MMeridian

Meridian Semantic Terms of Service

Last updated: [PLACEHOLDER: effective date]

These Terms of Service (these "Terms") are a binding agreement between [PLACEHOLDER: legal entity name, e.g., "Meridian Semantic, Inc.", a [state] corporation with its registered address at [address]] ("Meridian," "we," "us") and the company or other legal entity you represent ("Customer," "you"). They govern your access to and use of Meridian's hosted software service available at app.meridiansemantic.com, including its web application, APIs, integrations, and related documentation (collectively, the "Service").

By clicking "I agree," creating an account, or using the Service, you accept these Terms. If you do not agree, do not use the Service.

1. Acceptance and Who May Use the Service

1.1 Business use only. The Service is a business tool offered to companies and teams. It is not intended for personal, family, or household use, and it is not directed to consumers.

1.2 Authority. You represent that you are entering into these Terms on behalf of a company or other legal entity, that you have the authority to bind that entity, and that the entity accepts these Terms. If you do not have that authority, you may not accept these Terms or use the Service.

1.3 Minimum age. You must be at least 16 years old to use the Service.

1.4 Eligibility. You may not use the Service if you are barred from doing so under applicable law, or if we have previously suspended or terminated your access for breach of these Terms.

2. The Service

2.1 What Meridian does. Meridian is a deployment-visibility and release-intelligence platform for software teams. When you connect your GitHub organization through Meridian's GitHub App, the Service ingests deployment, release, pull request, commit, and CI workflow events and presents them in a real-time dashboard showing which version of each service is running in each environment, together with deployment history, drift indicators, approvals, and an audit trail. The Service also offers:

  • AI-assisted features — generated release changelogs, plain-language service summaries ("feature pages"), and a chat assistant that answers questions about your deployments and releases (see Section 7);
  • Slack notifications — deploy, promotion, rollback, and approval notifications posted to Slack channels you designate, plus slash commands;
  • A deploy-sync REST API — token-authenticated endpoints for reporting deployment status from your own CI/CD pipelines; and
  • Codebase graph publishing — an optional integration that lets you upload a code-structure knowledge graph generated by tooling running in your own CI environment (see Section 6.5).

2.2 What Meridian stores. The Service is designed to work from repository metadata — commit messages, pull request titles and descriptions, release notes, branch and tag names, CI and deployment status, and contributor identifiers — rather than your source code. The Service does not pull or store your repository file contents or code diffs. Data you choose to upload through the codebase graph integration is stored as you submit it (Section 6.5).

2.3 Changes to the Service. The Service will evolve. We may add, modify, or remove features, provided that we will not materially reduce the core functionality of a paid subscription during its then-current term. Where a change is material and adverse, we will use reasonable efforts to notify you in advance.

2.4 Beta and pilot features. We may offer features identified as beta, pilot, preview, or early access. These are provided as-is, may be changed or discontinued at any time, and are excluded from any support or availability commitments.

3. Accounts and Workspaces

3.1 Workspaces and members. The Service is organized into workspaces (accounts). A workspace is controlled by its administrators, who may invite and remove members, assign roles (such as admin, deployer, approver, and viewer), manage integrations, issue and revoke API keys, and view the workspace audit log. You are responsible for the choices your administrators make, including who is granted access and at what role.

3.2 Credentials. You are responsible for maintaining the confidentiality of all credentials used to access your workspace — passwords, session cookies, invitation links, and API keys — and for all activity that occurs under them. API keys grant programmatic access at the scope assigned to them; treat them as secrets, rotate them when personnel change, and revoke them promptly when no longer needed.

3.3 Accurate information. You agree to provide accurate account information and keep it current.

3.4 Notify us of compromise. If you become aware of unauthorized access to your workspace or credentials, notify us promptly at [email protected].

3.5 Sign-in. The Service supports sign-in with Google and with email and password. Your use of Google sign-in is also subject to Google's terms (Section 9).

4. Subscriptions, Fees, and Billing

4.1 Plans. The Service is offered in tiered subscription plans — currently Pilot (free), Team, and Enterprise — with the features, usage limits, and prices described on our pricing page or in an order form we both agree to (each an "Order"). AI-assisted features may be subject to usage allowances; when an allowance is exhausted, AI features may be reduced or paused for the remainder of the billing period while the rest of the Service continues to work.

4.2 Free plans. Free plans are provided for evaluation and light use. We may change free plan limits or features, or discontinue free plans, on reasonable notice.

