Legal

Dokima Subscription and Software Licence Terms

Last updated: 21 October 2026

These terms are between Northloom Ltd, a company registered in Scotland under company number SC895860 with registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN (“Northloom”), and the business identified in an Order (“Customer”). They govern paid subscriptions and any Order that incorporates them.

1. Business customers and authority

Dokima is supplied only for business use. The person accepting an Order confirms that they have authority to bind Customer and are not acting as a consumer. Customer must provide accurate procurement, ownership, end-use, destination and billing information.

2. Definitions

• Authorised User: Customer personnel permitted to use Dokima under the Order.
• Customer Materials: repositories, source code, configuration, prompts, findings, reports and other data supplied to or processed through Dokima by Customer.
• Documentation: Northloom’s current user documentation for Dokima.
• Dokima: Northloom’s locally installed software, Documentation, updates and related licence materials supplied under an Order.
• Order: an order form, accepted quotation, Stripe subscription or other written ordering record identifying Customer, plan, fees and subscription period.
• Subscription Term: the initial subscription period and each renewal period.
• Territory: the United States, Canada, United Kingdom, Australia, New Zealand, Jersey, Guernsey and Isle of Man.

3. Agreement and priority

The agreement consists of the Order, these terms, the Acceptable Use Policy, the hosted data-processing terms (where Customer enables private team publishing) and any signed data-processing or support addendum. If they conflict, a signed Order takes priority, followed by a signed addendum, the hosted data-processing terms (for hosted report personal data), these terms and the Acceptable Use Policy. The Privacy Notice describes Northloom’s processing as controller and does not form part of the contract.

4. Licence

Subject to payment and compliance with the agreement, Northloom grants Customer during the Subscription Term a limited, non-exclusive, non-transferable and non-sublicensable licence to install and use Dokima for Customer’s internal, authorised source-code security review.

Customer may make a reasonable number of backup or deployment copies and permit Authorised Users to use Dokima on Customer-controlled systems. Customer may not make Dokima available to an affiliate, contractor or other third party unless the Order expressly includes them. Customer is responsible for all use under its licence credentials.

The Order’s plan limits apply. Unless the Order says otherwise, contributor count means non-bot people who committed to a protected repository during the preceding 90 days. Repositories, workspaces and Dokima runs are unlimited, subject to the applicable contributor band and Customer’s own systems and AI-runner limits.

Customer must not sell, sublicense, rent, host for third parties, distribute, publish, copy except as permitted, remove proprietary notices, or reverse engineer Dokima except to the limited extent such restriction is prohibited by law. Customer must not bypass licence, plan, access or security controls.

5. Territory and location of use

Northloom supplies Dokima only to Customers established in the Territory. Dokima may be procured, installed and ordinarily used only for Customer operations in the Territory and by Authorised Users ordinarily based there.

An Authorised User may continue to use an existing authorised installation during temporary and incidental business or personal travel outside the Territory, provided that the travel does not involve:

• procurement, installation or deployment for an establishment or operation outside the Territory;
• an Authorised User becoming ordinarily based outside the Territory;
• supply, access or benefit to an affiliate, customer or other person outside the Territory; or
• conduct prohibited by export, sanctions or other applicable law.

Customer must obtain Northloom’s written approval before any other overseas transfer or use. Geo-IP controls are only one compliance measure and do not vary this contractual restriction.

6. Authorised review and Customer responsibilities

Customer warrants that it owns, controls or has clear permission to assess every repository and item of source code reviewed with Dokima. Customer will:

• use Dokima only for lawful defensive security work and comply with the Acceptable Use Policy;
• manage repository access, credentials, backups, endpoint security and Authorised Users;
• verify findings through suitably qualified human review before remediation, disclosure or reliance;
• comply with third-party licences, confidentiality duties and coordinated vulnerability-disclosure obligations; and
• remain responsible for decisions, changes and communications based on Dokima output.

Dokima is a review aid, not a guarantee that code is secure, compliant or free of vulnerabilities. It does not replace professional judgement, secure development practices, testing, penetration testing, legal advice or an independent security assessment.

