Terms of service

These terms apply from the moment you create an account on app.pupitre.studio or install the Pupitre app. Read them with the licence, the acceptable use policy, the privacy policy, the data processing agreement and the free servers and licences: together they are the whole contract.

Who we are

Pupitre is published by React Consulting SARL AU, a single-member limited company established in Morocco, represented by its manager, Jordan Monier, who is also the publication director. React Consulting SARL AU holds the code, the brand, the domain names and the platform, publishes the source code under the licence, and pays for the hosting of the platform. You contract with it and with it alone. Write to legal@pupitre.studio.

The site and the console are hosted by Cloudflare, San Francisco, United States. The legal notice gathers the identity of the publisher and that of the host.

The responsible party may change

Should the service be transferred to another company, that company takes over these terms, the accounts and the data as they stand, without any change to your rights. Any such change is announced by email to every active account at least thirty days before it takes effect. If you do not want to continue with the new party, you delete your account before that date: your servers keep running, as described below.

The service

Pupitre is a desktop app, an agent installed on a machine you own — a VPS, a dedicated server, a computer — and a console. The app inspects your machine, installs the services you choose, hardens it, and becomes your window onto it: projects, terminals, coding agents, databases, remote editors. The console holds your account, your organisation, the list of your machines and, beyond the free ones, your licence.

An account is required. Everything belongs to an organisation: a personal one is created with your account, and you may create or join others.

The service is meant for professionals and adults. By creating an account, you declare that you have the capacity to enter into this contract and, if you do so for a business, the authority to bind it.

What is free

The service is free for every organisation up to 3 enrolled machines. No payment is collected, no card is asked for, and no invoice is issued. Beyond 3 machines, an organisation needs a licence, which the platform grants on request, at no charge today, as the free servers and licences describe.

Should paid licences be offered one day, this is announced by email to every active account at least thirty days ahead, and nothing is ever charged without an explicit action on your part.

The source code

The source code of the app, the agent, the console and the platform is public, under the Apache License 2.0 with the Commons Clause License Condition. That licence, described in the licence, governs what you may do with the code; these terms govern the service we host at app.pupitre.studio. A platform you run yourself from the source is yours: these terms do not apply to it, and we do not operate it.

What you bring

You bring the machine, the hosting account that bills it, and the subscriptions of the model providers your coding agents use. You stay responsible for what runs on the machine, for the data it holds, for the backups you keep of it, and for the bills of your host and of your providers.

Your private SSH keys never leave your computer. We hold no copy and have no way of obtaining one. The same goes for the access key to your backup storage, kept in your computer’s keychain and on your machine, and for the key that opens your backups: derived from your passphrase on your computer, it only ever goes to your own machine, in memory, for the time of a restore.

What Pupitre receives from your machine

The agent on your machine only ever makes outbound connections: to app.pupitre.studio, to the repositories the software you install comes from, and, when you turn backups on, to the S3 storage you chose. It reads its state every thirty seconds and sends a heartbeat every five minutes. Here is everything the platform receives, and nothing else:

• at enrolment: the name and address you gave the machine in the app, the public half of its SSH host key, the agent version and the processor architecture;
• with each heartbeat: the size and the free space of the disk, the size and the use of the memory, the load average, the version of the agent, the version of the installed stack, the names of the installed catalogue modules, the name of the account that holds the SSH keys, the fingerprints of the SSH keys the agent trusts and of those waiting for the approval of one of your devices, and the names of the running tmux sessions — which are usually the names of your projects; when backups are on, the backup interval, the date of the last attempt and of the last success, the error of the last attempt, and the number of parts it could not carry;
• for each backup, when backups are on: its date, whether it was scheduled or started by hand, its place in your storage (endpoint, region, bucket and object prefix), the digest of its manifest, its size, whether it holds the configuration and the dev account, how many databases, projects and folders it holds, the configuration revision, the agent version, the public key it is encrypted to and the salt used to find the key again from the passphrase, and the name you give it if you start it yourself — never the name of anything it holds, a file, the access key to your storage, or anything that opens it;
• from the app, not from the machine: the public halves of your devices’ SSH keys and the approvals your devices sign for them, which the platform relays to the agent, and, when you restore a backup, the machine you restored it on.

The platform never receives a file, a line of code, an environment variable, a secret, a log, the content of a terminal or of a database, the output of a command, or anything that lives inside your projects. It has no technical means of asking for them: the protocol between the agent and the platform has no such message. A backup goes from your machine to your storage, encrypted to a key only your passphrase gives, without passing through the platform; neither the app, nor the machine, nor Pupitre keeps that passphrase, and a lost passphrase makes your backups unreadable, to us as to you. Only the manifest of each backup stays readable in your storage: it names the machine, the projects, the databases and the folders the backup holds, so that the app can show what it holds before asking for the passphrase. Anyone with access to your storage can read it.

