fremforge Terms of Service

title: fremforge Terms of Service author: fremverk date: 2026-08-05 status: Published v1.6 version: “1.6” lang: en #

Last updated: 2026-08-05

Effective Date: 2026-05-10 — Version: 1.6 (see the change log for the effective date of each amendment)

These Terms of Service (“ToS”) form the master agreement between fremverk ApS and the Customer for use of the fremforge service at frem.sh. The Acceptable Use Policy, Data Processing Agreement, Service Level Agreement, Privacy Notice, and Cookie Policy are incorporated by reference and form part of the same contract.

1. Parties #

This agreement is between:

fremverk ApS ("fremverk", “we”, “us”, “our”)
CVR: 39150689
Ringager 4C, 2. tv, 2605 Brøndby, Denmark
VAT: DK39150689
Primary contact: hello@frem.sh · compliance@frem.sh

and

the Customer (the legal entity that signs up for or is invoiced for the fremforge service), identified by the organisation name, billing address, and VAT number provided at signup or in the ordering document.

fremforge is a product brand of fremverk ApS. fremverk ApS is the sole legal signatory and contracting party.

1.1 Definitions #

The following capitalised terms have the meanings set out below when used in these ToS:

• Customer — the legal entity identified at signup or in the Order Form that contracts with fremverk for use of the Service.
• User — an employee, contractor, or other individual authorised by the Customer to use the Service under the Customer’s account.
• Service — the fremforge Git and CI/CD hosting service described in §2, including all features, APIs, and surfaces made available by fremverk under these ToS.
• Order Form — any ordering document, signup record, or bespoke commercial document agreed between the parties that records the commercial terms of a Subscription.
• Documentation — the published documentation at docs.frem.sh as of the Effective Date.
• Customer Content — all data, code, configuration, issues, pull requests, comments, wiki content, package artifacts, CI logs, and other content the Customer or its Users submit or cause to be generated on the Service.
• Customer Personal Data — personal data within Customer Content; this term incorporates the corresponding definition in the DPA by reference.
• Fees — the amounts payable by the Customer to fremverk for the Service, as set out in §4 and the applicable Order Form or published pricing.
• Term — the period during which these ToS are in force between the parties, as defined in §16.
• Effective Date — the date these ToS take effect under §16.1.
• Subscription — the Customer’s contracted right to use the Service for the Term, on the plan, seat count, and commercial basis recorded in the Order Form or at signup.

2. The Service #

fremforge is an EU-sovereign, multi-tenant Git and CI/CD hosting service. The Service includes, without limitation:

• Hosted Git repositories, issues, pull requests, wiki, releases, and collaboration surfaces.
• Hosted continuous integration and continuous delivery runners on T Cloud Public Elastic Cloud Server — one ephemeral virtual machine per job, destroyed when the job ends (“hosted runners”).
• Single sign-on enforcement via OIDC and SAML; per-organisation session binding; scoped API tokens.
• A bundled supply chain security stack: pre-receive secret scanning and push protection, dependency scanning on pull requests, signed commits via OIDC identity, and SLSA provenance for build artifacts.
• A package registry supporting npm, Maven, Docker, NuGet, PyPI, RubyGems, Composer, and Go.
• A fremforge admin UI for tenant configuration, policy management, audit-log view, and export initiation.
• A documented public REST API at frem.sh/_app/api/v1/* equivalent to the admin UI surface.
• Data export on demand per the Privacy Notice §7.
• Business-hours email support via support@frem.sh.

The Service is described in the Documentation published at docs.frem.sh as of the Effective Date, including the published feature scope, the security commitments at www.frem.sh/trust/, and the SLA. The Service is provided in accordance with the Documentation as updated from time to time per §17.

fremverk may update the Service from time to time to add features, fix bugs, or improve security; material reductions in functionality are announced with at least 30 days’ notice where commercially feasible.

3. Grant of use #

Subject to the Customer’s compliance with these ToS, fremverk grants the Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Service during the Term, for its own internal business purposes. The Customer may provide access to its employees, contractors, and other permitted users (“Users”) within a configured seat limit; each such User must agree to these ToS.

The right to use is limited to what the seat count, plan, and ordering document permit. fremverk retains all rights not expressly granted.

4. Fees, payment, and renewal #

4.1 Pricing and billing #

The Service is sold on a per-seat basis. Two billing terms are available, elected at signup or via the billing-admin surface:

• Monthly term — billed at the per-seat monthly list price, charged monthly in advance. The Customer may cancel at any time; access continues to the end of the paid month, and any further charges stop.

• Annual term — billed at the per-seat monthly list price discounted by 15% (the “annual discount”), charged as a single upfront annual fee at the start of each one-year term. The annual fee is non-refundable except during the 30-day money-back window described below. If the Customer cancels mid-term outside that window, access continues to the end of the committed period and then ends; the unused portion is not refunded and no clawback or further charge applies.

