Terms of Service

These Terms of Service ("Terms") govern access to and use of the Moatgator platform, provided by GZ Segurança e Defesa Cibernética LTDA, CNPJ 40.988.106/0001-60, with its registered office at ⟦full registered address⟧, Cascavel, Paraná, Brazil ("Moatgator", "we"). By creating an account, sending an app to Scan or using any part of the service, you ("Customer", "you") agree to these Terms, to the Acceptable Use Policy and, when we process personal data on your behalf, to the Data Processing Agreement (DPA). If you accept on behalf of a company, you represent that you have authority to bind it.

Enterprise customers may sign their own contract (MSA) with an SLA; in that case, the contract prevails over these Terms where they differ. This is a courtesy translation: if language versions differ, the Portuguese version prevails.

1. The service

Moatgator is a runtime application self-protection (RASP) platform for Android and iOS apps. It includes:

• SDKs and build protection (Shield and Runtime): obfuscation, anti-tampering and on-device detection of root, jailbreak, emulators, debuggers, instrumentation frameworks and tampering;
• Attest: verification of app and device integrity before a sensitive action;
• Pulse: console and API to view security telemetry and configure policies;
• Scan: static analysis of packages (APK, AAB, IPA), free and without an account (public Scan) or inside the console;
• Solve: fixing Scan findings through pull requests, via the Moatgator GitHub App.

Features labeled preview or beta, such as iOS support while it carries that label, may change, have limits or be withdrawn, and have no SLA.

2. Account and access

You create an account with e-mail and password or with a sign-in provider (Google, GitHub or X) and are responsible for your credentials and for all activity in the account. We recommend turning on two-step verification, which your organization may require. You must provide accurate information and keep it up to date. If you suspect unauthorized access, tell us through the contact form.

The organization owner manages who has access and with which role. Administrative actions are recorded in the organization's audit trail.

3. Acceptable use and authorization

You may only use Moatgator on apps and systems that you develop, own or are expressly authorized to analyze, test or protect, and never to hide malware, mislead users, evade app store review or reverse engineer third-party apps without authorization. The full rules, usage limits, customer verification and suspension are in the Acceptable Use Policy, which is part of these Terms. Security research on Moatgator itself follows the vulnerability disclosure program.

4. Scan

• When you send a package, you represent that you have rights over it (see the Acceptable Use Policy).
• A package sent to the public Scan is deleted within 24 hours; the report is available through its link for the same period. In the console, retention follows the plan.
• The result is an automated, informational analysis of the package sent: it is not an audit, penetration test, certification or opinion, and it may have false positives and negatives.
• Scan has size and frequency limits to keep the service available to everyone.

5. Solve (pull requests)

• Solve only works on the repositories you authorize when installing the GitHub App, with the permissions shown by GitHub. You can revoke that authorization at any time on GitHub.
• Solve proposes changes by opening a pull request; it does not merge or change the main branch. Reviewing, testing and accepting each change is your responsibility.
• Suggested code is yours once merged, at no additional license cost.

6. Personal data

When you integrate the SDK or use Attest, the signed-in Scan or Solve, you are the controller of your end users' data and Moatgator acts as processor, under the DPA. You represent that you have a legal basis and inform your users. Data about your account and your team is processed by Moatgator as controller, under the Privacy Notice. Subprocessors are in the public list.

7. Plans, prices and payment

Free plan. The Hatchling plan is free for one app per organization, with the limits on the pricing page. It does not expire and needs no card. We may change the free plan's limits with 30 days' notice.

Paid plans. Paid plans are charged per app, monthly or yearly, at the prices published at the time of purchase. Prices are published in US dollars, with the option to pay in Brazilian reais (BRL). Once billing is live, payment is made by card through our payment processor (Stripe), or by Pix for prepaid annual plans, up to the limit shown at checkout. Customers in Brazil receive a tax invoice in reais.

