Skip to content

Version 2.0.0-draft · not in force · sha256 de9d3a48bf62e4df…

VibefyCode Badge Licence Agreement

DRAFT — REQUIRES REVIEW BY QUALIFIED COUNSEL IN [JURISDICTION] BEFORE USE. Not legal advice. Not a substitute for a lawyer.

Version: 2.0.0-draft · Status: not in force · Baseline: GDPR-grade

1. What is licensed

This version renames the Mark. Until version 1.1.0-draft the licensed mark read "Verified by Vibefy". It now reads "Verified by VibefyCode", and the badge device has been redrawn from new supplied artwork.

That is a change to the thing being licensed, not a clarification, so an

acceptance of an earlier version does not carry forward: no badge issues or renews until this version is accepted.

"Verified by VibefyCode" and the VibefyCode badge device (together, the Mark) are trade marks of [LEGAL_ENTITY]. Where your application has been assessed, met the published threshold, and been approved by a human reviewer, we grant you a limited, non-exclusive, non-transferable, revocable licence to display the Mark for that application, for the period stated on the badge, on the domain recorded as its certified origin.

The licence covers that application only. It does not extend to your other products, your company generally, your marketing claims about security, or any successor application.

2. How the Mark is displayed

  1. Served from us. The badge is rendered from verify.[PRIMARY_DOMAIN] on every load. You may not host, cache, screenshot, re-draw or otherwise reproduce it as a file you control. Rendering it ourselves is what makes revocation take effect within minutes.
  2. Always linked. Every instance of the Mark must link to that application's verification page. A badge that does not link is a claim without evidence. Use the embed snippet we provide; it cannot produce an unlinked badge.
  3. Minimum size 96px, with clear space on every side equal to 25% of the badge width.
  4. No alteration. No recolouring, rotation, cropping, distortion, filtering, animation, or change to the wordmark. No text added inside the Mark.
  5. Alt text. The Mark carries the alt text we supply, which names the application, the rubric version, the assessment date, and states that this is a scope-limited assessment rather than a security guarantee.
  6. State is visible. Suspended, expired and revoked badges render as a distinct "not currently verified" mark. You may not suppress, hide or replace that rendering.

3. What you may say, and what you may not

Permitted: "Verified by VibefyCode", "VibefyCode-assessed", "VibefyCode Rubric v1.0.0 — score 82/100".

Not permitted, because they claim more than we assessed: "VibefyCode Verified Secure", "VibefyCode Certified Safe", "VibefyCode Approved", "Guaranteed by VibefyCode", "VibefyCode Compliant", or any formulation implying that VibefyCode has certified your application as free of defects, lawful, or fit for a purpose.

You may not present a VibefyCode assessment as a penetration test, a security

audit or a compliance certification.

4. Term, expiry and renewal

The licence runs until the badge's expiry date, which is at most twelve months from issue and shorter on continuous plans. It renews only on a successful re-assessment. An expired badge may not be displayed, and will in any case render as expired because we serve it.

5. Suspension and revocation

We may suspend or revoke immediately on: lapse of the subscription that maintains the badge; a material regression found on re-assessment; the certified application becoming unreachable; a change in ownership or control of the application; breach of this Licence; or any matter under the Acceptable Use Policy. We will state a reason, and the Appeals & Corrections Policy applies.

On suspension or revocation you must remove every instance of the Mark from any surface we do not serve — printed material, app store screenshots, decks, social profiles — within five business days.

6. Misuse

Displaying an expired, revoked, altered or unearned Mark is a breach of this Licence and an infringement of our trade marks. We may publish the revocation, pursue takedown with hosts, registrars and app stores, and seek any remedy available to us. We log the origin from which each badge is requested, and a badge rendered on a domain other than its certified origin is recorded as a mismatch.

7. Our obligations

We will serve the badge with reasonable availability, keep the verification page accurate, publish the rubric version each badge was issued against, and give you notice before a suspension that is not caused by an immediate safety concern.

8. The public directory

While a badge is live, the application is listed in the public VibefyCode directory. The listing shows the application's name, the origin the badge certifies, the overall score, the score by dimension, the rubric version and the date of assessment. It shows nothing that is not already on the verification page that badge links to.

You may opt out at any time, including while certified, and remain certified. Opting out removes the listing immediately; the badge and its verification page are unaffected. There is nothing to ask us for and no waiting period — it is a control in your console.

Where you are also a client of our marketing services, that relationship is disclosed on the listing, in the same words as on the verification page. It is disclosed whether or not you opt in to anything, and it is not something you can pay to remove.

Listings are ordered by the rubric alone. Placement in the directory is not for sale. If paid placement is ever introduced, it will be labelled as advertising, visually and in words, and it will not appear in the organic ordering.

9. No warranty, no reliance

The Mark states that an assessment happened and reached a threshold on a date. It is not a warranty by us to you or to anyone who sees it, and no third party may rely on it. The limitation of liability in the Terms of Service applies.

10. Termination

Either party may terminate on notice. On termination the licence ends immediately and clause 5 applies to removal, and any directory listing is removed with it.