EJO Cloud Terms of Service

Version: 2026-10-12

This is a translation. The Turkish version is the binding text.

These Terms of Service (the "Agreement") govern the service relationship between [Company name] ([Company address]; "EJO", "we") and the organization that signs up for EJO Cloud (the "Customer", "you"). The Agreement is formed at the moment you accept it on the signup form. If you sign up on behalf of a company or institution, you represent that you are authorized to bind it.

The Data Processing Agreement is an annex to this Agreement and is accepted together with it. The Personal Data Protection Notice and the Cookie Policy are for information purposes.

1. Definitions

• EJO Cloud: The EJO service offered by EJO at ejocloud.com that requires no installation.
• Installation: The EJO master and console set up for the Customer, accessed at <subdomain>.ejocloud.com, with its own database and Kubernetes namespace.
• Agent: The EJO software that the Customer installs on its own infrastructure (Docker, Kubernetes, servers, etc.), which takes jobs from the Installation and runs pipeline steps in the Customer's network.
• Customer Data: All data that the Customer and Authorized Users upload to the Installation or that the Installation collects on the Customer's behalf: user accounts, repository connections, .ejo files, pipeline definitions, deployment records and logs, test reports, SBOMs, image information, secrets, commit and pull request information read from the SCM, audit records.
• Authorized User: Persons for whom the Customer creates an account in the Installation or whom the Customer allows to log in through single sign-on (SSO, LDAP).
• Account Owner: The person who fills in the signup form and is the first administrator of the Installation. EJO sends notifications concerning the Agreement to the Account Owner's email address.

2. The service

2.1. For the term of the Agreement, EJO sets up, operates, backs up and updates an Installation for the Customer. The work the Installation does: connecting repositories to pipelines, receiving SCM webhooks, distributing jobs to Agents, recording deployments, logs and images, enforcing supply chain rules (scan, signature, SBOM), and displaying the service catalog and metrics. The current scope of the service is in EJO's documentation.

2.2. Agents and builds run on the Customer's infrastructure. EJO Cloud does not offer hosted runners. The code of your pipelines and your builds run in the network where the Agent is located; only the status information, logs, test reports, SBOMs and uploaded artifacts that the Agent sends reach the Installation. The security, maintenance and cost of the machine or cluster on which the Agent is installed and of the permissions given to the Agent belong to the Customer.

2.3. Beta. EJO Cloud is currently in beta. During the beta, new signups are approved manually; EJO may reject a signup without stating a reason. During the beta the service is free of charge, there is no service level commitment (SLA) and features may change. We will notify you by email at least 30 days in advance of the end of the beta and of paid plans; if you do not move to a paid plan, the service continues within the limits of the free plan or, if no free plan is offered, the Agreement ends on the date stated in the notice and Section 9 applies.

2.4. Plans and user limit. Each Installation runs with a signed license showing its plan. On the free plan (Community), at most 5 Authorized User accounts can be created; the limits of paid plans are stated at the time of order. When the limit is reached, new users cannot be created; existing users and data are not affected.

2.5. Maintenance and updates. We update Installations to new EJO versions. Updates are performed Installation by Installation and may cause short interruptions. We try to announce planned and lengthy maintenance in advance.

2.6. Support. Support is provided by email at destek@ejocloud.com, on business days and with reasonable effort. There is no response time commitment during the beta.

3. Account and security

3.1. You must provide accurate and current information at signup and keep the Account Owner's email address accessible; notifications concerning the Agreement are made to this address.

3.2. The Customer decides who the Authorized Users will be, their roles and what they do, and the Customer is responsible for them. Keeping access credentials confidential, such as user passwords, SCM tokens, GitHub App keys, Agent registration tokens, and registry and cloud credentials, is the Customer's responsibility.

3.3. If you suspect that your account or an access credential is being used without authorization, revoke the relevant credential immediately and write to destek@ejocloud.com.

4. Acceptable use

You may not use EJO Cloud, the Installation or the Agent for the following purposes:

• any activity contrary to applicable legislation, the rights of third parties or this Agreement;
• accessing, scanning or attacking systems you are not authorized to access; using features such as deploy verification, health checks and webhooks to send requests to addresses that you do not own or have no permission to use;
• trying to access EJO Cloud's infrastructure, other customers' installations or EJO's network, trying to bypass the separation between installations, or performing load tests or security tests without EJO's permission;
• distributing or hosting malware, or using EJO Cloud's resources for cryptocurrency mining;
• renting, reselling or offering EJO Cloud or an Installation to third parties as a service (except for users in your own company group);
• trying to reverse engineer the EJO software, to access its source code or to exceed license and user limits;
• using the Installation with a load that clearly exceeds reasonable use and affects other customers (e.g. unlimited logs, very large artifacts).

