App Audit
App Audit terms of service and privacy notice
Effective date: 28 October 2026.
The App Audit is a service of Impossible Means Go™, a program of DF5 Holdings LLC, 12352 Wilkins Avenue, Rockville, MD 20852, United States (“we”, “us”). These terms apply to every App Audit order. By ticking the terms box on the order form, you agree to these App Audit terms and to the Impossible Means Go site Terms and Conditions and Privacy Policy. Where these App Audit terms and the site Terms and Conditions disagree about an App Audit order, these App Audit terms apply.
1. What the App Audit is
We read the source code in one GitHub repository you choose and send you a written report on what we found. The report covers the areas listed in it, and for each area says what we found, that we checked it and found nothing, or that we did not check it and why.
What the App Audit is not:
- It is not a test of your live app, website, hosting, database or accounts. We read code only.
- It is not a fix. We do not change your code or fix anything for you.
- It is not a certificate, a compliance assessment or legal advice.
2. No promise that your app is secure
Reading code cannot prove that an app is secure, and the report never says that it is. A report that finds few or no problems means we did not find them in the code we read. It does not mean your app has no problems. Problems can sit in settings, services and data we cannot see, and new problems can arrive with any later change to the code.
The App Audit is provided “as is”. To the fullest extent the law allows, we make no warranty of any kind, express or implied, that your app is secure, that the report is complete or free of errors, or that following it will prevent a breach, loss or claim. You decide what to change, and you remain responsible for your app and for the data your customers trust you with.
3. What you need before you order
- Your code must be in a GitHub repository, public or private.
- You must be able to install our GitHub app on that repository, and the GitHub account you sign in with during the install must have write or admin access to it. This is how we confirm the repository is yours to have read.
- You may only order an audit of code you own or have the right to have reviewed.
- You are responsible for making sure you have the right to send the repository’s contents to us and our providers for the App Audit. Do not connect a repository that holds sensitive personal data, regulated data or another party’s confidential information unless you have the right to have it processed as these terms describe.
4. How we handle your code
- Read only. Our GitHub app asks GitHub for read access to repository contents and metadata, and no write access. It can only read the one repository you choose. You can remove it at any time in GitHub, under Settings, Applications, Installed GitHub Apps.
- Never changed, run, sold or published. We read your code. We never change it, never run it, and never sell or publish it.
- Read in an isolated environment. Each audit runs in a separate, temporary environment that is cut off from the internet before your code is read, and holds no keys or passwords of ours.
- Read by an AI model, through a business service. To read it, your code is sent to an AI model provided by Anthropic, PBC, under Anthropic’s Commercial Terms of Service. As of the effective date above, those terms say: “Anthropic may not train models on Customer Content from Services.”
- How long Anthropic keeps it. Under its published standard terms, Anthropic deletes what we send within 30 days of receiving it. It may keep material longer if it is flagged as breaking Anthropic’s usage policy, where needed to enforce that policy, or where the law requires it.
- Our copy is deleted. Our copy of your code is deleted when your report is done. The report shows the date and time it was deleted.
- Nobody at our company opens your code. Only the AI reads it. People at our company review your report before it is sent to you.
5. Your report
- Delivery. We email you a private link to your report within 2 business days after both your payment is complete and your repository has been connected and confirmed. Business days are Monday to Friday; we do not send reports on Saturday or Sunday (Manila time).
- What it contains. Findings, how serious each one is, why it matters, and a suggested change. To point you at a problem, the report quotes the file, the line and short pieces of your code. Our tools and our reviewer are instructed not to repeat a password, key or personal detail in the report. Where we find one, the report says where it is and tells you to replace, remove or change it, without showing the value.
- Who can open it. Anyone who has the link can open the report, so treat the link as private.
- How long it lasts. The report link stops working 30 days after it is sent. You can ask us to remove it sooner by replying to the email or writing to the address in section 10. Save your own copy if you want to keep it.
- It is yours to use. You may use the report however you like, including giving it to your AI tool, your developer or your customers.