  30-day money-back guarantee on annual terms. Customers who switch a monthly subscription to annual or sign up directly on the annual term may request a full refund of the upfront annual fee within 30 calendar days of the annual charge by cancelling via the admin UI or by emailing support@frem.sh with subject line ANNUAL REFUND — <organisation>. The refund is processed via the original Mollie payment method within 14 calendar days. On refund, the Subscription continues on the monthly term at the per-seat monthly list price (i.e. without the 15% annual discount) and the Customer’s next monthly charge falls on the next calendar-month boundary; the unused months from the cancelled annual fee are NOT credited against future monthly fees (the refund makes the Customer whole). The 30-day window applies once per annual cycle — a Customer who refunds in year 1, opts back to annual in year 2, then refunds again in year 2 is granted the year-2 refund; chained refund attempts in the same annual cycle are not. Renewals at the end of an existing annual term are NOT a “new annual charge” for the purpose of this window — the window resets only on a fresh monthly-to-annual switch.

Standard pricing and overage rates are those published at frem.sh/pricing at the date of signup, or those recorded in a bespoke ordering document for Enterprise-on-Demand customers.

Fees are denominated and invoiced in EUR. fremverk does not bill in any other currency. Where the Customer is established in Denmark, Danish 25% VAT applies on the EUR invoice via fremverk’s bookkeeping partner; the VAT regime depends on the Customer’s country of establishment and VIES status, not on the invoice currency.

4.2 Payment method #

Payments are processed through Mollie B.V., a PSD2-authorised payment institution in the Netherlands. Accepted payment methods include SEPA Direct Debit, major credit and debit cards, and other EU-native methods exposed by Mollie. By providing payment details, the Customer authorises fremverk to charge the payment method for Fees and overage in accordance with these ToS.

fremverk does not see or store raw card or bank-account data; Mollie is the sole processor of payment-card information and PCI-DSS Level 1 certified.

4.3 Overage #

Runner-minute overage beyond the pooled monthly allocation is metered at the rate published at frem.sh/pricing. Storage and package-registry egress are governed by the soft-cap and hard-cap regime described at frem.sh/pricing. Overage is invoiced monthly in arrears under both billing terms.

Adding seats mid-term. Additional seats added during a paid period are charged on a pro-rata basis to the end of the current period: monthly term → pro-rata to end of paid month; annual term → pro-rata to the committed-until date at the discounted rate. The new seat count carries forward at full rate at the next renewal.

Removing seats mid-term. Seat reductions take effect at the next renewal boundary (end of paid month for monthly term; committed-until date for annual term). Mid-term seat reductions are not refunded.

4.4 VAT and taxes #

Danish VAT applies to Danish Customers. Intra-EU B2B Customers with a valid VIES VAT number are invoiced under the reverse-charge mechanism. Non-EU B2B Customers are invoiced without EU VAT, with self-accounting by the Customer in its own jurisdiction. Where a Customer is a consumer (rare for fremforge as a B2B service), applicable VAT rates apply.

Withholding taxes, stamp duties, and other taxes imposed on the Customer in its jurisdiction are the Customer’s responsibility and may not be deducted from the Fees unless mandatory under applicable law; in that case the Customer will gross up the payment so that fremverk receives the agreed amount.

VAT regime changes during the term. fremverk validates each EU customer’s VAT registration via the EU VIES service at signup and periodically thereafter (typically every 90 days). EU non-Danish customers with a valid VIES registration are billed at 0% VAT under the cross-border B2B reverse-charge regime (Council Directive 2006/112/EC Art. 196). If the Customer’s VIES status becomes invalid during the Term — for any reason including company restructuring, deregistration, or VAT-number change — fremverk will notify the Customer by email and grant a 30-day grace period during which billing is paused. If the VIES status is not restored within the grace period, fremverk will automatically transition the Customer’s account to the Danish domestic VAT regime (currently 25%, charged on top of the listed prices) for all subsequent invoices, and will send a regime-change confirmation email. Past invoices issued correctly under reverse-charge are not retroactively re-rated. The Customer may avoid the regime change at any time by providing a valid VIES VAT number; restoring a valid VIES VAT number after the regime change reverts subsequent invoices to reverse-charge but does not retroactively re-rate any Danish-VAT invoices that were correctly issued during the post-grace period.

4.5 Late payment #

Invoices are due within 30 days of issue unless otherwise agreed. Late payment accrues interest at the default rate under the Danish Interest Act (Renteloven) or 8 percentage points above the European Central Bank’s reference rate, whichever is higher. Fees for dunning and recovery are recoverable under Danish law.

4.6 Dunning and suspension #

After the due date, fremverk follows a commercially reasonable dunning cycle — typically three notification attempts over 30 days — before suspending the Service per AUP §11.

4.7 Renewal #

Monthly subscriptions renew month-to-month unless cancelled; cancellation takes effect at the end of the current paid month and no further charges apply.

Annual subscriptions renew for successive one-year terms by an upfront charge at each renewal anniversary, unless either party gives at least 30 days’ notice before the end of the current term. Cancelling within an annual term ends auto-renewal but does not refund the unused portion of the current term — access continues to the committed-until date and then ends. Price changes for renewals are announced at least 60 days in advance.

4.8 Revenue recognition (periodisering) #

For Customers party to a Danish-law contract: fremverk’s financial year runs 1 May to 30 April. Where an annual subscription period spans that boundary, fremverk recognises the prepaid fee as revenue on a pro-rata monthly basis across the two fiscal years per Bogføringsloven §10 and IFRS 15. This affects only fremverk’s accounting; it does not change the amount the Customer is billed nor the Customer’s right of access during the term.

