DOKIMA

Legal

Dokima Subscription and Software Licence Terms

Last updated: 3 August 2026

These terms are between Northloom Ltd, a company registered in Scotland under company number SC895860 with registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN (“Northloom”), and the business identified in an Order (“Customer”). They govern paid subscriptions and any Order that incorporates them.

1. Business customers and authority

Dokima is supplied only for business use. The person accepting an Order confirms that they have authority to bind Customer and are not acting as a consumer. Customer must provide accurate procurement, ownership, end-use, destination and billing information.

2. Definitions

  • Authorised User: Customer personnel permitted to use Dokima under the Order.
  • Customer Materials: repositories, source code, configuration, prompts, findings, reports and other data supplied to or processed through Dokima by Customer.
  • Documentation: Northloom’s current user documentation for Dokima.
  • Dokima: Northloom’s locally installed software, Documentation, updates and related licence materials supplied under an Order.
  • Order: an order form, accepted quotation, Stripe subscription or other written ordering record identifying Customer, plan, fees and subscription period.
  • Subscription Term: the initial subscription period and each renewal period.
  • Territory: the United States, Canada, United Kingdom, Australia, New Zealand, Jersey, Guernsey and Isle of Man.

3. Agreement and priority

The agreement consists of the Order, these terms, the Acceptable Use Policy and any signed data-processing or support addendum. If they conflict, a signed Order takes priority, followed by a signed addendum, these terms and the Acceptable Use Policy. The Privacy Notice describes Northloom’s processing as controller and does not form part of the contract.

4. Licence

Subject to payment and compliance with the agreement, Northloom grants Customer during the Subscription Term a limited, non-exclusive, non-transferable and non-sublicensable licence to install and use Dokima for Customer’s internal, authorised source-code security review.

Customer may make a reasonable number of backup or deployment copies and permit Authorised Users to use Dokima on Customer-controlled systems. Customer may not make Dokima available to an affiliate, contractor or other third party unless the Order expressly includes them. Customer is responsible for all use under its licence credentials.

The Order’s plan limits apply. Unless the Order says otherwise, contributor count means non-bot people who committed to a protected repository during the preceding 90 days. Repositories, workspaces and Dokima runs are unlimited, subject to the applicable contributor band and Customer’s own systems and AI-runner limits.

Customer must not sell, sublicense, rent, host for third parties, distribute, publish, copy except as permitted, remove proprietary notices, or reverse engineer Dokima except to the limited extent such restriction is prohibited by law. Customer must not bypass licence, plan, access or security controls.

5. Territory and location of use

Northloom supplies Dokima only to Customers established in the Territory. Dokima may be procured, installed and ordinarily used only for Customer operations in the Territory and by Authorised Users ordinarily based there.

An Authorised User may continue to use an existing authorised installation during temporary and incidental business or personal travel outside the Territory, provided that the travel does not involve:

  • procurement, installation or deployment for an establishment or operation outside the Territory;
  • an Authorised User becoming ordinarily based outside the Territory;
  • supply, access or benefit to an affiliate, customer or other person outside the Territory; or
  • conduct prohibited by export, sanctions or other applicable law.

Customer must obtain Northloom’s written approval before any other overseas transfer or use. Geo-IP controls are only one compliance measure and do not vary this contractual restriction.

6. Authorised review and Customer responsibilities

Customer warrants that it owns, controls or has clear permission to assess every repository and item of source code reviewed with Dokima. Customer will:

  • use Dokima only for lawful defensive security work and comply with the Acceptable Use Policy;
  • manage repository access, credentials, backups, endpoint security and Authorised Users;
  • verify findings through suitably qualified human review before remediation, disclosure or reliance;
  • comply with third-party licences, confidentiality duties and coordinated vulnerability-disclosure obligations; and
  • remain responsible for decisions, changes and communications based on Dokima output.

Dokima is a review aid, not a guarantee that code is secure, compliant or free of vulnerabilities. It does not replace professional judgement, secure development practices, testing, penetration testing, legal advice or an independent security assessment.

