The deal, including the parts we can't promise

You may use Install Safe to protect your own installs and your team’s. You pay for the plan you pick, you can leave whenever you like and we refund the part of the month you did not use, and you are responsible for the registry tokens we issue you.

The part worth reading twice is what we do not promise. Install Safe reduces the chance that a known-bad package reaches your machine. It cannot make that chance zero, and nothing here should be read as a guarantee that it does.

What follows is the long version. Like the privacy policy, it is written to be checkable rather than reassuring.

Install Safe is a product of PrivJs OÜ, a private limited company registered in Estonia. PrivJs is the company you are contracting with; Install Safe is the service it provides.

You can reach a human at support@installsafe.io. That address is monitored by the people who build the product, not a ticket queue.

You need an account to use the registry proxy. Give us a working email address, keep your password to yourself, and tell us promptly if you think someone else has got into your account.

Your registry tokens are credentials. Anything installed through one is treated as installed by you, and the activity shows up under your account. The free plan issues 1 token; paid plans issue as many as you need. Revoke a token the moment you suspect it has leaked — revocation takes effect within a minute.

You must be old enough to enter a contract where you live, and if you are opening the account for a company, you need the authority to bind it.

One person, one account. Sharing one login across a team defeats the audit trail you are paying for — that is what team seats are for.

Install Safe sits between you and the npm registry. When you request a package, we check it against your policy and the advisory data we hold, and we refuse to serve versions your policy rejects.

We do not promise that every malicious or vulnerable package will be caught. We check against known advisories — principally OSV.dev — and a package whose problem nobody has published yet will pass, exactly as it would with any other tool built on the same data.

When our advisory sources are unreachable, the proxy is configured to fail open: it serves the package rather than breaking every install in your organisation. We think a failed check is a better outcome than a stalled deployment, but you should know that is the trade-off we made on your behalf, and that a package served during such a window was not checked.

A block is not a verdict on a package or its author. It means the package matched your policy — a severity threshold, a minimum age, an advisory ID — at the moment you asked for it.

The scanner is provided as-is for anyone to use, with no account and no promise about availability.

The free plan costs nothing and needs no card. Pro is $19 per month and starts with a 7-day trial. Team is $25 per seat per month, from 2 seats up to 500; above that, talk to us.

Prices are in US dollars and exclude any tax that applies where you are. Payments are handled by Polar, which acts as merchant of record — they take the payment, they handle the tax, and your card details never touch our servers. Your subscription is with us; the payment transaction is with them.

Subscriptions renew automatically each month until you cancel. We will tell you by email before any price change takes effect, and a price change never applies to a period you have already paid for.

If a payment fails we will retry it and email you. If it keeps failing, the account drops to the free plan rather than being deleted.

Cancel whenever you like, from billing settings. No email, no retention call.

When you cancel mid-period we refund the unused part of that period, pro rata, to the payment method you used. Refunds are issued through Polar and typically take a few working days to appear.

Cancelling a Pro trial before it ends costs nothing — you are not charged until the 7 days are up.

Removing seats from a Team plan is the same arithmetic: the unused portion of the removed seats is credited pro rata.

Do not resell proxy access, or share your tokens with people outside your account or team. If you want to cover more people, add seats.

Do not use Install Safe to distribute malware, to serve packages you do not have the right to serve, or to work around a block on behalf of someone whose policy set it.

Do not attack the service: no attempts to break authentication, no scraping of other accounts’ data, no load deliberately intended to degrade it for others. We rate-limit; do not try to route around it.

Automated and CI traffic is expected and welcome — that is the point of a proxy. Traffic that looks like an attempt to mirror the entire npm registry through us is not, and we will get in touch before doing anything about it.

Your dependencies, your lockfiles and your install history remain yours. We claim no rights over them beyond what running the service requires: caching and serving the packages you request, and keeping the activity record your dashboard is built from.

A shared scan report is published by you, at an unguessable link, and expires on its own. Do not share one containing findings you are not willing to have read by anyone holding the link.

What we collect, why, and for how long is described in full in the privacy policy, which forms part of these terms.

We aim to keep the proxy up continuously and we monitor it, but we do not offer a service level agreement and the free plan carries no availability promise at all.

We will give notice of planned maintenance that we expect to be disruptive. Emergency work — a security fix, a failing dependency — may happen without notice.

Because the proxy sits in your install path, plan for it being unavailable the way you would plan for npm being unavailable.

Install Safe is provided as-is. To the extent the law allows, we exclude the implied warranties — in particular any warranty that the service will be uninterrupted, or that it will detect every threat.

If we are liable to you for anything, our total liability is capped at what you paid us in the twelve months before the claim. On the free plan, that figure is zero, which is worth understanding before you rely on it.

We are not liable for indirect or consequential loss: lost profits, lost data, business interruption, or the cost of an incident caused by a package we did not catch. That last one is the whole point of this section — a security tool that accepted unlimited liability for every miss could not be sold at these prices by anyone.

Nothing here limits liability that cannot be limited by law, including for death, personal injury, or our own fraud or gross negligence. If you are a consumer, your statutory rights are unaffected by anything above.

You can close your account at any time from settings.

We may suspend an account that is breaching the acceptable-use section, that is not paying, or that is being used in a way that endangers the service for others. Except where the problem is urgent, we will contact you first and give you a chance to fix it.

When an account closes, the activity record is deleted on the normal retention schedule — 7 days on the free plan, 90 days on paid plans — and registry tokens stop working immediately. Ask us and we will delete the account outright, sooner.

When the product changes in a way these terms describe, this page changes in the same release — not afterwards.

For changes that materially reduce what you get, we will email account holders at least 30 days before they take effect, and you can cancel in that window with the usual pro-rata refund.

These terms are governed by the law of Estonia, and disputes go to the Harju County Court.

If you are a consumer resident elsewhere in the EU, this does not deprive you of the protection of your own country’s mandatory consumer law.

Before anyone involves a court, email us. Nearly everything that reaches this section is a misunderstanding that one reply would have settled.

This is a plain description of the deal, written in our own words. It is not a lawyer-drafted instrument and does not pretend to be one.

If something here does not match what the product actually does, that is a bug in this page and we want to hear about it.