Terms of Service

1. These terms, and who they apply to

These terms cover your use of Bitting, a service that keeps a register of an organization's keys, works out which of its services hold each key, and runs key rotations its named people approve. They are a contract between Bitting UAB, of Lvivo g. 25, LT-09320 Vilnius, Lithuania (“Bitting”, “we”) and the company that signs up (“Customer”, “you”).

The service is for businesses only, not consumers. By signing up you confirm that you are acting for your business and that you have the authority to commit your company.

The person who accepts these terms accepts them for the company, not for themselves. If you don’t have that authority, please don’t go ahead.

If documents disagree. This order applies: (1) a signed order form or agreement between us, (2) the data processing agreement, (3) these terms, (4) our Privacy Policy, (5) anything else on our website.

2. What the service is

Bitting reads the repositories, CI logs, chat channels, tickets, clusters, infrastructure state and vault paths you connect, through an agent you run in your own network, together with your scanner's findings if you have them. It tells live keys from dead ones, works out which of your services hold each live key and what stops if it changes, and keeps a register of your keys and certificates that you can export for an auditor. For a key you choose, it prepares a rotation plan: a new key from its issuer, given to each holder in an order it writes down, with the old key switched off only after every holder uses the new one. A plan runs only after your named approvers sign it with a passkey, and a key you mark critical needs two signatures. Every read, question, answer, approval and step is kept in an append-only evidence log for the period you set. Coding agents can use our boundary, a forward proxy you run, which attaches a key to a request an approved pass allows so the agent never holds the key.

3. What the service is not

These limits are deliberate, and they are part of what you are buying. They are not defects.

Not a secrets manager for runtime delivery. Bitting does not inject secrets into processes, ship SDKs or sync secrets to platforms on a schedule. It writes a new key only to the places your services already read keys from, and only during an approved rotation.

Not self-hosted. The models, the register and the evidence log run only as our service in Stockholm. There is no edition you install whole in your own network and no air-gapped install.

Not unattended rotation. No rotation runs on a timer, on a timeout or on the model's judgment alone. Every rotation waits for the people you name, however long that takes.

Not a certificate authority or privileged access. Bitting lists certificates and their expiry in the register and prepares their replacement, but it does not issue certificates, and it does not broker database or server sessions.

Not a promise that every key is found. Bitting reads what you connect. A key in a system you did not connect, or held in a way the model has never seen and nobody told it about, can be missing from the register.

4. What you need to do, and why it matters

What you get from the service depends a lot on things only you control. Please read this section carefully, because sections 9 and 10 build on it.

Keep the agent running and its access as granted. Everything Bitting reads and writes goes through the agent in your network and the read-only access you grant. If the agent stops or its access is narrowed, reads stop and no rotation starts, and we tell you which access failed.

Name approvers, owners and critical keys. Name the people who approve rotations and register their passkeys, keep service owners current, and mark which keys support critical or important functions. The model cannot decide what your firm treats as critical.

Answer the model's questions. When the model is unsure which services hold a key, it asks the owner and prepares nothing until a person answers. An unanswered question leaves that key out of rotation, and that is your call to make.

Keep the wrapping key safe. Rotated key versions are stored with us under a wrapping key kept in your network. Back it up as your policy requires; if it is lost, we cannot open any stored key version for you.

Give access to each issuer. A new key comes from its issuer, through the issuer's key API where it has one, or from a person with access to the issuer's portal. Arrange that access before you ask for a rotation.

Leave holders alone while a rotation runs. Do not change a holder's deployment, secret or variables by hand while its rotation runs. A change made outside the plan can make a check pass or fail for the wrong reason.

5. Getting started, and what is free

Before you sign, we read your scanner's export, or three repositories you connect read-only through the agent, at no charge, and send you where your card processor key, or the riskiest live key we find, lives and which services hold it. The read is done under these terms, and its results are deleted 30 days after we send them unless you sign.

There is no free plan. Billing starts on the day you sign the order form, monthly, with no annual term.

6. Fees

Per month, by repositories connected. Small is €690 a month for up to 30 repositories, Standard €1,390 for up to 100, Group €2,790 for up to 300, invoiced monthly in advance. Every repository connected counts, archived ones included, because their history is read.

What is not counted. There is no charge for findings, re-reads, rotations, approvers or seats, CI logs, chat workspaces, clusters, the coding-agent boundary, the auditor's export, or keeping logs for the period you set, up to ten years.

Moving between plans. If you connect more repositories than your plan covers, nothing stops reading; we tell you, and the next month is invoiced on the plan that fits.

Tax. Prices are in euros and exclude VAT. Customers in Lithuania are charged Lithuanian VAT at 21%; business customers elsewhere in the EU are invoiced without VAT under the reverse-charge rule; customers outside the EU are charged none.

