All posts
Compliance & FAQ5 min readScodyX trust & billing

Credits, carry-forward and refunds, explained plainly

What a credit is, when unused credits expire, how carry-forward differs between monthly and yearly plans, and what our refund position actually is.

Billing questions reach us more often than any other topic, so here is the full position in one place. Nothing below is new policy — it is the same wording as the pricing and refund pages, with the reasoning attached.

What a credit buys

Credits are consumed per phase of a run: plan, build, verify and repair each debit the ledger. Repairs cost credits too, because they call an engine. Every debit is recorded with a timestamp and request ID and can be exported from the credit ledger page.

Carry-forward

  • Monthly plans: unused plan credits carry forward for a maximum of one month.
  • Yearly plans: unused plan credits carry forward for a maximum of two months.
  • Beyond those windows, unused credits expire and are not reinstated.

Refunds

Purchased credits are non-refundable, including when they go unused. This is stated at checkout before payment. Your statutory rights under the consumer law that applies to you are unaffected, and we honour them where they apply.

Guardrails against surprise spend

  • A confirmation prompt appears every 25 credits consumed within a session.
  • A low-credit banner appears before your balance runs out, with an optional webhook alert.
  • Idempotency keys prevent a retry or engine fallback from charging twice for the same attempt.

Note: If a charge looks wrong, export the ledger entry and send it to support with the request ID — that is the fastest route to a resolution.

Keep reading

What is evidenced, and what is only alignment

Evidenced items are produced by checks that run against the live system and can be exported. Alignment-only items describe how our practices map to a published standard — they are not certifications, audits or attestations by any third party.

Evidenced
Tenant isolation
Row-level security tests run against the live database and are reported in your workspace assurance page.
Evidenced
Audit trail & credit ledger
Every run, deploy and credit movement is recorded with a timestamp and request ID you can export.
Evidenced
Encryption in transit
HTTPS/TLS is enforced on all platform and generated-app endpoints, and probed on demand.
Alignment only
ISO/IEC 27001 & 27701
Our controls are mapped to these standards. We are not certified by an accredited body, and we do not claim to be.
Alignment only
SOC 2 Trust Services Criteria
Practices mapped to the criteria. No SOC 2 report has been issued for ScodyX.
Alignment only
WCAG 2.2 AA
We build to the guidelines and test key flows. No independent accessibility audit yet.

Full control register and framework mappings: Compliance & standards · Security overview