7. AI runners and third-party services

Dokima orchestrates AI command-line runners selected, configured and funded by Customer. Those runners and any other third-party services are not supplied or controlled by Northloom. Customer is responsible for:

  • selecting a runner suitable for the sensitivity and location of Customer Materials;
  • its runner account, credentials, charges, availability and usage limits;
  • reviewing the runner provider’s terms, security, training, retention and international-transfer practices; and
  • ensuring it has authority to transmit Customer Materials to the runner.

Northloom is not responsible for a third-party service’s acts, omissions, output, loss, suspension or terms.

8. Local data and product reports

Dokima operates locally in Customer’s environment. Customer Materials remain there by default, except when Customer intentionally sends them to a runner, Northloom support or a separately documented service.

As between the parties, Customer retains its rights in Customer Materials and in reports generated from them. Northloom retains all rights in Dokima, its report format and templates, Documentation, methods, prompts supplied with the product and underlying technology. Customer grants Northloom only the rights reasonably needed to provide support or a service Customer expressly requests.

Northloom will not publish a paid Customer’s source code, findings or reports without Customer’s permission, except where required by law. This paragraph does not apply to a separately accepted open-source programme whose essential condition is delayed publication.

9. Open-source programme

Where an Order expressly identifies the free open-source programme, no subscription fee is charged and the following special conditions apply:

  • eligibility is assessed per workspace: covered repositories must be public and carry an OSI-approved licence;
  • Customer supplies and pays for its own AI runner;
  • reports are uploaded automatically when the relevant service becomes available, with no private-report opt-out under the free licence;
  • each finding becomes public 120 days after Dokima first records it, whether open, resolved or marked “wontfix”; Northloom may grant an extension or exception in writing for good reason; and
  • the maintainer may review findings privately before publication and control the published disposition, but not the scheduled publication itself.

A commercial Order is required where private reporting is needed. Northloom will not activate automated upload or publication until the relevant service and notice are operational and these conditions have been expressly accepted.

10. Delivery, updates and support

Northloom will provide the delivery, activation and renewal instructions stated in the Order. Product updates are included during an active paid Subscription Term. Customer must install supported updates within a reasonable period, particularly security updates.

Support is provided through support@dokima.net on a reasonable-efforts basis. No service level, response time, availability commitment, managed review or professional service is included unless an Order expressly states it.

Northloom may change Dokima and the Documentation to improve security, function or maintainability, provided this does not materially remove the core functionality purchased during the then-current Subscription Term.

11. Fees, billing and taxes

Fees are charged monthly or annually in advance as stated in the Order. Annual subscriptions are charged upfront. Fees exclude taxes unless the Order expressly says otherwise. Customer is responsible for applicable taxes, duties and levies other than taxes on Northloom’s income.

Subscriptions renew automatically for successive periods equal to the initial billing period unless either party gives notice of non-renewal before the renewal date. Customer may cancel at any time through the available billing method or by contacting support@dokima.net; cancellation takes effect at the next renewal.

Payments are non-cancellable and non-refundable once a billing period begins, and there are no prorated refunds or credits, except where required by law or expressly agreed in writing. Northloom may change renewal pricing on at least 30 days’ written notice. If payment is overdue, Northloom may suspend access after reasonable notice.

12. Confidentiality

Each party will protect the other’s non-public business, technical and commercial information using at least reasonable care, use it only for the agreement and disclose it only to personnel, advisers and providers who need it and are bound by confidentiality duties.

Confidential information does not include information that the receiving party can show was lawfully known without restriction, becomes public without breach, is received lawfully from another source, or is independently developed. A party may disclose information required by law after giving notice where legally permitted.

13. Data protection

Each party will comply with data-protection law applicable to its activities. Northloom’s Privacy Notice explains its handling of business contacts, licence administration, billing and support information.

Customer must not send Northloom personal data contained in repositories or diagnostic material unless reasonably necessary and lawfully disclosed. If a requested service requires Northloom to process personal data on Customer’s behalf beyond incidental support, the parties will put an appropriate data-processing agreement in place before that processing.

14. Intellectual property and feedback

Northloom and its licensors own all intellectual-property rights in Dokima and related technology. No rights are granted except those expressly stated. Third-party components remain subject to their own notices and licences.

Customer may provide feedback voluntarily. Customer grants Northloom a perpetual, worldwide, royalty-free right to use that feedback without identifying Customer or disclosing Customer Confidential Information.

