Approval Summary

What it is

Our staff build apps and tools with AI tools such as Claude Code, Cursor, Codex, Copilot, Devin Desktop and Gemini CLI. Each app pulls in packages, which are free code from the internet that nobody here reads. One bad package can read saved passwords and send files out.

Vigilance checks each new package version that our AI tools and our staff install with npm, pnpm, yarn, bun, pip and uv on our computers. It compares the version with the last version it found clean, and finds a file that gained a new power, such as reaching the internet or reading passwords. Paid plans swap that version for the last safe one. One installer on each computer covers every AI tool.

What happens first: a free 14-day watch

• We sign up and save a card. Nothing is charged unless we say yes on day 14.
• For 14 days it only watches. It swaps none of the packages our staff install.
• On day one we see how many packages are already on each computer.
• On day 14 we get a readout: how many different packages came in, on each computer, and which ones needed a look.
• If we say yes, we choose a plan. If not, Vigilance turns off within about 6 minutes and removes itself within 30 days. There is nothing to cancel.

After we buy

The free watch checks and counts. If swapping is not ready when we say yes, the free watch goes on at no charge.

What leaves our computers

• A short code instead of the package name. If nobody has checked that version yet, it sends the public package name and version.
• A random id and a two-word name for each computer, its counts, and codes that let us count different packages without naming them.
• Our code, files, file names, paths, folder names and project names stay on our computers. So do staff names, user names, host names, machine names, hardware ids, install ids, lockfiles, private package names and error reports. App names stay too, except the apps that the whole-computer watch flags (Done For You, which checks every app).
• Vigilance sends no AI tool name outside its fixed list, no program version outside the counts and the join, and no address of any package server.
• The full field list: vigihq.com/security/data

Who checks what is inside

Vigilance checks each public package version once. The readout lists the installs it did not check.

What Vigilance cannot see

Apps built only in a cloud workspace. Computers that did not join. Package managers it does not cover yet. Package versions nobody has checked yet. Who installed what. It cannot tell us which person or app installed a package, because it never gets that data.

What it costs

Prices are per computer, per month.

• Done With You: $49 per computer, per month, or $490 per computer for a year.
• Done For You: $199 per computer, per month plus $2,500 to start, or $1,990 per computer for a year with no start fee.

On monthly plans, we pay on the 1st for each joined computer, for the month ahead. A computer with no report that month gets a credit. Currency: CA$ for Canadian companies, US$ for others. Prices exclude tax. We charge none today.

Monthly plans continue until we cancel. Yearly plans renew each year. Ask within 60 days of the first payment and Vigilance refunds our plan fees, once per company. The $2,500 start fee comes back only if Vigilance misses either full setup or the written review within 14 days. The service stops when the refund starts.

The cost of one bad update (our numbers)

The risk to us

• Each person runs one installer on their own computer, with a join link. The readout lists each joined computer by its two-word name.
• We send our staff a short notice before they install.
• If our service is down or slow, installs go ahead and Vigilance counts them as unchecked.
• If the program stops, installs can fail for about 2 minutes.
• We remove a computer on our owner page. It turns off within about 6 minutes and removes itself within 30 days.
• Our IT provider needs to allow one host and one port. Vigilance gives us a ready email.

Decision

Approve a free 14-day watch for computers: Yes No

Signed Date