Terms of service

These Terms of Service ("Terms") are a contract between you and BluNorth Technologies LLC ("BluNorth", "we", "us"), a limited liability company organised in Wyoming, United States. They govern your use of the Infrox website at infrox.io and the Infrox application at app.infrox.io (together, the "Service").

By creating an account or using the Service you accept these Terms. If you are accepting on behalf of a company, you confirm you have authority to bind it, and "you" means that company.

Our Privacy Policy forms part of these Terms.

Infrox performs automated Well-Architected reviews of AWS accounts you connect. It reads configuration metadata read-only, runs a library of checks across the six Well-Architected pillars, and produces a score, a prioritised list of findings, curated remediation guidance, reports and trends over time.

Features, checks and plan contents evolve. We may add, change or withdraw parts of the Service; where a change materially reduces what a paid plan provides, we will give you notice and you may cancel under section 6.

You must be at least 18 and able to form a binding contract. You are responsible for the accuracy of your account details, for everything done under your credentials, and for the people you invite into your workspace.

Keep your password confidential and tell us promptly at support@infrox.io if you believe your account has been compromised. We strongly recommend enabling two-factor authentication.

Do not share a single login between people. Add each person as a member of the workspace instead — that is what the team features are for, and shared logins defeat the audit trail you may later need.

To assess an AWS account you deploy an IAM role into it that lets Infrox assume read-only access. By connecting an account you represent that you own it or are authorised by its owner to have it assessed. Scanning an account you are not authorised to scan is a breach of these Terms and may be unlawful; it is your responsibility, not ours, to have that authorisation.

You are responsible for deploying and maintaining the role, and for the permissions it grants. You can revoke our access at any time by deleting the role stack in your AWS account or removing the connection in Infrox — revocation is immediate and does not require us to act.

You remain solely responsible for your AWS accounts, your AWS costs and your relationship with Amazon Web Services. Nothing in these Terms makes us a party to your AWS agreement.

Paid plans are billed in advance through Stripe, monthly or annually as you choose, and renew automatically until cancelled. Current prices are shown on the pricing page and in the app; prices exclude any taxes, which are added where applicable. A one-off report is a single purchase, not a subscription.

Each plan carries limits — how many scans and AI analyses you may run in a billing period, and how many AWS accounts you may assess. Two things follow from how we have chosen to enforce them:

• Quotas stop, they do not bill. When a limit is reached the action is refused rather than charged as overage. You will never receive a surprise invoice for going over.
• If your AI quota runs out, the scan still runs. The report is produced without the narrative layer; scoring is unaffected.
• Account limits are hard limits. Your plan caps both how many AWS accounts you may have connected at one time and how many distinct AWS accounts you may assess over the life of your subscription. Deleting a connection frees the first but not the second — the distinct-account allowance is not replenished by removing an account. Upgrade if you need more.

Upgrades take effect immediately and are prorated by Stripe. Downgrades take effect at the next renewal. If a payment fails we may retry it and, after notice, suspend paid features until it succeeds.

Enterprise plans are agreed separately with us and may vary these commercial terms; where a signed order and these Terms conflict, the order governs. Contact sales@infrox.io.

You may cancel at any time from the billing portal in the app. Cancellation takes effect at the end of the period you have already paid for; your plan keeps working until then, and you are not billed again.

Payments are non-refundable except where the law requires otherwise or we agree in writing. We do not refund partial periods or unused quota. If we terminate your account for a reason other than your breach of these Terms, we will refund the unused portion of any prepaid fees.

Export what you need before cancelling. After your account is closed we delete your data as described in the Privacy Policy, and we cannot recover it afterwards.

You own your data. The configuration metadata we read from your AWS accounts, the findings derived from it and the reports produced from those findings are yours. We claim no ownership of them.

You grant us a limited licence to store and process that data solely to provide the Service to you — to run checks, generate reports, show trends and support your account. We do not sell it, and we do not use one customer's data to serve another.

You may share and republish your reports freely, including with your own clients. On plans where it is included, you may apply your own branding to report PDFs. You remain responsible for what you do with a report you share.

We own the Service itself — the software, the check library, the curated remediation content, the Infrox name and logo. These Terms grant you the right to use it, not any ownership of it. We may publish aggregated, de-identified statistics about how the Service is used; nothing published will identify you, your accounts or your findings.