5. Trials #

fremverk may offer a free trial of the Service, currently 30 calendar days with no payment method captured at signup. Trials convert to a paid Subscription only when the Customer follows the payment-setup link in their welcome email and successfully captures a payment-method mandate; if no mandate is captured by the end of the trial, the trial is suspended (read-only access continues for the data-retention period in §16.5 unless the Customer reactivates). Trial-tier limits are published at frem.sh/pricing. Trial-abuse controls — email verification, per-domain deduplication, signup rate limits, and trial-specific runner caps — apply. fremverk may terminate a trial at any time for suspected abuse.

6. Customer obligations #

6.1 Lawful use #

The Customer uses the Service only for lawful purposes and in accordance with these ToS, the AUP, and applicable law.

6.2 Account security #

The Customer is responsible for:

• Maintaining the confidentiality of its credentials, API tokens, and any delegated mandates it issues.
• Managing the lifecycle of its Users (onboarding, offboarding, role changes) and ensuring that access is granted only to authorised personnel.
• Configuring SSO and MFA in accordance with its own security policies; fremverk provides the tools, the Customer configures them.
• Notifying fremverk immediately via security@frem.sh of any suspected credential compromise or unauthorised access.

6.3 Content and data #

The Customer owns and is responsible for all data, code, configuration, issues, pull requests, comments, wiki content, package artifacts, CI logs, and other content it or its Users submit or cause to be generated on the Service (“Customer Content”). The Customer warrants that it has the right to use the Customer Content and that its use does not infringe third-party rights or violate applicable law.

The Customer remains the controller of Customer Content for GDPR purposes; fremverk processes Customer Content as processor under the DPA.

fremforge is a “hosting service” within the meaning of Regulation (EU) 2022/2065 (Digital Services Act). Customer Content is stored at the Customer’s request; fremverk does not select, modify, or moderate Customer Content as a matter of editorial control. Subject to acting expeditiously on notices submitted through the mechanism in AUP §5, fremverk relies on the conditional liability exemption in DSA Art. 6 in respect of Customer Content and is under no general monitoring obligation (DSA Art. 8). Nothing in this paragraph limits the Customer’s responsibility under this §6.3, the warranties in §13.2, or the Customer’s indemnity in §15.2.

6.4 Payment method #

The Customer maintains a valid payment method on file for the duration of the Term and updates it promptly on expiry or change.

6.5 Export control and sanctions #

The Customer warrants that:

• Its use of the Service, and any Customer Content stored or transmitted through the Service, complies with EU dual-use export-control regulation (Regulation (EU) 2021/821) and applicable national implementations.
• It is not located in, resident in, or a national of any country or region subject to comprehensive EU, UN, or Danish sanctions that would prohibit provision of the Service to it, and it is not acting on behalf of any person so located, resident, or national.
• It will not export, re-export, or otherwise transfer — directly or indirectly, via the Service — controlled software, technology, or technical data to a destination, person, or end-use prohibited by applicable sanctions or export controls.

Breach of this clause is a material breach of these ToS giving fremverk the right to suspend or terminate under §16.4 without cure period where required to comply with applicable law.

6.6 Anti-bribery and anti-corruption #

The Customer warrants that it will not use the Service to support activity prohibited under applicable anti-bribery and anti-corruption legislation, including the Danish Criminal Code (Straffeloven) provisions on bribery of public officials and in commercial relations, the UK Bribery Act 2010, the US Foreign Corrupt Practices Act, or equivalent provisions in the Customer’s own jurisdiction.

Breach of this clause is a material breach of these ToS giving fremverk the right to suspend or terminate under §16.4 without cure period where required to comply with applicable law.

7. Intellectual property #

7.1 Customer IP #

Customer Content remains the property of the Customer (or its licensors). The Customer grants fremverk a limited licence to host, process, transmit, cache, display, and make Customer Content available to the Customer and its Users strictly for the purpose of providing the Service, and to perform the operational and security-related processing described in the DPA and Privacy Notice. This licence terminates on deletion of the Customer Content or termination of this agreement.

7.2 fremverk IP #

The Service, the fremverk and fremforge trademarks and logos, the documentation, the admin UI, the control-plane software, the API, the shared OpenTofu modules, and the platform-foundation tooling remain the property of fremverk. No ownership of or interest in fremverk intellectual property transfers to the Customer under this agreement.

fremverk® is a registered trademark of fremverk ApS. fremforge™ is a trademark of fremverk ApS for which a registration application is pending; it is asserted as an unregistered mark and is not held out as registered.

Nothing in this agreement grants the Customer any licence to use the fremverk or fremforge names, marks, or logos. The Customer may nonetheless refer to fremverk and fremforge by name for factual and descriptive purposes — for example describing its own use of the Service, its toolchain, or its integrations — which is nominative use and requires no licence from fremverk. Use of the marks or logos in a manner that implies endorsement, partnership, certification, or common origin requires fremverk’s prior written consent (email suffices). This mirrors the reciprocal restriction on fremverk’s use of Customer marks in §27.

7.3 Open source components #

The Service is built on open source software, including Forgejo (GPL v3+), which fremverk runs as a modified build, and the supply chain security stack components documented on the trust page. Those components are governed by their respective open source licences, which are compatible with commercial SaaS distribution of the Service.