If you find a security vulnerability, please report it to destek@ejocloud.com; we will not pursue legal action for vulnerabilities reported in good faith and responsibly.

5. Customer Data

5.1. Customer Data belongs to the Customer. For the term of the Agreement, EJO has the right to use Customer Data only as needed to provide, back up and secure the service, to provide your support and to fulfill its legal obligations.

5.2. EJO does not look at Customer Data without the Customer's request or consent. Exceptions: responding to a security incident or abuse, fixing a fault that disrupts the operation of the service, and cases where the law requires it. In these cases only as much data as necessary is accessed.

5.3. To operate the service and apply the plans, we read aggregate usage information from the Installation: the total number of users and the number of active users in the last 30 days, the number of online Agents, the number of deployments in the last 30 days and the time of last activity. These do not contain per-person information.

5.4. Customer Data contains personal data (the accounts of Authorized Users, the names and email addresses of commit authors, audit records, information that may appear in logs). The data controller of this data is the Customer; EJO is the data processor. The Parties' obligations under KVKK are set out in the Data Processing Agreement. In particular, EJO's developer and pull request metrics may show per-person results; if you will use this data about your own employees, informing them and determining the legal basis for processing is the Customer's responsibility.

5.5. The lawfulness of content uploaded to the Installation and third-party rights in the content are the Customer's responsibility. Take care not to print secrets, personal data or special categories of personal data to logs and pipeline outputs; EJO tries to mask variables marked as SECRET in logs, but cannot prevent the pipeline itself from printing these values in some other form.

5.6. Backups. EJO backs up each Installation's database every day and keeps the backups in Türkiye for 14 days. Backups are for EJO to restore the service; they are not a substitute for backups of the Customer's own production systems, repositories and artifacts. Artifacts kept on the local disk of Agents and of the Installation are not included in the daily backup.

5.7. Export. At the Account Owner's request, during the term of the Agreement and within 30 days after its end, we provide a dump of the Installation's database (in PostgreSQL format). SECRET variables in the dump remain encrypted.

6. Third-party services

EJO communicates with third-party services that the Customer connects (GitHub, GitLab, Azure DevOps, container registries, Kubernetes, Argo CD, HashiCorp Vault, AWS, Azure and CyberArk secret managers, notification channels such as Slack, incident tools, etc.) with the permissions the Customer gives. The use of these services is subject to the terms between the Customer and the provider of that service. EJO is not responsible for outages or API changes of these services or for operations performed with the permissions given by the Customer.

7. Fees and payment

7.1. During the beta the service is free of charge. When paid plans start, prices are shown in Turkish lira at ejocloud.com and at the time of order, stating whether taxes are included.

7.2. Paid plans are paid in advance for the selected period (monthly or annual). Payment is collected by card through PayTR; card details do not reach EJO. An e-Archive invoice is issued for each payment and sent to the Account Owner by email.

7.3. Plans renew for the same period at the end of the period unless the Customer cancels. A reminder is sent by email at least 7 days before renewal.

7.4. Price changes are notified at least 30 days in advance and apply from the first renewal after the notification; the price of a period already paid does not change.

7.5. If a payment cannot be collected, the Account Owner is notified. If it is not paid within 14 days of the notification, the Installation may be suspended; the data of a suspended Installation is preserved and the Installation is reopened when payment is made.

7.6. Fees paid in advance are not refunded, except where EJO terminates the Agreement at its own discretion (9.2) or because of a material breach by EJO, or where the Customer terminates by not accepting a change under Section 12. In these cases the amount for the unused period is refunded.

8. Suspension

EJO may suspend the Installation or a part of it in the following cases: payment delay under 7.5; breach of Section 4; the Installation threatening the security or operation of EJO Cloud, other customers or third parties; a decision of a competent authority. Where possible before the suspension, otherwise immediately after, an email stating the reason is sent to the Account Owner. During suspension the data is preserved and the Installation is reopened when the reason ceases. The suspension lasts only as far and as long as necessary.

9. Term and termination

9.1. The Agreement begins upon acceptance and is of indefinite duration. The Customer may terminate the Agreement at any time by writing to destek@ejocloud.com from the Account Owner's email address.

9.2. EJO may terminate the Agreement with 30 days' notice on free plans, and on paid plans as of the end of the paid period and with at least 30 days' notice.