7. AI models, runners and third-party services

Dokima orchestrates AI command-line runners and models selected and configured by Customer, whether provided by a third party or hosted locally by Customer. Those models, runners and any other third-party services are not supplied or controlled by Northloom.

Dokima supplies structured instructions directing the selected AI model and runner to perform authorised source-code review. AI models and runners may behave unpredictably, disregard instructions or attempt actions outside that purpose. Dokima’s instructions and any available runner permission or sandboxing controls do not guarantee that unintended or harmful actions cannot occur.

Customer is responsible for:

• selecting a model and runner suitable for the sensitivity and location of Customer Materials;
• the permissions, filesystem and network access, credentials and environment available to the model and runner, and for appropriate isolation, backups and system protection;
• its runner accounts, hosting, charges, availability and usage limits;
• reviewing any applicable model or runner provider terms, security, training, retention and international-transfer practices; and
• ensuring it has authority to transmit Customer Materials to the selected model and runner.

Subject to Section 18 (Liability), Northloom is not responsible or liable for the acts, omissions or output of any AI model, runner or third-party service, including actions contrary to Dokima’s instructions, unauthorised commands or network requests, modification or deletion of files, disclosure of information, damage to systems or data, service suspension or provider terms.

8. Local data and product reports

Dokima operates locally in Customer’s environment. Customer Materials remain there by default, except when Customer intentionally sends them to a runner, Northloom support or a separately documented service.

As between the parties, Customer retains its rights in Customer Materials and in reports generated from them. Northloom retains all rights in Dokima, its report format and templates, Documentation, methods, prompts supplied with the product and underlying technology. Customer grants Northloom only the rights reasonably needed to provide support or a service Customer expressly requests.

Northloom will not publish a paid Customer’s source code, findings or reports without Customer’s permission, except where required by law. This paragraph does not apply to a separately accepted open-source programme whose essential condition is delayed publication.

9. Open-source programme

Where an Order expressly identifies the free open-source programme, no subscription fee is charged and the following special conditions apply:

• eligibility is assessed per workspace: covered repositories must be public and carry an OSI-approved licence;
• Customer supplies and is responsible for its own AI model and runner;
• findings are uploaded automatically only when Dokima marks them fully_valid or possibly_valid; each finding is encrypted individually on the Customer machine before upload, source code is never uploaded, and there is no private-finding opt-out under the free licence;
• each uploaded finding becomes public, with the affected open-source project identified by name, 120 days after Dokima first promotes it to fully_valid or possibly_valid; later promotion from possibly_valid to fully_valid does not restart that window; Northloom may grant an extension or exception in writing for good reason; and
• the maintainer may review findings privately before publication and control the published disposition, but not the scheduled publication itself; a retracted finding is reconciled through its revision history and is not published.

Optional private team publishing, if separately enabled, follows the private-team terms below and does not replace or opt out of the open-source disclosure requirements. A commercial Order is required where findings must remain private instead of entering that disclosure programme. Northloom will not activate automated upload or publication until the relevant service and notice are operational and these conditions have been expressly accepted.

10. Delivery, updates and support

Northloom will provide the delivery, activation and renewal instructions stated in the Order. Product updates are included during an active paid Subscription Term. Customer must install supported updates within a reasonable period, particularly security updates.

Support is provided through support@dokima.net on a reasonable-efforts basis. No service level, response time, availability commitment, managed review or professional service is included unless an Order expressly states it.

Northloom may change Dokima and the Documentation to improve security, function or maintainability, provided this does not materially remove the core functionality purchased during the then-current Subscription Term.

11. Fees, billing and taxes

Fees are charged monthly or annually in advance as stated in the Order. Annual subscriptions are charged upfront. Fees exclude taxes unless the Order expressly says otherwise. Customer is responsible for applicable taxes, duties and levies other than taxes on Northloom’s income.