Forgejo is licensed under GPL v3+. fremverk runs a modified build of Forgejo as a hosted service: a maintained patch series is applied on top of a pinned upstream commit, principally for single-sign-on and MFA claim handling, tenant-boundary enforcement, system-bot concealment, and additional Actions APIs. The Customer’s use of the hosted Service does not constitute “distribution” of Forgejo to the Customer within the meaning of GPL v3 §0/§5, and accordingly does not impose any GPL obligations on the Customer’s own code, repositories, or derivative works hosted on the Service. GPL v3 contains no network-use clause (unlike AGPL v3 §13), so operating a modified build as a service does not trigger a source-provision obligation; that conclusion is unchanged by the modifications. The Customer’s repositories remain governed solely by the licences the Customer chooses for them. The modifications do not alter Forgejo’s data model, so repository, issue, PR, and metadata exports under §16.5 / DPA §9 remain directly importable into a self-hosted Forgejo instance, providing a vendor-lock-in mitigation.

7.4 Feedback #

If the Customer provides suggestions, bug reports, or ideas for improving the Service, fremverk may freely use them without obligation.

7.5 fremforge CLI — licence, support period, and security updates #

fremverk publishes the fremforge CLI, a single-file executable that wraps the public REST API, at cli.frem.sh and documents it at docs.frem.sh/get-started/cli/. Unlike the rest of the Service, the CLI is software the Customer downloads and runs on its own systems, so it is addressed separately here.

(a) Licence. fremverk grants the Customer a non-exclusive, non-transferable, non-sublicensable, revocable licence to download, install, and run the CLI on any number of systems, solely to access the Service under a valid Subscription and for the Customer’s own internal business purposes. The CLI is proprietary software; it is not open source and no source licence is granted. The Customer may not decompile, reverse-engineer, or redistribute it, except where such a restriction is unenforceable under applicable law (including Art. 6 of Directive 2009/24/EC on interoperability).

(b) No separate charge. The CLI is provided at no additional cost as part of the Subscription. It is not a separate product and confers no rights beyond those in this §7.5.

(c) Support period. fremverk declares a support period of five (5) years from the release date of each minor version of the CLI, during which fremverk handles vulnerabilities in that version in accordance with (d). This is the support period within the meaning of Art. 13(8) of Regulation (EU) 2024/2847 (the Cyber Resilience Act), and it is published alongside the download so that it is available before installation. The support period is independent of the Customer’s Subscription term: it attaches to the released version, not to the account.

(d) Security updates and vulnerability handling. fremverk remediates vulnerabilities in the CLI by publishing a new release, made available at the same URLs and covered by the same signed SHA256SUMS manifest. Security fixes are provided free of charge and are announced separately from feature releases. Because fixes ship forward, the Customer is expected to run a supported version; a Customer running a superseded version can obtain the fix by upgrading, which fremverk will not gate behind a paid plan or a new licence. Vulnerability reports go to security@frem.sh under the coordinated-disclosure process published at www.frem.sh/security.

(e) Software bill of materials. A CycloneDX SBOM for each release is published at cli.frem.sh/cli/SBOM.cdx.json (and per-version at cli.frem.sh/cli/v<version>/SBOM.cdx.json), covered by the same signed manifest as the binaries, so the Customer can verify its provenance rather than take it on trust.

(f) Warranty and liability. The CLI is subject to §13 (Warranties) and §14 (Liability) on the same basis as the Service, save that fremverk gives no warranty that the CLI will operate on any specific operating-system version, architecture, or configuration beyond the platforms listed in the Documentation. Nothing in this §7.5 limits liability that cannot be limited under §14.1, and nothing in it excludes the Customer’s rights under mandatory consumer or product-safety law.

(g) Not required. The CLI is a convenience. Every operation it performs is available through the documented REST API and, where applicable, the admin UI. A Customer that prefers not to run third-party executables can decline it with no loss of functionality.

8. Confidentiality #

Each party treats the other’s confidential information with at least the same care it applies to its own, and uses it only for purposes of this agreement. This does not apply to information that is public, already known without confidentiality duty, independently developed, or rightfully received from a third party.

Customer Content is treated as the Customer’s confidential information. Aggregate and anonymised operational metrics that cannot identify the Customer may be used by fremverk for capacity planning, product improvement, and reporting.

9. Privacy and data protection #

Personal data processed as part of the Service is governed by the Privacy Notice and the DPA. Where Customer Content contains personal data, the Customer is the controller and fremverk is the processor. fremverk complies with GDPR Art. 28 processor obligations in the DPA.

10. Security #

fremverk implements the technical and organisational security measures documented in the DPA security annex and the security-patch SLA at www.frem.sh/trust/#security-patching, including but not limited to:

• TLS 1.2+ on every surface; at-rest encryption via T Cloud Public DEW KMS.
• Per-organisation logical isolation with enforced ACLs, per-org rate limits, and per-tenant audit streams.
• Pre-receive secret scanning, dependency scanning, signed commits, SLSA provenance.
• Immutable audit log with tamper-evident hash chaining anchored to OBS WORM storage.
• Layered SSRF hardening: per-pod VPC Security Group egress allowlist (Cloud Native Network 2.0) + outbound-proxy CONNECT tunnel with SSRF deny-set + app-layer SSRF guard with one-shot DNS-resolve-then-dial-by-IP.
• Published CVE-patching SLA — contractual and in force now: Critical within 48h, High within 72h, Medium within 7 days, Low by the next scheduled maintenance window. The previously stated phasing (these targets from 2027-Q1, weaker commercially-reasonable targets until then) was withdrawn on 2026-08-05 because fremverk’s published trust page already committed to these figures and DPA Annex A.8 incorporates that page by reference. See DPA A.8 (v1.30).