4.3 Fees and payment. Fees for paid plans are billed in advance, in U.S. dollars, at the interval you select (monthly or annually), through our third-party payment processor. Except where prohibited by law, fees are exclusive of taxes; you are responsible for all applicable sales, use, VAT, GST, and similar taxes, excluding taxes on our net income. [PLACEHOLDER: confirm payment processor (Stripe planned, not yet live) and card-on-file/invoicing mechanics before publication.]

4.4 Renewal and cancellation. Paid subscriptions renew automatically for successive terms equal to the then-current term unless either party cancels before renewal. [PLACEHOLDER: confirm auto-renewal mechanics and cancellation notice period, e.g., cancel any time effective at the end of the current billing period; check applicable auto-renewal statutes.]

4.5 Refunds. Except as required by law or expressly stated in an Order, fees are non-refundable and payment obligations are non-cancelable. [PLACEHOLDER: confirm refund policy.]

4.6 Price changes. We may change prices effective at your next renewal, with at least [PLACEHOLDER: 30] days' notice before the renewal date.

4.7 Downgrades. If you downgrade, features and limits of the lower tier apply from the start of the next billing period. Downgrading may result in loss of access to features or data associated with the higher tier. [PLACEHOLDER: confirm downgrade/data-limit behavior once billing ships.]

4.8 Overdue amounts. If undisputed fees are overdue, we may suspend the Service in accordance with Section 10.3 after at least 10 days' written notice.

5. Acceptable Use

You will use the Service only for lawful business purposes and in accordance with our Acceptable Use Policy at app.meridiansemantic.com/legal/acceptable-use, which is incorporated into these Terms. In short: no unauthorized access or security probing outside your own workspace; no interference with the Service or its rate limits; no uploading unlawful or infringing content; no reselling or white-labeling the Service without our written agreement; and no use of the Service to build a competing product by systematic extraction. We may investigate suspected violations and take reasonable action, including suspension under Section 10.3.

6. Customer Data

6.1 Your data is yours. "Customer Data" means all data you or your users submit to the Service or authorize the Service to ingest on your behalf, including repository metadata ingested from GitHub (commit messages, pull request titles and descriptions, release notes, contributor names and email addresses, deployment and CI events), codebase graphs you upload, chat prompts and conversation history, workspace configuration, and content generated for you from your data. As between you and Meridian, you own all right, title, and interest in Customer Data, including your code and anything derived from it. These Terms grant Meridian no rights in Customer Data other than the limited license below.

6.2 Limited license to us. You grant Meridian a limited, non-exclusive, worldwide, royalty-free license to host, copy, transmit, process, display, and create derivative presentations of Customer Data solely (a) to provide, maintain, secure, and support the Service; (b) as you or your administrators instruct through the Service's features (for example, sending a deployment notification to your Slack channel, or — if we later engage a third-party AI provider — submitting content to that provider when you use an AI feature); and (c) as required by law. This license ends when Customer Data is deleted from the Service, subject to Section 10.5.

6.3 Your responsibilities for Customer Data. You represent that you have all rights, consents, and permissions needed to submit Customer Data to the Service and to grant the license in Section 6.2 — including with respect to personal data of your own personnel and contributors (such as commit author names and email addresses) contained in the repositories and tools you connect. You are responsible for the accuracy and legality of Customer Data and for your decisions about which repositories, organizations, and channels to connect.

6.4 Aggregated and de-identified data. [PLACEHOLDER: decide whether to keep this section.] Meridian may generate and use data about the operation and use of the Service in aggregated or de-identified form that does not identify you, your users, or your code, to operate, benchmark, and improve the Service. Meridian will not re-identify such data or represent it as attributable to you.

6.5 Codebase graphs. The codebase graph integration runs analysis tooling in your CI environment, using your own compute and (if applicable) your own AI provider credentials; your source code is not transmitted to Meridian by that tooling. What Meridian receives and stores is the generated graph file you upload — typically file paths, component summaries, and relationships. You control the content of uploaded graphs and are responsible for ensuring they do not include material you do not want stored in the Service.

6.6 Data protection. Where Meridian processes personal data contained in Customer Data on your behalf, Meridian does so as a processor/service provider under our Data Processing Addendum ("DPA"), available on request from [email protected] and incorporated into these Terms where such processing occurs. [PLACEHOLDER: finalize the DPA and be ready to execute it with customers on request before publication — a template lives in the repo at docs/legal/dpa-template.md.] Our Privacy Policy at app.meridiansemantic.com/legal/privacy describes our privacy practices, and our current subprocessor list is maintained at app.meridiansemantic.com/legal/subprocessors.