6. Price and payment
The App Audit costs $97 (US dollars), paid by card through Stripe when you order. Discount codes are not accepted.
7. Refunds
We refund you in full, to the card you paid with, if:
- we cannot access your repository;
- our audit fails to complete (for example, it runs over our time or size limits);
- you have not connected your repository within 72 hours of paying. We remind you once, at about 24 hours, before this happens.
If you want a refund for another reason, write to us at the address in section 10 before your report is sent. Once we send the report link, the audit has been delivered and is not refundable, except where the law requires a refund or where we find the report was not delivered as these terms describe. Nothing here limits a right you cannot give up under the consumer law where you live.
8. Limitation of liability
To the fullest extent the law allows, DF5 Holdings LLC is not liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, loss of goodwill, business interruption or loss of data, arising from the App Audit, the report, or anything you do or do not do because of it. To the fullest extent the law allows, our total liability for an App Audit order is limited to the amount you paid for that order. These limits do not apply where the law does not allow them, or to liability for our fraud, willful misconduct or gross negligence.
Privacy notice for the App Audit
This section adds to the Impossible Means Go Privacy Policy for App Audit orders.
9. What we collect and keep
| What | Why | How long |
|---|---|---|
| Your name, email, business name and repository link, from the order form | To run your order and contact you about it | 7 years after the order (see below) |
| Your payment, handled by Stripe. We receive the payment record, not your card number | To take payment and issue refunds | 7 years after the order (see below) |
| Your GitHub username, from the install sign-in | To confirm the repository is yours to have read | 7 years after the order (see below) |
| The referral that brought you, if any | To pay the partner who referred you | 7 years after the order (see below) |
| Your contact record and order tag in our customer system (GoHighLevel) | To send your receipt and report and to tell you about our other services | Marketing contact record: until you unsubscribe or ask us to remove it. Order records: 7 years after the order (see below) |
| Your report | So you can read it | 30 days after it is sent, or sooner if you ask |
| Your code | To read it | Deleted when your report is done (our copy); within 30 days under Anthropic’s standard terms (their copy), with the exceptions in section 4 |
After 7 years, order records are deleted or made anonymous, unless we need to keep them longer for a dispute, a fraud or security issue, or a tax, accounting or legal requirement.
Who handles it for us: Stripe (payments), GitHub (repository access), GoHighLevel (contact records and email), Anthropic (reading the code), and Vercel (hosting the order system and the report). If a partner referred you, we may share what is needed to confirm and pay the referral, such as the fact that an eligible order was placed.
Where it is handled, and on what basis. DF5 Holdings LLC is based in the United States, and we and the providers above may process information in the United States and other countries. Where EU or UK data protection law applies, we rely on our contract with you to run the App Audit; on our legitimate interests to secure the service, keep business records and improve our services; on legal obligations for tax, accounting and compliance records; and on consent or opt-out rules where they are required for marketing. Where required, we rely on our providers’ data-processing terms and transfer safeguards such as standard contractual clauses. Your repository’s contents are processed only to provide the App Audit. If your repository holds personal data you are responsible for, you authorise us and the providers above to process it for the App Audit as these terms describe.
Email from us. Your receipt, a reminder if your repository is not connected, and your report are sent to the email you gave. We may also send you information about our other services; every such email has an unsubscribe link.
10. Your choices and how to reach us
You can ask us to remove your report early, to stop emailing you, or, where those rights apply, to access, correct, delete, restrict or object to our use of your personal information. We may keep order, payment, security, tax, accounting and legal records for the periods in section 9 even after removing you from marketing or deleting other contact details.
If you are in the EU or UK, you may also have the right to data portability and to complain to your local data protection authority. If you are a California resident, we do not sell or share your personal information for cross-context behavioral advertising, and you may have rights under California law to know, access, correct or delete your personal information.
To make a request, write to atibadesouza@clientattractionpros.com, or call (301) 455-3696.
These terms are governed by the laws of the State of Nevada, USA. We may update them; the version in force when you ordered applies to your order.