Do not:

• connect or scan an AWS account you do not own and are not authorised to assess;
• attempt to access another tenant's data, or probe, scan or load-test our infrastructure without written permission;
• reverse engineer, decompile or copy the Service, or extract the check library or remediation content to build a competing product;
• resell or provide the Service to third parties except as your plan expressly permits;
• use the Service unlawfully, or to store or transmit malicious code;
• circumvent quotas, account limits or billing, including by creating multiple accounts to evade them.

Automated access to our API is fine within your plan's limits. Access that degrades the Service for other customers is not, and we may rate-limit it.

This section matters more than its length suggests. Read it before relying on a report.

• Infrox is advisory. Its findings are informational and do not guarantee that your infrastructure is secure, resilient, compliant or correctly configured. A clean report is not proof of a safe account, and no automated check library detects every problem.
• It is not an audit and not a certification. Infrox does not provide legal, financial, or professional security advice, and a report is not an attestation against SOC 2, ISO 27001, PCI DSS, HIPAA or any other framework.
• Applying a fix is your decision. Remediation guidance describes a change to make in your own account. You are responsible for reviewing it, testing it in a non-production environment first, and understanding its impact. We are not liable for the consequences of a change you make.
• AI-generated narrative can be wrong. Where a report includes an executive summary or correlation written by a language model, treat it as a summary to verify, not a fact. Scores and risk levels come from the checks themselves and do not depend on it.
• We are not affiliated with Amazon. Infrox is an independent product. "AWS", "Amazon Web Services" and "Well-Architected" are trademarks of Amazon.com, Inc. or its affiliates, used here descriptively. Nothing in the Service is endorsed by, certified by, or delivered in partnership with Amazon, and an Infrox report is not an official AWS Well-Architected Framework Review.

We aim to keep the Service available and to run scans promptly, but we do not commit to an uptime figure on self-serve plans, and we may take the Service down for maintenance. Where a service level is offered, it is set out in a signed Enterprise order.

Support is by email at support@infrox.io. A scan that fails for a reason on our side does not consume your quota.

The Service depends on third parties — Amazon Web Services for hosting and authentication, Stripe for payments, Anthropic for optional AI analysis, an email provider for transactional mail, and Google if you choose to sign in with it. Their availability and their own terms are outside our control. The Privacy Policy lists what each one receives.

You may stop using the Service and close your account at any time. We may suspend or terminate your access if you materially breach these Terms — in particular section 8 — if payment fails after notice, or if we must do so to comply with law or protect the Service or other customers. Where circumstances allow, we will give you notice and an opportunity to fix the problem first.

Sections 7, 9, 13, 14, 15 and 17 survive termination.

The Service is provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or that its findings will be complete or accurate.

Some jurisdictions do not allow certain disclaimers, in which case those parts do not apply to you.

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost data, or business interruption, even if advised of the possibility.

Our total aggregate liability arising out of or relating to these Terms or the Service is limited to the greater of the amounts you paid us in the twelve months before the event giving rise to the claim, or US$100.

These limits do not apply to liability that cannot be limited by law, such as fraud or wilful misconduct. They allocate risk between us and are reflected in the price of the Service.

You will defend and indemnify us against claims, damages and reasonable legal costs arising from your use of the Service in breach of these Terms, from your having connected an AWS account you were not authorised to assess, or from your infringement of a third party's rights. We will notify you of any such claim and let you control its defence, provided any settlement releases us fully.

We may update these Terms as the Service changes. The "last updated" date at the top shows the current version. For material changes we will give account holders notice by email or in the app before they take effect; continuing to use the Service after that means you accept the new version. If you do not, cancel under section 6.

These Terms are governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-laws rules. The state and federal courts located in Wyoming have exclusive jurisdiction, and both parties consent to venue there.

Before filing anything, email us at support@infrox.io with a description of the dispute. Most problems are cheaper and faster to solve that way, and we will do the same for you.

These Terms, with the Privacy Policy and any signed order, are the entire agreement between us and replace any earlier understanding. If a provision is held unenforceable, the rest stays in force. Our not enforcing a provision is not a waiver of it.

You may not assign these Terms without our written consent; we may assign them to an affiliate or in connection with a merger or sale of the business. Nothing here creates a partnership, agency or employment relationship, and there are no third-party beneficiaries.

Notices to you go to the email address on your account. Notices to us go to support@infrox.io.

Questions about these Terms: support@infrox.io
Sales and Enterprise plans: sales@infrox.io

BluNorth Technologies LLC, Wyoming, United States.