Terms of Service

Last updated: September 2, 2026

1. Who you're dealing with

"RFF" and "we" / "us" mean Vitko Software, LLC, a California LLC operating the product at getrff.com and app.getrff.com. "You" / "your" means the person or organization using the service. Mailing address available on request.

2. What RFF does

RFF is an endpoint management platform for Windows, macOS and Linux. You install an agent on machines you administer, or use agentless mode to reach machines over SMB or SSH with credentials you supply. Because managing a machine properly requires it, the agent runs as SYSTEM on Windows and as root on macOS and Linux, the highest privilege level on the machine. Most of what follows in these terms is a consequence of that one fact.

What you can direct RFF to do:

• Inventory and report - hardware, installed software, browsers, certificates, services, configuration drift and change history.
• Run code - scripts, installers, uninstallers and multi-step jobs, on demand or on a schedule.
• Patch - Windows Update and Patch Tuesday cycles, macOS and Linux OS updates, third-party application updates, and remediation of specific vulnerabilities.
• Find vulnerabilities - match installed software and Windows build levels against public CVE data.
• Configure - policies, the Settings Catalog, conformance baselines, drive and printer mappings, shortcuts, folders and user preferences.
• Reach a machine directly - view and control its screen, browse and transfer its files, and open an interactive console running as SYSTEM. Console sessions are transcripted and the transcript is stored in your tenant.
• Hold secrets for you - escrow BitLocker recovery keys and store the credentials you give RFF for agentless work. Both are encrypted at rest.
• Provision - bare-metal imaging, agent deployment and agent updates.

This list is deliberately explicit, and it is longer than it used to be. Software that can execute arbitrary code as SYSTEM, watch a screen and hold recovery keys is not an inventory tool, and you should know exactly what you are installing before you install it.

Tell the people using those machines. Remote viewing and control, console sessions and screen access may be regulated where you operate, and notice or consent may be legally required. Meeting that obligation for your own users and customers is yours, not ours.

3. Your account

You're responsible for keeping your login credentials secret. Anything done from your account is treated as done by you. If you suspect unauthorized access, change your password immediately and email us - we can reset MFA, terminate sessions, and review the audit log on your behalf.

You can only install the RFF agent on machines you have the authority to manage. Don't push RFF to your neighbor's laptop. Don't push it to a customer's fleet without their consent. We assume you have authorization for every endpoint you connect.

Identity verification. RFF runs code with administrator rights on the machines you connect, so we need to know who is operating an account. We may ask you to verify your identity, your business, or your authority over the endpoints you're managing, and we may suspend an account while that verification is outstanding. We'll tell you what we need and restore access as soon as it checks out. This is not a formality we enjoy - it exists because a stolen identity plus a remote management tool is somebody else's very bad day.

4. Pricing and payment

Pricing is published at getrff.com/#pricing. Paid plans bill monthly via Stripe. By signing up for a paid plan you authorize Stripe to charge the payment method you provide.

• Free tier: $0, up to 100 endpoints, throttled poll cadence. Always available.
• Paid plans: 14-day trial on signup. Your card is captured but not charged until day 15. If you cancel before day 15, you pay nothing.
• Cancellation: you can cancel anytime from your account's billing page (Stripe Customer Portal). Your subscription remains active until the end of the current billing period; no further charges occur.
• Refunds: we don't pro-rate refunds for partial months. If you cancel mid-month, you keep the service through the end of the billing period and aren't charged again. Special cases - service outages, billing errors, anything we screwed up - we'll make it right; email me.

Payment has to be yours. You confirm the payment method belongs to you or that you're authorized to use it. If a payment is reversed, disputed as fraudulent, or we have reasonable grounds to believe the card isn't yours, we may suspend or close the account immediately and without notice, and we may refund the payment ourselves rather than wait for a dispute. Accounts opened with someone else's payment method get terminated, not warned.

5. Your data

You own your data. The hardware inventory, software inventory, jobs, groups, policies, audit log, and any files you upload - that's yours.

Some of what RFF holds for you is more sensitive than inventory, so it is worth naming: BitLocker recovery keys you escrow, credentials you store for agentless work, and the transcripts of remote console sessions. These are encrypted at rest and are treated as your data on exactly the same terms as everything else above: we don't sell them, share them, or use them to train anything.

We collect and process this data only to run the RFF service for you. We don't sell it, share it with advertisers, or use it to train models. See the Privacy Policy for the full breakdown of what we collect and where it lives.

On account deletion, your data is purged from our active database within 7 days. Encrypted backups retain it for up to 90 days before rotation, after which it's gone. If you need a data export before deletion, request it via email and we'll provide a JSON dump.

6. Acceptable use

Don't use RFF to:

• Push malware, ransomware, cryptominers, or anything that harms the endpoints you're managing or anyone else's.
• Bypass authentication, access endpoints you're not authorized to manage, or use credentials you don't legitimately have.
• Probe, attack, or attempt to compromise RFF's infrastructure (api.getrff.com, the database, the agent update channel, etc.).
• Resell or sublicense the service to your own customers without an MSP agreement (the MSP plan exists for this - talk to us).
• Violate any applicable law in your jurisdiction.

If you do, we may suspend or terminate your account. For obvious abuse we'll act first and explain after; for borderline cases we'll email you first and give you a chance to fix it.

7. Service availability

We try hard to keep RFF running, but we don't promise zero downtime. RFF is hosted on Render and Cloudflare; we depend on them being up. Planned maintenance is announced in-app or via email when feasible. There is no formal SLA on Free and Starter plans. MSP plans get a best-effort 4-hour response on support tickets and we keep an internal target of 99.5% uptime - if a real SLA matters for your contract, email us.

8. Disclaimer of warranties

RFF is provided as is. We don't warrant that it will be uninterrupted, error-free, or fit for every purpose. The agent runs powerful operations on your endpoints - test changes against a small group before pushing fleet-wide.

9. Limitation of liability

To the extent the law allows it, our total liability to you under these terms is capped at the amount you paid us in the 12 months before the claim arose. We're not liable for indirect, incidental, or consequential damages (lost profits, lost data, downtime damages, etc.). This cap is a deliberate trade for the price we charge - if you need a higher cap, talk to us about a custom enterprise contract.

10. Termination

You can leave anytime - cancel from the Stripe Customer Portal or email us. We can terminate or suspend your account for violation of these terms, non-payment beyond 90 days, or because the company is shutting down (we'll give you at least 90 days' notice and a data-export window if so, matching the commitment on our security page).

11. Changes to these terms

We'll update these terms occasionally as RFF evolves. Material changes - anything that affects your rights or obligations - will be emailed to you with at least 30 days' notice before they take effect. Minor edits (typos, clarifying language, the "last updated" date) we'll just push.

12. Governing law

These terms are governed by the laws of the State of California, without regard to conflict-of-law principles. Disputes go to the state or federal courts in Riverside County, California. If you're outside California and a different jurisdiction is mandatory under your local law, that takes precedence.

13. Questions?

Email brian@getrff.com. You'll get a reply from a person - usually me - within a business day.