10A. Insurance #

fremverk procures cyber-liability and technology errors-and-omissions insurance and commercial general liability insurance appropriate to the Subscription tier and to any Customer-specific procurement requirements. For Standard Subscription Customers, fremverk maintains commercially reasonable equivalent self-insurance reserves and provides transparent disclosure of the position on written request. For Enterprise-on-Demand Subscription Customers, the Order Form may stipulate named-insured certificates, specific per-claim and annual-aggregate limits (typically in the €1,000,000–€5,000,000 range for cyber + E&O), 30-day cancellation notice, or other Customer-procurement-specific terms; those terms bind both parties for the duration of the Order Form, and certificates of insurance are renewed annually while the requirement is in force. Coverage shall not be reduced below the limits stipulated in an active Order Form without 30 days’ prior written notice to the Customer.

11. Availability and SLA #

Service availability commitments and service-credit remedies are defined in the SLA. The standard plan provides a 99.5% monthly availability commitment with automatic service credits; Enterprise-on-Demand contracts may agree to higher commitments backed by dedicated staffing.

12. Third-party services #

The Service interoperates with third-party services configured by the Customer — for example, external identity providers, webhooks sent to Customer systems, package registries consumed from the Customer’s own infrastructure, or AI tooling the Customer brings. The Customer is responsible for its use of those third-party services and their associated terms; fremverk is not a party to them and is not responsible for their performance.

13. Warranties and disclaimers #

13.1 fremverk warranties #

fremverk warrants that:

• It has the right to enter into this agreement and provide the Service.
• It will provide the Service with commercially reasonable skill and care consistent with industry standards applicable to EU-sovereign cloud services.
• It will meet the contractual CVE patch SLA set out in DPA Annex A — Security Measures (Critical CVSS ≥9.0: 48 hours of upstream fixed release; High 7.0–8.9: 72 hours; Medium 4.0–6.9: 7 days; Low: next scheduled maintenance window). These targets are in force now. The phased warranty previously given here — commercially reasonable efforts against weaker targets until fremverk’s funded 24/7 on-call rotation went live, targeted 2027-Q1 — was withdrawn on 2026-08-05, because fremverk’s published trust page already committed to the stricter figures and DPA Annex A.8 incorporates that page by reference. Failure to meet this SLA is a material breach for the purposes of §16.4.

13.2 Customer warranties #

The Customer warrants that:

• It has the right to enter into this agreement and to authorise its Users to use the Service.
• Its use of the Service and the Customer Content complies with applicable law and does not infringe third-party rights.
• It has obtained all consents, given all notices, and established all legal bases required for its processing of personal data within Customer Content.

13.3 Disclaimer #

Except for the warranties expressly stated above, the Service is provided “as is” and fremverk disclaims all other warranties, express or implied, to the maximum extent permitted by applicable law, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. fremverk does not warrant that the Service will be uninterrupted or error-free beyond the SLA commitment.

The disclaimer in this §13.3 applies to the maximum extent permitted by Danish law. Where the Customer is acting otherwise than in the course of its trade, business, or profession, mandatory consumer-protection law (including Forbrugeraftaleloven, Markedsføringsloven, and the Købeloven warranty floor for defects of substance) is preserved per §21.

14. Liability #

14.1 Mandatory exclusions #

Nothing in these ToS limits or excludes either party’s liability for: (a) gross negligence (grov uagtsomhed) or wilful misconduct (forsæt); (b) death or personal injury caused by negligence; (c) fraud or fraudulent misrepresentation; (d) any liability that cannot lawfully be limited under Danish law (including under the Aftaleloven §36 unfair-terms doctrine and the Købeloven where applicable).

14.2 Unlimited liability #

Nothing in this agreement limits or excludes liability for:

• Death or personal injury caused by negligence.
• Fraud or fraudulent misrepresentation.
• Any other liability that cannot be limited or excluded under applicable law.

14.3 Capped liability #

Subject to §14.1 and §14.2, the aggregate liability of either party to the other under or in connection with these ToS, including the DPA, AUP, SLA, Privacy Notice and Cookie Policy, in any twelve-month period is limited to the greater of (a) the Fees actually paid by the Customer to fremverk under the affected Subscription in the twelve months preceding the event giving rise to liability, or (b) €25,000, capped in any case at €500,000 per twelve-month rolling period.

14.4 Indirect loss #

Subject to §14.1 and §14.2, neither party is liable for indirect, consequential, incidental, special, or punitive damages, including loss of profits, loss of revenue, loss of goodwill, loss of business, loss of anticipated savings, loss of data (except where the loss of data constitutes a breach of fremverk’s obligations under the DPA, in which case §14.5 applies), or loss arising from business interruption.

14.5 Data liability carve-out #

For claims arising from fremverk’s breach of the DPA security annex and resulting in a personal-data breach, the cap in §14.3 is raised to two times the annual Fees, without prejudice to any statutory liability that cannot be capped.

14.6 Carve-outs from cap #

The aggregate cap in §14.3 does not apply to: (a) fremverk’s IP indemnity obligations under §15.1; (b) either party’s liability for breach of confidentiality, provided that where the same incident also constitutes a breach of fremverk’s obligations under the DPA security annex, the higher of the cap in §14.5 (two times annual Fees) or the uncapped statutory liability in DPA §13 applies, and the carve-out in this paragraph (b) does not stack on top; (c) liabilities excluded from limitation under §14.1.

