The rules behind the record

Service terms and separate licenses

These terms apply to the hosted service and its company-owned website materials. Downloaded software and source code remain governed by their accompanying licenses. In particular, the Dev Autographs repository is distributed under the Apache License 2.0. Nothing here withdraws permissions granted by that license or a third-party license, or limits rights that applicable law makes non-waivable.

A separately agreed written customer contract or the purchase terms presented for a specific paid plan control that purchase when they conflict with these general service terms. Browsing this website does not by itself purchase a plan, assign intellectual property or authorize a payment.

Your identity and your submissions

Use an identity and account you are entitled to control. Protect your signing keys, exports, devices and GitHub account, and promptly report suspected compromise. You must have authority to submit or publish the code metadata, labels, files and repository information you provide. Do not submit credentials, private keys in public fields, confidential repository paths or another person's private information.

You retain the rights you hold in your submissions. You authorize Axiom Risk Group to process them to provide the features you request, including verification, storage, public lookups and distribution of records you choose to publish. That authorization does not transfer ownership of your work. Privacy and data explains signing-key storage and publication.

What a signature can establish

Dev Autographs verifies cryptographic signatures and reports the supplied provenance records and registry status. A signature can show that particular data was signed with a key and whether it matches those signed records. It does not establish who originally wrote the code, legal ownership, originality, copyright registration, freedom from infringement, or permission to copy it.

A GitHub-linked repository claim is a recorded claim checked within the product's workflow, not a legal title decision. Report percentages describe available records, not necessarily every file or contributor. The service cannot prevent copying or guarantee that unsigned, missing, altered or independently signed work will be detected. Investigate the underlying evidence before relying on a record.

Use the tools responsibly

Do not impersonate a developer or Axiom Risk Group, forge attestations or contribution records, misrepresent a repository claim, publish records you know are misleading, use the service to infringe another person's rights, steal credentials, bypass account controls, or disrupt the hosted service. Do not present a copy of company-owned branding or website content as an official Dev Autographs service without permission.

These rules do not prohibit lawful independent development, interoperability, good-faith security research within an authorized scope, or use and redistribution allowed by an applicable open-source license. Report abuse, disputed attribution or a vulnerability through support.

Git hooks, keys and public history

Review the changes made by installers and setup scripts. Global Git hooks can apply across repositories; choose the scope you intend and use the product controls to disable them when necessary. Keep copies of important work and protect exported identities. Browser signing keys and downloaded identity or setup files are not encrypted by the export mechanism.

Unlinking revokes the key only after the registry acknowledges the request. Clearing local storage or uninstalling software does not erase already published records or revoke exported keys. Historical reports and third-party copies may remain. The product does not currently provide self-service account deletion.

Charges, subscriptions and refunds

The publicly described early-access product is free. Optional Marketplace support exists but its availability is controlled by the operator. This website's connection page does not purchase or cancel a plan. No charge is authorized merely by signing in or visiting a page.

If a paid plan is offered, its checkout or written order must disclose the seller, price, currency, taxes, billing interval, any trial, renewal, cancellation and refund terms before payment. For a GitHub Marketplace purchase, manage the subscription through the GitHub account that purchased it and consult the terms shown there. Other paid services follow the applicable order or checkout terms. Contact info@axiomriskgroup.com for a billing or refund request, with a receipt reference and without payment-card details.

Cancellation, access changes and removal of account information are separate processes. These terms do not promise a particular refund, automatic deletion or retention period that has not been offered and implemented. Statutory cancellation and refund rights remain available where applicable.

Availability and external services

The product includes early-access features and depends on GitHub, hosting providers and other services. Features may change, fail or be temporarily unavailable. Keep your own backups and review the release notes before upgrading. External services have their own terms and privacy practices; Axiom Risk Group does not control them.

To the extent applicable law allows, services are provided as available without a promise of uninterrupted operation, perfect security, complete provenance coverage or suitability for a particular legal dispute. A paid agreement may provide additional commitments. No wording here excludes liability or remedies that cannot lawfully be excluded.

Misuse, disputes and changes

Axiom Risk Group may restrict hosted access to address unlawful use, security threats or material misuse, with notice and an opportunity to clarify where reasonable and permitted. Restrictions on hosted access do not cancel rights granted under separate software licenses. Contact info@axiomriskgroup.com to raise a concern or dispute. This page does not impose mandatory arbitration or waive access to courts or regulators.

Material changes will be identified by an updated date and appropriate notice in the service. New charges or material paid-plan changes require the disclosures and consent required by applicable law and the relevant purchase terms.