Subscriptions renew automatically for successive periods equal to the initial billing period unless either party gives notice of non-renewal before the renewal date. Customer may cancel at any time through the available billing method or by contacting support@dokima.net; cancellation takes effect at the next renewal.

Payments are non-cancellable and non-refundable once a billing period begins, and there are no prorated refunds or credits, except where required by law or expressly agreed in writing. Northloom may change renewal pricing on at least 30 days’ written notice. If payment is overdue, Northloom may suspend access after reasonable notice.

12. Confidentiality

Each party will protect the other’s non-public business, technical and commercial information using at least reasonable care, use it only for the agreement and disclose it only to personnel, advisers and providers who need it and are bound by confidentiality duties.

Confidential information does not include information that the receiving party can show was lawfully known without restriction, becomes public without breach, is received lawfully from another source, or is independently developed. A party may disclose information required by law after giving notice where legally permitted.

13. Data protection

Each party will comply with data-protection law applicable to its activities. Northloom’s Privacy Notice explains its handling of business contacts, licence administration, billing and support information.

Customer must not send Northloom personal data contained in repositories or diagnostic material unless reasonably necessary and lawfully disclosed. If a requested service requires Northloom to process personal data on Customer’s behalf beyond incidental support, the parties will put an appropriate data-processing agreement in place before that processing.

14. Intellectual property and feedback

Northloom and its licensors own all intellectual-property rights in Dokima and related technology. No rights are granted except those expressly stated. Third-party components remain subject to their own notices and licences.

Customer may provide feedback voluntarily. Customer grants Northloom a perpetual, worldwide, royalty-free right to use that feedback without identifying Customer or disclosing Customer Confidential Information.

15. Compliance, sanctions and export

Customer must comply with applicable export-control, sanctions, anti-bribery and trade laws. Customer represents throughout the Subscription Term that neither it nor, to its knowledge after reasonable checks, its controlling owners or intended end users is a prohibited or sanctioned person, and that Dokima will not be used for a prohibited end use or diverted to a prohibited destination.

Northloom may perform screening before activation and renewal, request supporting information, refuse or suspend supply while a concern is reviewed, and terminate immediately where supply or continued performance may breach law or create an unacceptable sanctions, export or misuse risk. Customer must promptly notify Northloom of a material change affecting these representations.

16. Suspension and termination

Northloom may suspend Dokima where reasonably necessary to address overdue fees, a security threat, suspected misuse, a sanctions or legal concern, or material breach. Where appropriate, Northloom will give notice and a reasonable opportunity to remedy.

Either party may terminate for a material breach not remedied within 30 days after written notice, or immediately where the breach cannot be remedied, the other party enters administration, liquidation, receivership, sequestration or an arrangement with creditors or becomes unable to pay its debts as they fall due, or continued performance would be unlawful. Northloom may terminate the free open-source programme on reasonable notice.

On expiry or termination, the licence ends and Customer must stop using and delete Dokima and licence materials, except for archival copies required by law. Before deletion, Customer may use Dokima only to generate a final report from findings already stored locally; it may not begin or continue any review or other AI-backed work. Customer retains its local repositories, findings and generated reports, and Dokima does not erase them. Accrued rights, payment obligations, confidentiality, intellectual-property, liability and other provisions intended to survive will continue.

17. Warranties and disclaimers

Northloom warrants that it has authority to enter the agreement and will use reasonable skill and care in providing any expressly agreed service. If Dokima materially fails to operate in accordance with the Documentation, Customer’s exclusive remedy is for Northloom, at its option, to use reasonable efforts to correct the failure, provide a workaround, or terminate the affected Order and refund the prepaid fees for the unused part of the current billing period.

To the fullest extent permitted by law, all other warranties, conditions and terms, whether express, implied or statutory, are excluded. Dokima and its output are provided as a security-review aid. Northloom does not warrant uninterrupted or error-free operation, compatibility with every repository or runner, discovery of every vulnerability, absence of false positives or negatives, or any particular security or compliance outcome.

18. Liability

Nothing in the agreement excludes or limits liability that cannot lawfully be excluded or limited under the laws of Scotland, including liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.