15. Indemnities #

15.1 fremverk indemnity — IP #

fremverk will defend the Customer against third-party claims that the Service (excluding Customer Content and Customer-configured third-party services) as provided by fremverk infringes the claimant’s intellectual property rights, and will pay any damages awarded by a court of competent jurisdiction or agreed in settlement. As a condition: (i) the Customer promptly notifies fremverk of the claim in writing; (ii) fremverk has sole control of the defence and settlement; provided that fremverk shall not, without the Customer’s prior written consent (not unreasonably withheld or delayed), enter into any settlement that (A) admits liability of the Customer, (B) imposes injunctive or non-monetary obligations on the Customer, or (C) is not solely monetary and fully paid by fremverk; (iii) the Customer provides reasonable cooperation at fremverk’s expense.

If the Service becomes, or in fremverk’s reasonable opinion is likely to become, the subject of an infringement claim, fremverk may at its option: (a) procure the right for the Customer to continue using the Service; (b) modify the Service so it is non-infringing while materially preserving functionality; or (c) terminate the affected portion of the Service and refund prepaid unused Fees.

This indemnity does not apply to infringement resulting from: use of the Service in combination with anything not supplied by fremverk; modification of the Service by the Customer; or Customer Content.

fremverk’s indemnity under this clause is limited to claims brought in courts of the European Union, European Economic Area, the United Kingdom, Switzerland, the United States, or any jurisdiction in which the Customer is a registered legal entity at the time the underlying claim arises (not frozen to the Effective Date).

15.2 Customer indemnity — Content #

The Customer will defend fremverk against third-party claims that Customer Content, or the Customer’s use of the Service in breach of these ToS or applicable law, caused the claimant harm, and will pay any damages awarded by a court of competent jurisdiction or agreed in settlement. The same conditions (prompt notice, control of defence, cooperation) apply; provided that the Customer shall not, without fremverk’s prior written consent (not unreasonably withheld or delayed), enter into any settlement that (A) admits liability of fremverk, (B) imposes injunctive or non-monetary obligations on fremverk, or (C) is not solely monetary and fully paid by the Customer.

16. Term and termination #

16.1 Effective Date and acceptance #

These ToS take effect on the earlier of (a) Customer’s electronic acceptance at signup or via clickwrap, (b) Customer’s first paid use of the Service, or (c) Customer’s authenticated use of the Service for any purpose, including trial, sandbox, or evaluation access. Mere unauthenticated browsing of public marketing pages does not by itself constitute acceptance, but submission of an account-creation request, sign-in, or use of an authenticated surface does.

The agreement continues on a monthly or annual basis as selected, with automatic renewal as described in §4.7, until terminated per this §16.

16.2 Termination by the Customer for convenience #

The Customer may terminate a monthly subscription at the end of any billing period by cancelling via the admin UI (where the self-service cancellation flow is available) or, until that flow ships in Phase 1, by written notice to support@frem.sh with subject line CANCELLATION — <organisation>. Annual subscriptions may be cancelled at any time; outside the 30-day money-back window in §4.1, the upfront annual fee remains payable in full and is non-refundable, cancellation ends auto-renewal at the next term boundary, and access continues to the committed-until date. Within the 30-day money-back window the full annual fee is refunded per §4.1 and the Subscription continues monthly. Cancelling at least 30 days before the end of the current term is required to prevent the next year’s auto-renewal charge.

16.3 Termination by fremverk for convenience #

fremverk may terminate at the end of any billing period on 30 days’ written notice, provided fremverk refunds the pro rata unused prepaid Fees.

16.4 Termination for cause #

Either party may terminate immediately on written notice if the other party:

• Materially breaches these ToS and fails to cure the breach within 30 days of notice (15 days for payment breaches).
• Becomes insolvent, files for bankruptcy, enters administration, or ceases to trade.

fremverk may suspend or terminate immediately per AUP §7 for egregious violations.

16.5 Effects of termination #

On termination, the Customer’s right to use the Service ends. Customer Content is retained for 60 days to allow export (using the on-demand signed-export endpoints), then deleted per the DPA data-return clause. Fees accrued up to termination remain payable. The following provisions survive termination of these ToS for any reason: §1.1 (Definitions to the extent terms are used in surviving clauses), §6 (Customer Content ownership and IP), §7 (fremverk IP), §8 (Confidentiality), §13 (Warranties for breaches that occurred during the Term), §14 (Liability), §15 (Indemnification), §16.5 (Effects of termination — including data export and refund), §16.6 (Switching, porting and exit), §18 (Force majeure for events spanning termination), §20 (Notices), §21 (Governing law), §22 (Entire agreement and precedence), and the DPA audit rights for matters arising during the Term as set out in DPA §12. Customer’s obligation to pay accrued Fees and fremverk’s obligation to refund prepaid unused Fees on termination for fremverk’s uncured breach also survive.

If termination is for fremverk’s uncured material breach, Customer is not liable for Fees accruing after the effective date of termination, and fremverk refunds any prepaid Fees on a pro-rata basis within 30 days of termination.