What Pupitre can do on your machine, and what it cannot

The platform has exactly three levers on your machine, all of them applied by the agent itself when it reads its state:

1. The right of use. The platform tells the agent whether your organisation’s licence is valid: free up to 3 machines, or covered by a licence beyond. Without a valid answer for seven days, or when the answer is a suspension, the agent enters restricted mode: it refuses commands from the app and nothing else. It stops no service, deletes no data and touches no file.
2. The list of requested keys. The platform relays to the agent the public keys of the devices of the members of your organisation who are assigned to that machine, with the approvals your devices signed for them. It cannot, on its own, give access to your machine: the agent writes a key into the tagged block of the authorized_keys file of the SSH account it manages only if it already trusts that key — the key your app laid itself over SSH, or the ones the block held when the agent learnt this rule — or if it comes with an approval signed by the private key of a device the agent already trusts. Those private keys stay on your computers; the platform holds none of them and cannot forge an approval. The agent writes that block atomically, without touching any line outside it. Revoking a device or removing a member removes its key on the next read, with no signature needed — but the agent never removes the last key of the block: a suspended machine, or one for which the platform requests no key any more, keeps the keys it holds. Keys you added yourself outside the block, and any other access you keep to the machine, stay as they are.
3. The version to run. The platform names the agent version to install. The agent downloads it from the platform and verifies its Ed25519 signature against the key it carries before installing it. A binary that does not carry that signature is never installed.

Everything else is impossible by construction, not by policy:

• the platform cannot open a connection to your machine: nothing listens for it, it holds no address it could reach, no credential and no key that would open a session, and it cannot have one laid that none of your devices approved;
• it therefore cannot run a command, read, write or delete a file, start or stop a service, project or process;
• there is no hidden access, no support access and no maintenance access. When support needs to see something on your machine, it asks you to send it;
• the app on your computer talks to your machine directly, over SSH, with your own key. The platform is not on that path and nothing that passes between the app and the machine goes through Pupitre. When a project is exposed on a domain, the tunnel is on your own Cloudflare account, mounted from your computer, and the platform is not on that path either.

What the agent does on your machine — installing, configuring, starting, stopping — it does on the orders of your app, on your computer, sent over your SSH session. Nothing happens on the machine without a gesture of yours, except what the agent does on its own for the three levers above and for the services it monitors.

Your machine, your data

Because of the above, the data on your machine is yours alone: we do not hold it, we cannot reach it, and we cannot restore it. We take no responsibility for it — not for its loss, its corruption, its exposure, its backup, or for what a service installed on the machine, a coding agent you started, or a third party who reached the machine does with it. The app makes it easy to run things on your machine; what you run there is your decision and your responsibility.

Third-party software and model providers

The agent installs software on your machine that is not ours — runtimes, databases, coding agents, tools. Each keeps the licence its publisher releases it under, which you accept by installing it; each service in the catalogue carries the name of the software it installs. The coding agents you run use your own subscriptions and remain subject to the terms of the provider whose model they call.

When the right of use ends

When your organisation’s licence ends while it holds more machines than its free ones, or when a machine is suspended, your machine keeps running. Installed services stay installed, your projects stay yours, nothing is erased. The agent enters restricted mode as described above: you lose the app, not the machine. Uninstalling the agent is documented and takes one command.

Availability and support

The service is provided without an availability commitment. The app stays usable for seven days without the platform, so an outage on our side does not cut you off from your machines. We do our best to answer support at support@pupitre.studio, in French or in English, without a promised response time. The state of the platform can be read at app.pupitre.studio/status.

We may stop

We may suspend or discontinue the service, in whole or in part, at any time. A planned discontinuation is announced by email to every active account at least thirty days ahead. An interruption required by security, by law or by a technical failure may be immediate. In every case, your machines keep running, and the agent can be uninstalled.

Ending the contract

You end it by deleting your account from the console, at any time. We end it, for your organisation or for one of its machines, on a serious breach of these terms or of the acceptable use policy, or when the law requires it. A suspension based on a mistake is lifted as soon as the mistake is established.

Liability

The service is provided as is, free of charge, and without any warranty beyond what the law imposes. To the fullest extent the applicable law allows, we are not liable for indirect damage, loss of data, loss of revenue or business interruption, nor for what a coding agent you started does, for the bills of a host or a model provider, or for the acts of a third party who reached your machine.

To the same extent, our total liability for everything arising from the service is limited to what you paid us in the twelve months preceding the event that gives rise to the claim. Nothing here excludes or limits a liability that the applicable law does not allow to be excluded or limited.

Changes to these terms

A change is published on this page with its date. When it is unfavourable to you, it is announced by email to active accounts and takes effect at least thirty days later; you can delete your account until then. Other changes take effect when they are published.

Law and jurisdiction

These terms are governed by the law of Morocco, and a dispute that cannot be settled by writing to legal@pupitre.studio goes before the competent courts of Morocco. Nothing here removes the protection the law of your own country of residence guarantees you as a consumer, including the right to bring a claim before your own courts where that law gives it to you.