Launch Lock terms of service
Version 1 · Last updated: 2026-11-08
These terms apply when you order Launch Lock from Rotomal. They sit alongside our general terms, privacy policy and refund policy; where they differ, these product terms apply to Launch Lock.
Who provides the service
Launch Lock is provided by Rotomal, Israel ("we"). Contact: hello@rotomal.com.
The service
Launch Lock is a one-time, fixed-scope security check of one live app built with an AI builder. We test it from the outside with what a browser receives (plus your test accounts on the Full audit) and deliver a ranked findings report with fixes, then re-test after you apply them.
What is included
- Quick check: anonymous read and write test on every table, secrets scan of the browser bundle, public storage bucket check, ranked findings with copy-paste fixes and one re-test.
- Full audit: everything in Quick check plus cross-user tests with your two test accounts, edge function, API and CORS checks, an auth, role and rate-limit review, Firebase rules if used, and a re-test with a dated summary report.
- Audit + fixes: everything in Full audit plus writing and applying RLS policies and rules, pull requests on your GitHub repository, key rotation guidance, a second re-test after deployment and a 30-minute review call.
- Report within 2 business days of receiving the URL and test accounts; any critical finding or exposed key reported the same day.
- Re-test usually done within one business day of your request.
Plans and prices
| Plan | Price | Covers |
|---|---|---|
| Quick check | $29 one-time | A side project or MVP before its first real users |
| Full audit | $129 one-time | Apps with logins, payments or personal data |
| Audit + fixes | $349 one-time | When you want the gaps closed for you |
One-time price per app, paid once after we confirm the scope. No subscription. A re-test after your fixes is included in every plan. Founding customer pricing applies to early-access orders.
Prices are founding-customer prices for early-access orders. Taxes are added where the law requires.
Limits and extra use
One purchase covers one app and the scope of the chosen plan. Quick check and Full audit include one re-test; Audit + fixes includes a second re-test after deployment. Additional apps, scope beyond the plan or further re-tests are quoted by email before we start and are never charged without your written OK.
How an order starts
Submitting a request does not create a contract or a charge. A contract starts only when we confirm your order by email and payment has been agreed. We start within 2 business days of that confirmation.
Billing, cancellation and refunds
This is a one-time service, paid once after we confirm the scope by email. There is no subscription and nothing renews. If we cannot deliver what was agreed, you are refunded in full.
Refunds and cancellations also follow our refund policy. rotomal.com/refund-policy/
What is not included
- This is not a full penetration test.
- We do not certify compliance with SOC 2, ISO 27001, HIPAA, GDPR or any other standard.
- We do not run destructive or high-volume tests against production.
- We do not test anything outside the agreed scope and time window, or any app without the owner's written authorization.
- We do not promise that the app has no other vulnerabilities after the check.
- We do not rotate your keys for you; we explain how to do it in the provider's dashboard.
Your responsibilities
- Confirm in writing, before any test, that you own the app or have written authorization from the system owner, and sign the one-page authorization.
- Give us an accurate live URL, builder and backend details, and the two test accounts.
- Make sure you have the right to share any credentials, repository access or data you send us.
- Review our findings and fixes before you apply them, and test them in your app; on Audit + fixes, review our pull requests before merging.
- Rotate any exposed secret, treating it as compromised even after it is removed from the code.
- On Audit + fixes, revoke the time-limited database role and repository access when the job closes.
- You use the service only for lawful purposes and keep your account details safe.
Regulatory status
Launch Lock is a fixed-scope security check, not a full penetration test, not an accredited auditor and not a compliance certification. Before any test, you confirm in writing that you have authorization from the owner of the system, and we test only within the agreed scope and time window. You stay responsible for your app, its security, the fixes you deploy and your obligations to your users, payment providers and any authority. Our dated summary states what was tested; it is not a guarantee that the app is secure.
Outside services
- Supabase and Firebase: changes to their access rules, auth or storage behaviour can change what is exposed after our check.
- Lovable, Bolt, v0, Replit and Cursor: later changes made by your builder can reopen gaps we confirmed as closed.
- GitHub: on Audit + fixes, pull requests depend on the repository access you grant; if access is removed or GitHub is unavailable, delivery of fixes may be delayed.
- Stripe, Lemon Squeezy and other key providers: key rotation is done in their dashboards and follows their rules.
The service relies on systems run by others. We are not responsible for their availability, changes or decisions; when one of them changes, we adapt the service as soon as we reasonably can.
Your data
Data and files you send stay yours. We process them only to provide Launch Lock, as described in our privacy policy, keep them no longer than the service needs, and delete them on request when the service ends.
Early access and errors
Launch Lock is an early-access service, provided as is and as available. We work carefully, but output can contain errors. If you show us an error in our output, we correct it and redo the affected work at no charge; this is your main remedy for errors.
No professional advice
Launch Lock is a software and data service. It is not legal, tax, customs, accounting, insurance or other professional advice. Confirm decisions that depend on such advice with a qualified professional.
Liability
- Our total liability for all claims about Launch Lock is limited to the fees you paid us for Launch Lock in the 12 months before the claim.
- We are not liable for indirect or consequential loss, lost profit or revenue, or for fines, penalties, duties, taxes, surcharges, interest or chargebacks imposed on you by an authority, carrier, marketplace, bank or other third party, even where our output was used.
- Nothing in these terms limits liability that the law does not allow to be limited, including for fraud, intent or gross negligence, death or personal injury, or the mandatory rights of consumers.
Suspension and ending the service
We may suspend the service if it is used unlawfully or against these terms. We may also stop offering Launch Lock; if we do, we give paying customers at least 30 days' notice by email and refund any prepaid period not used.
Changes to these terms
We may update these terms. For existing customers, changes take effect 30 days after we email them and never change a price we have already confirmed to you. The date at the top shows the current version.
Law and disputes
These terms are governed by the laws of the State of Israel, and disputes go to the competent courts in Israel. If you are a consumer, you keep the protection of the mandatory laws of the country where you live and may also bring a claim there.
Contact
Questions about these terms: hello@rotomal.com.