Terms of service

Only check what you control

You may only ask us to check a website you own or are allowed to have checked. Before any paid scan you prove control of the site with a DNS TXT record or a /.well-known token that we issue, and you confirm the list of assets in scope. The full method limits are in the rules of engagement.

Your host's rules still apply

Some hosting platforms limit security testing of sites they serve. Our default Safe Profile avoids the activities those policies forbid (such as subdomain takeover, flooding and denial-of-service style tests). Tell us where your site is hosted; we list what ran in every report's limitations.

Reports are point-in-time

A report describes your site at the time of the scan, against the check-set version it names. It is not a promise about later, and it is not a certification beyond the checks it lists.

The guarantee

• (a) At least one actionable finding, or it's free. If the report gives you nothing you can act on, you get your money back.
• (b) Effort estimates you can hold us to. Every finding carries an effort estimate. If one marked at 1 hour or less takes more than 2 hours, you get a refund.
• (c) A refund revokes the certificate. Refunded work can't keep a Fixed & Proven certificate. Its public page changes to REVOKED, so nobody relies on proof you took back.

How to claim, and the window for claims, are set before launch.

Payments, renewals and cancelling

Payments are taken by Stripe. Reports and fixes are one-time payments. Proof Maintenance renews monthly or yearly, as you chose, until you cancel, and you can cancel anytime. On Complete, Proof Maintenance is included through month 12 and then continues at $29/mo unless you cancel; that price is shown before you buy.

Fixes

Fix prices come from the effort estimate in your report. Work beyond a band: $149/h, always with a written quote first. When a fix needs access, you share it through a sealed one-time link, never in an email body, and we return a checklist for rotating anything you shared.

Certificates

A Fixed & Proven certificate is issued only after a retest confirms the fix. Its public page shows PROVEN, EXPIRED once the drift window passes, or REVOKED if the work was refunded.

Liability and governing law

These terms are governed by the laws of the United States and of the state named here before launch. Limitation-of-liability wording is added after legal review.