15. Compliance, sanctions and export

Customer must comply with applicable export-control, sanctions, anti-bribery and trade laws. Customer represents throughout the Subscription Term that neither it nor, to its knowledge after reasonable checks, its controlling owners or intended end users is a prohibited or sanctioned person, and that Dokima will not be used for a prohibited end use or diverted to a prohibited destination.

Northloom may perform screening before activation and renewal, request supporting information, refuse or suspend supply while a concern is reviewed, and terminate immediately where supply or continued performance may breach law or create an unacceptable sanctions, export or misuse risk. Customer must promptly notify Northloom of a material change affecting these representations.

16. Suspension and termination

Northloom may suspend Dokima where reasonably necessary to address overdue fees, a security threat, suspected misuse, a sanctions or legal concern, or material breach. Where appropriate, Northloom will give notice and a reasonable opportunity to remedy.

Either party may terminate for a material breach not remedied within 30 days after written notice, or immediately where the breach cannot be remedied, the other party becomes insolvent, or continued performance would be unlawful. Northloom may terminate the free open-source programme on reasonable notice.

On expiry or termination, the licence ends and Customer must stop using and delete Dokima and licence materials, except for archival copies required by law. Customer retains its local repositories, findings and generated reports. Expiry should prevent new reviews but should not erase local findings. Accrued rights, payment obligations, confidentiality, intellectual-property, liability and other provisions intended to survive will continue.

17. Warranties and disclaimers

Northloom warrants that it has authority to enter the agreement and will use reasonable skill and care in providing any expressly agreed service. If Dokima materially fails to operate in accordance with the Documentation, Customer’s exclusive remedy is for Northloom, at its option, to use reasonable efforts to correct the failure, provide a workaround, or terminate the affected Order and refund the prepaid fees for the unused part of the current billing period.

To the fullest extent permitted by law, all other warranties, conditions and terms, whether express, implied or statutory, are excluded. Dokima and its output are provided as a security-review aid. Northloom does not warrant uninterrupted or error-free operation, compatibility with every repository or runner, discovery of every vulnerability, absence of false positives or negatives, or any particular security or compliance outcome.

18. Liability

Nothing excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

Subject to that sentence, Northloom will not be liable for loss of profit, revenue, business, anticipated savings, goodwill, opportunity or contracts; loss or corruption of data; business interruption; or indirect or consequential loss, in each case arising from the agreement, even if foreseeable.

Subject to the first paragraph of this section, Northloom’s total aggregate liability arising out of or in connection with the agreement, whether in contract, delict (including negligence), breach of statutory duty or otherwise, will not exceed the fees paid by Customer for Dokima during the 12 months immediately preceding the event giving rise to the first claim. For a free programme, that cap is £100.

Customer is responsible for maintaining appropriate backups and security controls and for human validation of output. The exclusions and cap reflect the fees and allocation of risk agreed by the parties.

19. Changes to these terms

Northloom may update these terms for future Orders and renewals. A material change during a current Subscription Term will take effect only where required by law or reasonably necessary to protect Dokima or its users; otherwise it takes effect at renewal after at least 30 days’ notice. If a legally or security-required change materially disadvantages Customer, Customer may terminate before it takes effect and receive a refund of prepaid fees for the unused period.

20. General

Neither party is liable for delay caused by events beyond its reasonable control, except Customer’s payment obligations. Customer may not assign the agreement without Northloom’s prior written consent; Northloom may assign it as part of a reorganisation or sale of its business or relevant assets.

Notices must be in writing. Notices to Northloom should be sent to contact@northloom.ai; operational support messages may be sent to support@dokima.net. Notices to Customer may be sent to the account or billing contact in the Order.

The agreement is the entire agreement about its subject and replaces earlier statements on that subject. Neither party relies on a statement not set out in it, without limiting liability for fraud. A delay in enforcing a right is not a waiver. If a provision is unenforceable, it will be adjusted to the minimum extent necessary and the remainder will continue. Nothing creates a partnership, agency or employment relationship. A person who is not a party has no right to enforce the agreement.

21. Governing law and courts

The agreement and any non-contractual obligations or disputes arising from it are governed by the laws of Scotland. The courts of Scotland have exclusive jurisdiction.