Beta price. A firm that signs during the beta keeps its plan's price for 24 months from its first invoice.

7. Delivery, availability and support

Approvals. No rotation starts without the passkey signatures of the approvers your policy requires. A plan is frozen when it is approved, and any change to it needs a new approval.

When a check fails. If any holder fails its check, the agent puts that holder's previous key version back, stops the rotation and tells the approver. The old key stays live, and it is never switched off while a holder the plan names has not confirmed the new one.

When the agent or the service is down. No rotation starts. A rotation already running pauses at its next check with the old key still live, and resumes only when an approver says so.

Response times. A rotation that stops is answered within one business day on Small, within one hour at any hour on Standard, and within 30 minutes at any hour on Group, Vilnius time.

Support. Support is by email at [email protected]. We aim to reply within one business day. That is a target, not a guarantee.

8. The register, approval records and the evidence log

The register. One row per key and certificate: what it opens, which services hold it, whether you marked it critical, when it was issued and last replaced, who approved that, and the prepared plan for replacing it. You can export it at any time as a signed PDF and as CSV.

Approval records. For every rotation: when the model prepared the plan, who approved and who signed it and when, when each holder confirmed the new key, and when the old key was switched off.

The evidence log. Every read, question, answer, plan, approval, step and boundary request is appended to a hash-chained log that neither you nor we can rewrite, kept for the period you set and exportable at any time.

Correction. If a holder link or a register row is wrong, tell us or correct it in the register. The correction is written beside the original with who made it and when; the original is never overwritten.

9. What we promise, and what we don’t

We promise to provide the service with reasonable skill and care, and that we have the right to provide it.

We do not promise that the model finds every key or every holder of a key: it reads only what you connect, and a service that reads a key in a way it has never seen can be missed, which is why it asks when it is unsure and why a person approves every plan. We do not promise that a rotation never interrupts a service, since a holder that keeps the old key past its restart can fail when the old key is switched off. We do not promise that an issuer's key API works, or keeps working.

Beyond that we give no other warranty. As far as the law allows, we exclude all implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

10. Liability

10.1 Neither of us limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law says can’t be limited.

10.2 Losses neither of us covers. Neither of us is liable for lost profit, revenue, expected savings, business, goodwill or reputation, or for any indirect or consequential loss, however it arises.

10.3 Specific exclusions. We are not liable for a rotation your approvers approved; for a holder your people did not connect, did not name or described wrongly in answer to the model's question; for an outage or a change at a key's issuer; for changes made to holders outside an approved plan; for the loss of the wrapping key you keep; or for what a coding agent does with an API a pass you approved allowed.

10.4 Cap. Our total liability to you in any 12-month period is limited to the fees you paid us in that period. The cap does not apply to damage caused intentionally or through gross negligence, which Lithuania's Civil Code does not allow a contract to limit.

10.5 You accept that the limits in sections 9 and 10 are a fair way to share risk, given the price and your part under section 4, and that we could not offer the service at this price without them.

11. Confidentiality and data

Everything the agent sends us, your holder maps, register, approval records, evidence log, the ciphertext of your key versions, and the fact that you use Bitting, are your confidential information. We use them only to run the service for you and disclose them to nobody, except to a supervisory authority where the law requires it, and then we tell you first unless the law forbids it.

How we handle personal data is set out in our Privacy Policy and in the data processing agreement between us, which forms part of these terms. If the DPA and these terms disagree about personal data, the DPA wins.

12. Who owns what

The service, the agent, the boundary, our models and their weights, and the corpus of correction pairs from customers who opted in are ours.

Your code, logs, messages, register, holder maps, approval records and evidence log are yours, and you can export all of them at any time, including after the contract ends.

You may not use our name or logo in public, and we may not use yours, without written permission first.

13. How long this lasts, and how it ends

13.1 The contract starts when you sign up and runs until one of us ends it.

13.2 You can end it. Cancel at any time. It takes effect at the end of the current billing month, unless section 6 sets a minimum term.

13.3 We can end it. We can end it with 30 days’ notice. We can end it immediately if you seriously break these terms and don’t fix it within 14 days of being told, if you become insolvent, or if your use exposes us to legal risk.

13.4 What happens then. We stop delivering and stop billing. You keep everything already delivered to you, and your right to use it continues. We delete or return our working copies as the DPA says. Sections 9, 10, 11 and 12 continue to apply.

14. Changes to these terms

We may update these terms. A change that matters takes effect 30 days after we email you about it. If you don’t accept it, you can end the contract before then. Using the service after that date means you accept the change.

15. Contact

Bitting UAB, Lvivo g. 25, LT-09320 Vilnius, Lithuania
[email protected]

← Back