Terms of Service

What the Service does

Is My Site Hackable? is an automated security scanner for web applications. It offers a free passive scan that reads only what your site already serves to the public, and paid active (deep) scans plus scheduled monitoring that run only after you prove you own the domain. We also offer an Agency plan that lets you run monitoring for your clients and present the deliverables under your own brand (see below), and we may offer a separate human security audit. The Service is provided on an “as is” basis as described below.

Your authorization to scan (important)

You may submit a domain only if you own it or have explicit, current authorization from its owner to have it security-tested. You are solely responsible for having that authorization, and you represent and warrant that you have it for every domain you submit.

• Passive scans read only publicly-served artifacts (HTML, JavaScript bundles, response headers, and publicly-reachable files). They never log in, submit forms, or query your database.
• Active (deep) scans, monitoring, and any agent-driven probing run only against a domain you have verified ownership of through the Service. No verification, no active scan.
• Testing a domain you don't personally own (for example, a client's site under an Agency plan) additionally requires you to attest, per domain, that you hold the owner's current written authorization for active security testing. We record that attestation and perform active testing in reliance on it. See “Agency and white-label plans” below.
• If your verified site references a backend you own (such as an API or database host detected in its code), you can confirm that backend in your dashboard. Confirming it authorizes active scans and agent probing of that host as well, alongside the verified domain. We only offer backends your verified site actually references.
• You will not use the Service to test systems you are not authorized to test, to gain unauthorized access, or to disrupt any system or network.

Acceptable use

You agree not to:

• use the Service for any unlawful purpose, or to violate anyone's rights;
• submit government, military, or raw IP-address targets, or any domain you are not authorized to test;
• use findings to attack, exploit, or harm any system, or to harass any person or organization;
• resell or sublicense the Service except under an Agency plan as described below, scrape the Service, or attempt to overwhelm, reverse-engineer, or circumvent its rate limits and safeguards.

We may suspend or terminate access for any suspected misuse, with or without notice.

Accounts

Paid features require an account, which is created when you subscribe. Sign-in is passwordless via a one-time code sent to your email, so keeping your email account secure is your responsibility. You are responsible for activity that occurs under your account.

Plans, billing, and cancellation

Paid plans are billed through a third-party payment processor; we never receive or store your raw card details. Subscriptions are priced per monitored domain and billing frequency, recur until cancelled, and you can cancel at any time; cancellation stops future renewals and takes effect at the end of the current period. Agency plans are billed as a fixed platform fee plus a per-client-site charge that adjusts automatically as you add or remove verified domains. Founding-50 monitoring is reserved in advance and begins with a free trial period; your first charge occurs when that trial ends, and we aim to align the trial with when your monitoring goes live. Cancellations and refunds are governed by our Refund Policy: contact us within 14 days of a charge and we will refund that charge in full. Except as set out there or required by law, payments are non-refundable. Prices may change with notice for future billing periods.

Agency and white-label plans

An Agency plan lets you run scans and monitoring for your clients and present the deliverables (reports, alert emails, and verification badges) under your own brand. If you use one:

• You are responsible for your relationship with each client, including what you tell them, the price you set, and obtaining and maintaining each client's authorization to be security-tested.
• For every client domain, before any active testing you must attest that you hold the owner's current, written authorization for the scope and nature of the testing the Service performs. We record that attestation (its version, who attested, and when) and rely on it; a missing or revoked attestation blocks active testing for that domain.
• You represent that you have the right to use the brand name, logo, and colors you upload, and you grant us permission to display them on the deliverables we generate for you. You are responsible for that branding not infringing anyone else's rights.
• White-labeling covers the deliverables, not the scan itself. To honor responsible-scanning norms, our scanner always identifies itself in our name (not yours) in the traffic it sends to a target, and our role as the operator is disclosed on the reports it produces.

No warranty; not a guarantee of security

The Service is provided “as is” and “as available,” without warranties of any kind, whether express or implied, including merchantability, fitness for a particular purpose, and non-infringement. Automated scanning is not exhaustive: a scan that finds nothing does not mean your application is secure, and we do not guarantee that the Service will detect every vulnerability or that reports are error-free. The Service is not a substitute for a comprehensive, professional security audit.

Limitation of liability

To the maximum extent permitted by law, Is My Site Hackable? and its operators will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, revenue, or profits, arising from your use of (or inability to use) the Service. Our total liability for any claim will not exceed the amount you paid us for the Service in the three months before the claim arose.

Indemnification

You will indemnify and hold harmless Is My Site Hackable? and its operators from any claim or liability arising out of your use of the Service, your breach of these terms, or your submission of a domain you were not authorized to test.

Intellectual property

The Service, including its software and report templates, belongs to its operators. The findings and reports generated for a domain you submitted are yours to use for securing that application. Brand assets you upload for an Agency plan remain yours; you grant us only the permission needed to display them on the deliverables we generate for you.

Changes to these terms

We may update these terms. Material changes are reflected by a new version identifier (the version above). When you accept these terms by checking the box on a scan, we record the version, time, and IP of that acknowledgment. Continued use after a change means you accept the updated terms.

Governing law

These terms are governed by the laws of the State of New York, United States, without regard to its conflict-of-laws rules.

Contact

Questions about these terms? Email security@ismysitehackable.com. See also our Privacy Policy.