6.7 Security. Meridian maintains administrative, technical, and organizational safeguards designed to protect Customer Data, including encryption of data in transit, hashed or encrypted storage of credentials and tokens, role-based access controls, and an append-only audit log of privileged workspace actions. Our security program is designed to align with the SOC 2 Trust Services Criteria, and we are preparing for a SOC 2 Type II audit. A summary of our current practices is available from [email protected].

7. AI Features

7.1 How AI features work. Certain features — generated changelogs, project summaries, and the chat assistant — apply large language models to the engineering metadata your workspace has ingested (commit messages, pull request titles and descriptions, release notes, project and environment names, deployment metadata, and, for the chat assistant, your prompts and conversation history). The Service does not process your repository file contents or code diffs with these features. Meridian does not currently send Customer Data to any third-party AI provider to operate these features, and no AI vendor appears on our subprocessor list at app.meridiansemantic.com/legal/subprocessors. If we engage a third-party AI provider in the future, we will add it to that list and notify you in advance before it begins processing Customer Data.

7.2 Use of your data. We do not use Customer Data to train AI models, and we do not sell or share Customer Data with third parties for their own purposes. Because Meridian does not currently route Customer Data to any third-party AI provider, no such provider receives your data through our AI features. If we engage a third-party AI provider in the future, we will do so under commercial (not consumer) terms and will not permit it to use Customer Data to train its generally available models.

7.3 AI output. AI-generated content is produced by statistical models and may be inaccurate, incomplete, or misleading. AI output is provided for convenience and must not be relied on as the sole basis for operational, legal, or compliance decisions. You are responsible for reviewing AI output before acting on it or distributing it. As between the parties, AI output generated from your Customer Data is part of Customer Data.

7.4 Availability. AI features are subject to usage allowances (Section 4.1) and, where they rely on any third-party provider we may engage, to that provider's availability; they may be modified, throttled, or suspended if an underlying model or service changes or is discontinued.

8. Acceptable Use Policy Reference

Your use of the Service is subject to the Acceptable Use Policy referenced in Section 5. If there is a conflict between the Acceptable Use Policy and these Terms, these Terms control.

9. Third-Party Integrations

9.1 Your integrations, your authorization. The Service interoperates with third-party services you choose to connect, including GitHub (repository and deployment event ingestion via our GitHub App), Slack (notifications and slash commands), and Google (sign-in). By connecting an integration, you authorize Meridian to access and receive data from that service on your behalf, within the permissions you grant during setup, and you instruct Meridian to exchange data with that service as needed to operate the feature.

9.2 Third-party terms apply. Your use of each third-party service is governed by your agreement with that provider, not by these Terms. Meridian is not responsible for third-party services, their availability, or changes to their APIs, and integration functionality may change or stop working if a provider changes or withdraws its APIs.

9.3 Disconnecting. You may disconnect an integration at any time from workspace settings. Disconnecting stops future data exchange with that provider; data already ingested into the Service remains in your workspace until deleted in accordance with these Terms. [PLACEHOLDER: confirm the deletion posture for disconnected integrations before publication — today, disconnects retain previously ingested data and stored integration credentials.]

10. Term, Suspension, and Termination

10.1 Term. These Terms start when you first accept them and continue until all subscriptions have expired or been terminated and all workspaces you control are closed.

10.2 Termination. Either party may terminate these Terms or any subscription (a) for convenience, effective at the end of the then-current subscription term, by notice before renewal; or (b) for cause, if the other party materially breaches these Terms and does not cure within 30 days of written notice, or immediately upon the other party's insolvency or an uncured breach incapable of cure. You may stop using a free plan at any time.

10.3 Suspension. We may suspend the Service, or a feature, wholly or partly, if: (a) undisputed fees are overdue beyond the notice period in Section 4.8; (b) your use poses a security risk to the Service or others, or violates the Acceptable Use Policy or Section 5; or (c) suspension is required by law. We will limit suspensions in scope and duration to what is reasonably necessary, and where practicable we will give notice and an opportunity to cure before suspending.

10.4 Data export. For [PLACEHOLDER: 30] days after termination or expiration, we will, on your written request, make Customer Data available for export in a machine-readable format. After that window, we have no obligation to retain Customer Data.

10.5 Deletion. Following the export window, we will delete or de-identify Customer Data within [PLACEHOLDER: 60] days, except that (a) Customer Data in routine backups will be deleted in the ordinary course of backup rotation, and (b) we may retain data we are required to keep by law and minimal records needed for billing, security, and dispute resolution, which remain protected under these Terms. [PLACEHOLDER: ENGINEERING PREREQUISITE — account-deletion tooling does not exist yet and the audit log is append-only at the database level; build the deletion capability or adjust these windows before publishing.]

