Rules of engagement

Authorization comes from whoever controls the site

A written authorization only counts if it comes from someone entitled to control access to the asset. Your say-so about a CDN, host or third-party service you do not control does not authorize us to test it. Each paid scan carries an authorization block: your warranty of authority, the list of assets, the method limits, and your per-asset opt-ins.

Control verification first

No paid scan starts until control is proven by a DNS TXT record or a /.well-known token we issue. The same record serves as the authorization for breach-exposure lookups on that domain.

The Safe Profile is the default

• Passive and single-request checks (layers T0 and T1) and, on paid reports, a low-rate map of common ports (T2).
• Fingerprinting (T3) and path discovery (T4) run only with your opt-in for each asset.
• Login or exploit proof (T5) runs only with an explicit tick for each asset, on Complete.

What never runs

• Denial-of-service or flooding tests, or any tool whose overload capability is not disabled.
• Subdomain or storage-bucket takeover, and DNS zone walking.
• Anything a hosting platform's published policy forbids for sites it serves.

Stopping

The customer, or the operator of any asset we touch, can ask us to stop. We stop within 4 hours of the request. Write to abuse@utlyze.com.

Handling what we see

Everything we fetch is treated as data, never as instructions. Evidence is kept for your report and its retests. Third-party data sources are cited and linked in reports, never copied in.

Identity

Our scanner's purpose, limits and contact are on the scanner identity page, and its source IPs are published there before the first public scan.