Renewal and cancellation. Subscriptions renew automatically at the end of each period. You can cancel or change plans in the console at any time; cancellation takes effect at the end of the period already paid, and the plan continues until then. Usage above what the plan includes (for example, monthly active users) is charged as shown on the pricing page, with notices at 80% and 100%.

Taxes. Unless stated otherwise, prices do not include taxes, which may be added as required by law.

Non-payment. If a payment fails, the plan continues for up to 14 days while we retry, with e-mail notices. After that, the app returns to the free plan: nothing is deleted and runtime protection already installed is not switched off for non-payment, but paid features stop applying.

Price changes. Price changes apply from the next renewal and are announced at least 30 days in advance.

8. Withdrawal and refunds

Consumers. If you buy as a consumer (an individual, or a company using the service as its final user), you may withdraw within 7 days of purchase or of the first payment, without giving a reason, with a full refund, under art. 49 of the Brazilian Consumer Protection Code. To withdraw, cancel in the console or use the contact form. The refund is made through the same payment method.

All customers. In addition, we refund the full first payment of an organization's paid plan if you ask within 14 days, no questions asked, for monthly, annual and prepaid Pix plans. After that there are no pro-rata refunds: cancellation takes effect at the end of the paid period. Incorrect charges are always corrected.

9. Intellectual property

The platform, including software, SDKs, detection rules, brand, documentation and content, belongs to Moatgator or its licensors. We grant you a limited, non-exclusive, non-transferable and revocable license to use the service under these Terms, including to embed the SDKs and the protection in your apps and distribute them to your users. You keep all rights to your apps, code and data. You may not reverse engineer Moatgator's components beyond what the law allows or what the disclosure program authorizes.

If you send us suggestions, we may use them with no obligation to you.

10. Availability and support

We strive to keep the service available and secure, but, without an SLA signed in writing, it is provided "as is", with no guarantee of uninterrupted or error-free operation. Support depends on the plan (community and docs on the free plan; e-mail on paid plans; an account manager on Enterprise). Service status is on the status page.

11. Disclaimers and limitation of liability

Moatgator is a layer of defense that reduces risk but does not eliminate all of it: no protection stops every attack, and detections may have false positives. You decide how your app reacts to each detection (monitor, warn, block or end the session) and must test that configuration before releasing it.

To the maximum extent permitted by law, Moatgator is not liable for indirect damages, lost profits, or loss of data or revenue arising from the use of, or inability to use, the service. Moatgator's total liability is limited to the amount you paid in the 12 months before the event that gave rise to it. These limits do not apply to damage caused by willful misconduct or gross negligence, to personal data breaches caused by Moatgator's failure to comply with the LGPD, or to consumers, to the extent the Consumer Protection Code does not allow limitation.

12. Indemnification

If you are not a consumer, you agree to defend and indemnify Moatgator against third-party claims caused by use of the service in breach of these Terms, the Acceptable Use Policy or the law, including use on apps without proper authorization.

13. Term, suspension and termination

These Terms apply while you use the service. You may close your account at any time in the console. We may suspend or end access for breach of these Terms or the Acceptable Use Policy, for security risk or when required by law, with prior notice whenever possible, as set out in the Acceptable Use Policy. After termination, you have 30 days to export your data; it is then deleted under the Privacy Notice and the DPA.

14. Changes

We may change these Terms. Material changes are announced by e-mail or in the console at least 30 days in advance; if you disagree, you may close your account before they take effect and receive a pro-rata refund of prepaid, unused fees. The date of the last update is at the top of the page.

15. Governing law and venue

These Terms are governed by the laws of Brazil. If you are a consumer, you may bring a claim in the courts of your domicile (art. 101, I, of the Consumer Protection Code). Otherwise, the courts of Cascavel, State of Paraná, Brazil have jurisdiction, to the exclusion of any other, however privileged. Before going to court, please talk to us: most problems are solved within days.

16. Contact

Questions about these Terms: contact form or contato@moatgator.com. GZ Segurança e Defesa Cibernética LTDA, CNPJ 40.988.106/0001-60, ⟦full registered address⟧, Cascavel/PR, Brazil.