10.6 Survival. Sections that by their nature should survive termination do survive, including Sections 6.1, 10.4–10.6, 11, 12, 13, 14, 15, 16, and 17.

11. Confidentiality

11.1 Definition. "Confidential Information" means non-public information disclosed by one party to the other under these Terms that is designated confidential or that reasonably should be understood to be confidential, including Customer Data (your Confidential Information) and non-public information about the Service, security practices, and pricing (our Confidential Information). It excludes information that is or becomes public without breach, was known to the recipient without restriction before disclosure, is independently developed without use of the discloser's information, or is rightfully received from a third party without duty of confidentiality.

11.2 Obligations. The receiving party will use the discloser's Confidential Information only to perform under these Terms, protect it with at least reasonable care, and not disclose it except to employees, affiliates, contractors, and subprocessors who need it and are bound by obligations at least as protective. Each party remains responsible for its representatives' compliance.

11.3 Compelled disclosure. A party may disclose Confidential Information to the extent required by law or court order, provided it gives prompt notice (where legally permitted) and reasonable cooperation so the discloser may seek protective treatment.

11.4 Remedies. Unauthorized use or disclosure of Confidential Information may cause harm for which damages are inadequate; the discloser may seek injunctive relief in addition to other remedies.

12. Intellectual Property

12.1 Our IP. Meridian and its licensors own the Service, including all software, interfaces, designs, documentation, and all improvements — and all intellectual property rights in them. Except for the limited rights expressly granted in these Terms, no rights in the Service are granted to you, whether by implication, estoppel, or otherwise. You will not copy, modify, create derivative works of, reverse engineer, or attempt to extract the source code of the Service, except to the extent such restriction is prohibited by law.

12.2 Your license to use the Service. Subject to these Terms and payment of applicable fees, Meridian grants you a non-exclusive, non-transferable right during the subscription term for your users to access and use the Service for your internal business purposes.

12.3 Feedback. If you give us suggestions, ideas, or other feedback about the Service, you grant Meridian a perpetual, irrevocable, worldwide, royalty-free license to use it without restriction or obligation to you. Feedback does not include Customer Data.

13. Warranties and Disclaimers

13.1 Mutual warranties. Each party warrants that it has the legal power to enter into these Terms.

13.2 Our warranty. For paid subscriptions, Meridian warrants that the Service will perform materially in accordance with its documentation. Your exclusive remedy for breach of this warranty is that we will use commercially reasonable efforts to correct the non-conformity, and if we cannot do so within a reasonable time, you may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees for the remainder of the term.

13.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 13, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." MERIDIAN DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. MERIDIAN DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DATA WILL NOT BE LOST, OR THAT AI OUTPUT WILL BE ACCURATE OR COMPLETE. FREE PLANS AND BETA FEATURES ARE PROVIDED WITHOUT ANY WARRANTY OR SUPPORT COMMITMENT. THE SERVICE IS A VISIBILITY AND REPORTING TOOL; IT DOES NOT OPERATE YOUR PRODUCTION SYSTEMS, AND YOU REMAIN RESPONSIBLE FOR YOUR OWN DEPLOYMENT DECISIONS AND CHANGE-MANAGEMENT CONTROLS.

14. Limitation of Liability

14.1 Exclusion of indirect damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF GOODWILL, OR LOSS OF DATA (OTHER THAN A PARTY'S DATA-PROTECTION OBLIGATIONS EXPRESSLY STATED IN THESE TERMS OR THE DPA), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

14.2 Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY CUSTOMER TO MERIDIAN FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY [PLACEHOLDER: confirm cap; consider adding a dollar floor, e.g., "or $[amount], whichever is greater," so the cap is not zero for free-plan customers].

14.3 Carve-outs. The exclusions and cap above do not apply to: (a) a party's indemnification obligations under Section 15; (b) a party's breach of Section 11 (Confidentiality) [PLACEHOLDER: decide whether Customer Data/security incidents fall under a separate super-cap instead]; (c) Customer's payment obligations; (d) a party's infringement or misappropriation of the other party's intellectual property; or (e) a party's gross negligence, fraud, or willful misconduct. [PLACEHOLDER: attorneys should confirm this carve-out list and whether to add a "super-cap" (e.g., 2–3x fees) for data-protection breaches instead of unlimited exposure.]