Subject to the first paragraph of this section, Northloom will not be liable, whether in contract, delict (including negligence), breach of statutory duty or otherwise, for loss of profit, revenue, business, anticipated savings, goodwill, opportunity or contracts; loss or corruption of data; business interruption; or indirect or consequential loss, in each case arising out of or in connection with the agreement, even if foreseeable (each category being independent and severable).

Subject to the first paragraph of this section, Northloom’s total aggregate liability arising out of or in connection with the agreement, whether in contract, delict (including negligence), breach of statutory duty or otherwise, will not exceed the fees paid by Customer for Dokima during the 12 months immediately preceding the event giving rise to the first claim. For a free programme, that cap is £100.

Customer is responsible for maintaining appropriate backups, isolation and security controls, for its selected AI models and runners, and for human validation of output. The exclusions and cap reflect the fees and allocation of risk agreed by the parties between businesses.

19. Changes to these terms

Northloom may update these terms for future Orders and renewals. A material change during a current Subscription Term will take effect only where required by law or reasonably necessary to protect Dokima or its users; otherwise it takes effect at renewal after at least 30 days’ notice. If a legally or security-required change materially disadvantages Customer, Customer may terminate before it takes effect and receive a refund of prepaid fees for the unused period.

20. Private team accounts and optional hosted reports

An organisation account is required for new trial and purchase requests. Individuals register a username and a long password and may add passkeys. Accounts are never automatically merged by matching email. Passkeys are optional until the individual explicitly requires them; password sign-in and email recovery are then disabled, and support cannot bypass that requirement. Customers must keep independent backup passkeys and another authorised owner. The organisation owns its subscription and licences. Owners control billing and ownership; owners/admins administer invited membership and publishing installations; viewers can read private reports. Customers must maintain authorised owners and promptly remove departed members. Existing customers can claim their subscription through the verified billing mailbox without reactivating installed software; disputed or conflicting ownership requires manual verification.

Local HTML reports remain available. Private Dokima.net publishing begins only after a user confirms the publishing choice and an authorised owner/admin links the installation to the organisation. Publishing includes report findings, evidence (which may contain source excerpts or personal data), repository/component information and worker status. Customer instructs Northloom to store and display this data privately for its invited team, subject to the hosted data-processing terms. It is not public disclosure and is separate from the open-source programme.

Customer retains its rights in uploaded materials and grants only the rights needed to operate the requested hosted service. Turning publishing off stops future uploads; owners/admins can separately revoke credentials or delete hosted report data. Only the latest complete report is retained per installation. Inactive report/status payloads expire after 30 days without contact, with hourly cleanup. Active payload deletion is immediate; recovery copies expire under the managed backup schedule. Hosted availability has no additional service-level commitment unless expressly agreed. Customers should retain their local report and not rely on hosted copies as a backup.

21. General

Neither party is liable for delay caused by events beyond its reasonable control, except Customer’s payment obligations. Customer may not assign, novate or otherwise transfer the agreement or any rights or obligations under it without Northloom’s prior written consent; Northloom may assign or transfer it as part of a reorganisation or sale of its business or relevant assets.

Notices must be in writing. Notices to Northloom should be sent to contact@northloom.ai; operational support messages may be sent to support@dokima.net. Notices to Customer may be sent to the account or billing contact in the Order.

The agreement is the entire agreement about its subject and replaces earlier statements on that subject. Neither party relies on a statement not set out in it, without limiting liability for fraud or fraudulent misrepresentation. A delay in enforcing a right is not a waiver. If a provision is unenforceable, it will be adjusted to the minimum extent necessary and the remainder will continue. Nothing creates a partnership, agency or employment relationship. This agreement does not create any rights in favour of any person who is not a party to it, whether under the Contract (Third Party Rights) (Scotland) Act 2017 or otherwise.

22. Governing law and courts

The agreement and any non-contractual obligations or disputes arising out of or in connection with it are governed by the laws of Scotland. The courts of Scotland have exclusive jurisdiction.