16.6 Switching, porting and exit (EU Data Act Chapter VI) #

This §16.6 implements Chapter VI of Regulation (EU) 2023/2854 (the Data Act), which applies to fremverk as a provider of a data processing service. It applies in addition to, and does not narrow, the export rights in §16.5 or the DPA. Where this §16.6 and any other provision of the Agreement conflict on switching, this §16.6 prevails.

(a) Right to switch. The Customer may at any time, without cause, direct fremverk to (i) switch the Service to another provider of an equivalent service, (ii) port the Customer’s Exportable Data and Digital Assets to on-premises ICT infrastructure operated by or for the Customer, or (iii) erase the Customer’s Exportable Data and Digital Assets. The Customer may exercise any of these while remaining a Customer, and exercising (i) or (ii) is not itself a termination of the Agreement.

(b) Definitions. Exportable Data means the input and output data of the Service, including metadata, generated directly or indirectly by the Customer’s use of the Service — for fremforge, this is repository content and history, LFS object references, issues and pull requests, Actions workflow definitions and logs, the Customer’s audit-log slice, build attestations, and account and organisation configuration. It excludes fremverk’s own operational data, aggregate or derived data that does not relate to the Customer, and any asset protected by third-party intellectual-property rights or constituting a trade secret. Digital Assets has the meaning given in Art. 2(31) of the Data Act.

(c) Notice period. The Customer initiates switching by written notice to support@frem.sh or through the admin UI. The maximum notice period before the switching process begins is two months from the Customer’s request; fremverk in practice begins immediately on receipt and does not require the Customer to wait.

(d) Maximum transitional period. fremverk completes the switching process within a mandatory maximum transitional period of 30 calendar days, beginning at the end of the notice period in (c). Where completion within 30 calendar days is technically unfeasible, fremverk notifies the Customer within 14 working days of the switching request, with a duly substantiated justification, and specifies an extended transitional period, which will not exceed seven months. The Customer may extend the transitional period once, to a period the Customer considers more appropriate for its own purposes.

(e) Continuity during transition. Throughout the transitional period, fremverk maintains full continuity of the Service and continued business operations under the Agreement, at the same service levels (SLA) and the same Fees as before, and keeps the Customer’s security obligations under §11 and the DPA intact.

(f) Retrieval and erasure. After the transitional period ends, the Customer has a retrieval period of 30 calendar days in which to retrieve Exportable Data and Digital Assets. This runs in parallel with, and does not shorten, the 60-day retention window in §16.5 — the longer of the two applies. At the end of the applicable window, fremverk erases all Exportable Data and Digital Assets in accordance with DPA §9, and confirms erasure in writing on request.

(g) No switching charges. fremverk does not charge switching charges, early-termination penalties, egress fees, data-transfer fees, or any other charge for exercising rights under this §16.6. Art. 29 of the Data Act permits cost-based reduced charges until 12 January 2027 and prohibits them thereafter; fremverk waives them in full from the date of this version rather than at the statutory deadline. Fees for the Service itself remain payable for the period the Service is provided.

(h) Assistance and good faith. fremverk assists the switching process in good faith and with due care, including by providing the information in (i) below, responding to reasonable technical questions from the Customer or the receiving provider, and not introducing pre-commercial, commercial, technical, contractual, or organisational obstacles to switching. The Customer likewise cooperates in good faith, including by identifying the receiving provider or target infrastructure and by testing retrieved data promptly.

(i) Functional equivalence and open formats. fremforge is a software-as-a-service offering, so the functional-equivalence obligation in Art. 30(1) of the Data Act — which applies to infrastructure-as-a-service — does not attach. fremverk instead meets Art. 30(5) and 30(6): it makes open interfaces available free of charge and exports Exportable Data in structured, commonly used, machine-readable open formats. Specifically: repositories as native git bundle archives, LFS as standard pointer manifests, audit data as JSONL, attestations as in-toto DSSE envelopes, and account and organisation metadata as JSON, with a DSSE-signed SHA-256 manifest over every file. No fremverk-proprietary format is used and no fremverk tooling is required to read an export. Because fremverk runs Forgejo without altering its data model (§7.3), an export is directly importable into a self-hosted Forgejo instance or another Forgejo-compatible host.

(j) Information on switching. The procedures, formats, tooling, size limits, and step-by-step verification recipe are published and kept current at docs.frem.sh/admin/data-export/, which forms the information notice required by Art. 26 of the Data Act. The self-service export is included in the standard per-seat price and is available to every organisation administrator at any time, including throughout the transitional and retrieval periods.

(k) Interaction with termination. Nothing in this §16.6 requires the Customer to terminate in order to switch or port, and nothing in §16.2 to §16.5 limits the rights in this §16.6.

17. Changes to these ToS #

fremverk may amend these ToS on at least 30 days’ prior written notice. A change is materially adverse where it (a) increases Fees beyond the contracted increase mechanism, (b) reduces the liability cap or shifts indemnity allocation, (c) materially reduces functionality covered by the Service description, or (d) changes the governing law or dispute-resolution forum. On any materially adverse change, the Customer may terminate with effect from the change date by written notice within 30 days of fremverk’s notice, and fremverk refunds prepaid Fees attributable to the period after the effective date on a pro-rata basis.

Security-related amendments that address an active threat may take effect on shorter notice, with commensurate transparency.