9.3. If one of the parties materially breaches the Agreement and does not remedy the breach within 14 days of written notice, the other party may terminate the Agreement immediately. In case of a serious breach of Section 4 (e.g. attacks on other systems, malware), EJO may terminate without giving a period.

9.4. After termination. When the Agreement ends, the Installation is closed and deleted. Before deletion, a final backup of the Installation database is taken; this backup is kept for 30 days and an export may be requested within this period under 5.7. Afterwards the backup is deleted; copies in the daily backups drop out automatically within 14 days at the latest. The Account Owner's email address and organization name are also removed from our records after 30 days. Invoice and accounting records that must be retained by law are excepted.

9.5. Provisions that by their nature must remain valid after termination (5.7, 9.4, 10, 11, 13 and the deletion and confidentiality provisions of the Data Processing Agreement) are not affected by termination.

10. Warranty and liability

10.1. EJO provides the service with the care and security measures regarded as reasonable in the industry. Beyond this, to the extent permitted by law, no warranty is given that the service will be uninterrupted or error-free, will meet all your needs or will produce a particular result.

10.2. EJO's security and resilience features (image scan, signature verification, SBOM, environment policies, approval and freeze windows, metrics-based deploy verification, automatic rollback, merge gates) are tools to reduce risks; they do not guarantee that a vulnerability, a faulty release or an outage will never occur. The Customer decides how these features are configured and which deployment is made when.

10.3. EJO is not responsible for the consequences of the Customer's Agents, pipelines, scripts and of operations performed in target environments (Kubernetes, servers, cloud accounts, registries, repositories) with the permissions the Customer gives.

10.4. The parties are not liable to each other for indirect damages, loss of profit, loss of business or loss of reputation.

10.5. EJO's total liability under this Agreement is limited to the fees the Customer paid to EJO in the 12 months before the event causing the damage. For free use, EJO is liable only for intent and gross negligence.

10.6. This Section does not limit liability arising from intent or gross negligence under Article 115 of the Turkish Code of Obligations No. 6098, or other liabilities that the law does not allow to be limited.

11. Intellectual property

11.1. The EJO software (including the master, console, Agent, CLI, blueprints and step packs), its documentation, name and logo belong to EJO or its licensors. This Agreement grants the Customer the right to use EJO Cloud and to run the Agent on its own infrastructure, for the term of the Agreement and only for its own internal business; it does not transfer any other right or grant any other license.

11.2. We may use suggestions and feedback you send to EJO to improve the product, without creating any obligation to you.

11.3. The Customer's .ejo files, pipeline definitions and blueprints written by the Customer belong to the Customer.

12. Changes

EJO may change this Agreement. Changes to the Customer's detriment are notified to the Account Owner by email at least 30 days before they take effect. If you do not accept the change, you may terminate the Agreement until the effective date; in this case the fee for the unused period is refunded under 7.6. Continuing to use the service after the effective date means that you accept the change. Changes arising from a change in law or from security requirements may take effect in a shorter time.

13. Miscellaneous

13.1. Notices. EJO's notices are made to the Account Owner's email address and the Customer's notices to destek@ejocloud.com, and are deemed made on the day they are sent. For termination notices, written notice may also be made to the address above.

13.2. Force majeure. Obligations affected are suspended for the duration of events beyond the parties' control (natural disaster, epidemic, war, general outages, major failures in data center or internet infrastructure, decisions of official authorities).

13.3. Assignment. The Customer may not assign the Agreement without EJO's written consent. EJO may assign the Agreement, by notifying the Account Owner, in case of a transfer of the business, a change in company type (e.g. transition from a sole proprietorship to a capital company) or a merger.

13.4. Consumers. EJO Cloud is for businesses and persons receiving services for their professional activities. Where the Customer is considered a consumer within the meaning of Law No. 6502 on Consumer Protection, the mandatory provisions of that Law are reserved.

13.5. Evidence. In disputes, EJO's system records, email correspondence and the acceptance record kept at signup constitute evidence under Article 193 of the Code of Civil Procedure No. 6100; the right to present counter-evidence is reserved.

13.6. Governing law and jurisdiction. This Agreement is subject to Turkish law. In disputes, the courts and enforcement offices of the place where EJO's headquarters is located are competent; consumers' statutory rights regarding jurisdiction and applying to the consumer arbitration committee are reserved.

13.7. Entire agreement and language. This Agreement and its annexes are the entire agreement between the parties. The invalidity of a provision does not affect the others. The Agreement is published in Turkish and English; in case of any difference between them, the Turkish text prevails.