms) may be incomplete, delayed, or incorrect.

3.4 Open-source components

Portions of the software may be distributed under the Apache License, Version 2.0. The warranty disclaimer and limitation of liability in that license apply to those components in the form licensed under Apache 2.0. For hosted Service use, these Terms and the Privacy Policy also apply. If you self-host open-source components, you are responsible for your deployment and for providing appropriate notices to your own users.

3.5 Not legal advice

These Terms and our other policies are not a substitute for advice from qualified legal counsel about your specific obligations, industry, or jurisdiction.

4. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL MERGESIGNAL, ITS OPERATORS, CONTRIBUTORS, OR LICENSORS BE LIABLE FOR ANY:

  • Direct, indirect, incidental, special, consequential, or punitive damages
  • Loss of profits, revenue, data, use, goodwill, or other intangible losses
  • Damages resulting from:
    • Your use or inability to use the Service
    • Unauthorized access to or alteration of your data
    • Any security breaches or vulnerabilities not detected by the Service
    • Any decisions made based on Service outputs
    • Any third-party content or conduct on the Service

This limitation applies whether the liability is based on contract, tort (including negligence), strict liability, or any other legal theory, even if advised of the possibility of such damages.

Some jurisdictions do not allow certain exclusions or caps; in those cases our liability is limited to the fullest extent permitted by law. Nothing in these Terms is intended to exclude liability that cannot legally be excluded (for example, certain forms of gross negligence or willful misconduct, where applicable).

5. Usage Rules

You agree to:

  • Use the Service only for lawful purposes and in compliance with these Terms
  • Not use the Service to violate any applicable laws or regulations
  • Not attempt to gain unauthorized access to the Service or its infrastructure
  • Not interfere with or disrupt the Service or servers/networks connected to it
  • Not use automated means (bots, scrapers, etc.) to access the Service without express permission
  • Not reverse engineer, decompile, or disassemble any portion of the Service
  • Provide accurate and complete information when using the Service
  • Maintain the security and confidentiality of your API keys and credentials

You agree not to:

  • Use the Service to harm, threaten, or harass others
  • Upload malicious code or content designed to damage or disrupt systems
  • Attempt to circumvent any rate limits, quotas, or access controls
  • Resell, sublicense, or redistribute the Service without authorization
  • Use the Service in any manner that could damage, disable, or impair its functionality

6. API Usage

API access is subject to:

  • Rate limits and quotas as documented in the API Terms
  • Authentication requirements using organization-scoped API keys
  • Tier-based usage caps (free/paid)

Excessive or abusive API usage may result in throttling or access suspension without notice.

7. User Content and Data

When you submit dependency information, lockfiles, graphs, or other Customer Content to the Service:

  • You retain all ownership rights to your content
  • You grant MergeSignal a limited, non-exclusive license to process, analyze, store, and display that content solely to provide, secure, improve, and bill for the Service, in accordance with the Privacy Policy (including the restrictions in Section 2.1 there)
  • You represent that you have the right to submit such content
  • You are responsible for ensuring compliance with applicable data protection laws

MergeSignal may store inputs and outputs needed to operate the product (for example scan results, risk scores, and metadata). See the Privacy Policy for categories, retention, and your rights.

8. Intellectual Property

The Service, including its source code, documentation, and branding, is licensed under the Apache License 2.0 (see LICENSE file). This means:

  • You may use, modify, and distribute the software as permitted by the Apache 2.0 license
  • Certain components may be proprietary and not included in the open-source distribution
  • The MergeSignal name and logo are trademarks and may not be used without permission

9. Termination

We reserve the right to:

  • Suspend or terminate your access to the Service at any time, for any reason, with or without notice
  • Terminate these Terms or cease offering the Service at any time
  • Remove or disable any content or functionality at our discretion

You may terminate your use of the Service at any time by ceasing all access and use.

Upon termination:

  • Your right to access and use the Service immediately ceases
  • We may delete your data, including scan results and API keys
  • Provisions that by their nature should survive termination will continue to apply

10. Changes to Terms

We may modify these Terms at any time by posting updated Terms on our website or in the repository. Your continued use of the Service after changes are posted constitutes acceptance of the modified Terms.

Material changes will be notified through:

  • Updates published on the MergeSignal website
  • Notices in the application interface
  • Email notifications (if contact information is available)

11. Third-Party Services

The Service may integrate with or rely on third-party services, including:

  • GitHub API
  • npm registry
  • OSV vulnerability database
  • Package adoption metrics services

Your use of these third-party services is subject to their respective terms and policies. We are not responsible for third-party services' availability, accuracy, or conduct.

12. Indemnification

You agree to indemnify, defend, and hold harmless MergeSignal, its operators, and contributors from any claims, damages, losses, liabilities, and expenses (including legal fees) arising from:

  • Your use of the Service
  • Your violation of these Terms
  • Your violation of any rights of another party
  • Any decisions made based on Service outputs

13. Disclaimer of accuracy

This section supplements Section 3 (nature of analyses and no guarantee of specific results).

Risk scores, vulnerability information, and recommendations provided by the Service:

  • Are generated algorithmically and may not reflect current threats
  • Should be independently verified before taking action
  • May be based on incomplete or outdated data
  • Are not guaranteed to detect all security issues

Always perform your own security assessments and follow industry best practices.

14. Governing Law and Dispute Resolution

These Terms are governed by the laws of the jurisdiction where MergeSignal is operated, without regard to conflict of law provisions.

Any disputes arising from these Terms or the Service will be resolved through:

  • Good faith negotiations
  • Binding arbitration (if required by applicable law)
  • Courts in the jurisdiction specified above

15. Severability

If any provision of these Terms is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.

16. Entire Agreement

These Terms, together with the Privacy Policy and API Terms, constitute the entire agreement between you and MergeSignal regarding the Service and supersede any prior agreements.

17. Contact

For legal inquiries regarding these Terms, please see Contact or open an issue in the GitHub repository.

Last Updated: March 16, 2026

By using MergeSignal, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service.