Where these ToS are amended during a Term, the version applicable to the Customer at the start of that Term continues to govern the Customer’s Subscription until renewal, unless the Customer expressly accepts the amended version (a positive act, not mere continued use). Mere continued use of the Service does not constitute acceptance of an amended version where the amendment is materially adverse within the meaning of this §17. On renewal, the then-current version applies subject to the materially-adverse-change protections in this §17.

18. Force majeure #

Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, strikes, internet or power outages affecting third-party infrastructure, acts of government, or pandemics. The affected party notifies the other promptly and uses commercially reasonable efforts to resume performance.

For the avoidance of doubt, the following are NOT force majeure events:

(a) ransomware, malware, security incidents, or configuration failures affecting fremverk’s own infrastructure or that of its sub-processors, where the proximate cause is within fremverk’s vendor-management or operational control; (b) outages of fremverk’s contracted sub-processors (T Cloud Public, Bunny CDN, Lettermint B.V., Heinlein Hosting / mailbox.org, Mollie, or any successor) — these are governed by the SLA exclusions in SLA §6 and remain fremverk’s commercial risk to manage; (c) failures attributable to fremverk’s own personnel, configuration, or operational error.

19. Assignment #

Neither party may assign or transfer this agreement without the other’s prior written consent, not to be unreasonably withheld. fremverk may assign to a successor in interest in connection with a merger, acquisition, or sale of substantially all assets, provided the successor assumes all obligations.

20. Notices #

Notices to fremverk go to compliance@frem.sh and to the address in §1. Notices to the Customer go to the billing contact and admin-of-record email on file, or to any address the Customer designates in writing. Notices are deemed received on the next business day after dispatch.

Where notice is sent by email to a Customer’s nominated address and fremverk receives a non-delivery report (bounce, mailbox full, address unknown) within 5 business days, fremverk shall make a reasonable second attempt to a backup address (where one has been designated) and to the Customer’s account-of-record administrator before treating the notice as delivered. The Customer is responsible for keeping the nominated security contact and admin-of-record contact current; fremverk is not in breach for inability to deliver to a stale Customer-supplied address after a documented good-faith second attempt.

21. Governing law and jurisdiction #

This agreement is governed by Danish law, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods. The competent courts of Denmark have exclusive jurisdiction, subject to any mandatory provision protecting consumers and to out-of-court dispute resolution mechanisms available under the Digital Services Act.

22. Entire agreement; precedence #

This agreement (these ToS plus the AUP, DPA, SLA, Privacy Notice, Cookie Policy, and any ordering document) constitutes the entire agreement and supersedes prior agreements on the same subject matter. In case of conflict, the order of precedence is: (1) a signed Enterprise-on-Demand ordering document, (2) the DPA, (3) these ToS, (4) the AUP, (5) the SLA, (6) the Privacy Notice, (7) the Cookie Policy, (8) published pricing at frem.sh/pricing.

Notwithstanding the above, no Order Form, pricing page, or commercial document may override the data-protection commitments in the DPA. The DPA prevails over any conflicting term in any Order Form on matters within its scope (Article 28 GDPR processing).

The English-language version of these ToS and the rest of the legal bundle (Acceptable Use Policy, Data Processing Agreement, Service Level Agreement, Privacy Notice, Cookie Policy) controls. Translations into Danish, German, or other languages are provided for convenience only; in the event of conflict, the English version prevails.

23. Severability #

If any provision is held unenforceable, the remainder remains in full effect and the parties negotiate in good faith a replacement provision that most closely achieves the original intent.

24. No waiver #

Failure or delay by either party to enforce any right is not a waiver of that right or of any other right.

25. Relationship of the parties #

Nothing creates a partnership, joint venture, or agency between the parties. Neither party has authority to bind the other.

26. Third-party beneficiaries #

No person other than the parties has any right to enforce any term of this agreement under Danish law, the UK Contracts (Rights of Third Parties) Act 1999 (to the extent it might otherwise apply), or any analogous statute in any jurisdiction. The rights and obligations of employees, contractors, and other Users of the Customer, and of data subjects whose personal data is processed under the DPA, are governed by their own relationships with the Customer or with fremverk ApS as applicable, and not by direct enforcement of this agreement.

27. Customer name and logo #

fremverk may not use the Customer’s name, logo, or trademarks in marketing, customer lists, case studies, or other public materials without the Customer’s prior written consent (email suffices). Consent, once given, may be revoked with 30 days’ notice, after which fremverk removes the Customer’s name and logo from forward-facing materials, noting that historical materials already distributed in print or fixed formats are not recalled.

The Customer may reference its use of the Service factually (for example, “our source code is hosted on fremforge”) without prior consent, consistent with normal commercial usage.

28. Change of control #

In the event of (i) a change of control of fremverk ApS, or (ii) a change of control of any sub-processor disclosed in DPA Annex B that would alter the EU-sovereignty posture set out in DPA §11 (e.g., acquisition by a non-EU/EEA entity bringing the sub-processor within the scope of US extraterritorial process), fremverk notifies the Customer within 10 business days of public announcement. The Customer may, within 60 calendar days of notice, terminate the affected Subscription for cause without penalty, with pro-rata refund of any prepaid unused Fees.

29. Contact #

• General: hello@frem.sh · support@frem.sh
• Legal, contract queries, law enforcement: compliance@frem.sh
• Security: security@frem.sh
• Privacy: compliance@frem.sh
• Abuse (DSA Art. 16): abuse@frem.sh

Change log #