14.4 Basis of the bargain. The parties agree that this Section 14 reflects the allocation of risk between them and that these limits apply regardless of the theory of liability and even if a remedy fails of its essential purpose.

15. Indemnification

15.1 By Meridian. Meridian will defend Customer against any third-party claim alleging that the Service, as provided by Meridian and used in accordance with these Terms, infringes that third party's patent, copyright, or trademark, or misappropriates its trade secrets, and will indemnify Customer for damages, costs, and reasonable attorneys' fees finally awarded or agreed in settlement for such claim. If the Service is subject to such a claim, Meridian may, at its option, procure the right for Customer to continue using it, modify it to be non-infringing, or terminate the affected subscription and refund prepaid, unused fees. Meridian's obligations do not apply to claims arising from Customer Data, combinations of the Service with items not provided by Meridian, use in violation of these Terms, or free or beta features.

15.2 By Customer. Customer will defend Meridian against any third-party claim arising from (a) Customer Data, including claims that Customer lacked the rights or consents required by Section 6.3; or (b) Customer's use of the Service in violation of these Terms, the Acceptable Use Policy, or applicable law, and will indemnify Meridian for damages, costs, and reasonable attorneys' fees finally awarded or agreed in settlement for such claim.

15.3 Procedure. The indemnified party must give prompt written notice of the claim, allow the indemnifying party sole control of the defense and settlement (provided any settlement fully releases the indemnified party and imposes no obligations on it beyond ceasing use), and provide reasonable cooperation at the indemnifying party's expense. This Section 15 states each party's exclusive remedy for the third-party claims it covers.

16. Modifications to These Terms

We may update these Terms from time to time. If a change is material, we will give at least [PLACEHOLDER: 30] days' notice by email to workspace administrators or by in-app notice before it takes effect; non-material changes take effect on posting. Changes apply from their effective date and do not apply retroactively. If a material change adversely affects you, you may terminate the affected subscription before the change takes effect and receive a pro-rata refund of prepaid, unused fees. Continued use of the Service after a change takes effect constitutes acceptance.

17. General

17.1 Governing law and venue. These Terms are governed by the laws of [PLACEHOLDER: governing law, e.g., the State of Delaware], without regard to conflict-of-laws rules. The parties consent to the exclusive jurisdiction and venue of the state and federal courts located in [PLACEHOLDER: venue], and each party waives objections to that forum. The U.N. Convention on Contracts for the International Sale of Goods does not apply. [PLACEHOLDER: decide whether to add an arbitration clause instead of court venue.]

17.2 Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign them in connection with a merger, acquisition, or sale of all or substantially all of its assets, with notice to the other party. Any other attempted assignment is void.

17.3 Force majeure. Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, governmental action, internet or utility failures, and failures of third-party hosting or communications providers, provided the affected party uses reasonable efforts to mitigate.

17.4 Entire agreement; order of precedence. These Terms, together with the Acceptable Use Policy, the Privacy Policy, the DPA (where applicable), and any Orders, are the entire agreement between the parties regarding the Service and supersede all prior or contemporaneous agreements on that subject. If there is a conflict, the order of precedence is: (1) the Order, (2) the DPA (for personal-data processing), (3) these Terms, (4) the policies incorporated by reference. Terms in a Customer purchase order or vendor form are void.

17.5 Severability; waiver. If any provision of these Terms is held unenforceable, it will be modified to the minimum extent necessary to be enforceable, and the rest remains in effect. A failure to enforce a provision is not a waiver.

17.6 Notices. Legal notices to Meridian must be sent to [email protected] [PLACEHOLDER: and to Meridian's registered/postal address]. Notices to Customer may be sent to the email addresses of workspace administrators or posted in the Service. Notices are deemed given when received (email) or when posted (in-app).

17.7 Relationship; no third-party beneficiaries. The parties are independent contractors. These Terms create no partnership, agency, or employment relationship, and there are no third-party beneficiaries.

17.8 Publicity. [PLACEHOLDER: decide whether to keep.] Meridian may identify Customer by name and logo as a customer in its marketing materials, subject to Customer's brand guidelines if provided; Customer may opt out at any time by emailing [email protected].

17.9 Export and sanctions compliance. Each party will comply with applicable export-control and sanctions laws. You represent that you are not located in, or owned or controlled by parties in, an embargoed jurisdiction and are not on any restricted-party list.

17.10 Insurance. [PLACEHOLDER: decide whether to include an insurance representation (e.g., "Meridian maintains commercially reasonable insurance coverage, including cyber liability insurance") once policies are bound; omit until true.]

18. Contact