Terms of Service

These Terms of Service (“Terms”) form a binding agreement between you and VulnVerify, LLC (“we”, “us”), a limited liability company organized under the laws of the State of Delaware, United States. If you are accepting these Terms on behalf of an organization, you confirm you have authority to bind that organization.

You must provide accurate information when signing up and keep it up to date. You are responsible for safeguarding your password and any actions taken under your account.

You must be at least 18 years old, or the age of majority in your jurisdiction. The service is intended for professional use; consumer accounts are out of scope.

You agree not to:

• Use the service to compromise, attack, or unlawfully access third-party systems.
• Add, verify, or authorize scanning of a domain that you do not own or control, or that you are not permitted to have tested.
• Scrape the database in bulk or attempt to reconstruct the underlying dataset by automated means.
• Resell, sublicense, or transfer your access to a third party without our written consent.
• Circumvent per-tier usage limits, rate limits, or technical controls.
• Use the service in any way that violates US, EU, UK, or other applicable law.

Violations may result in suspension or termination without refund.

The first scan report for a domain you have verified and authorized is free: no card is needed, and it stays available to you whether or not you subscribe. Weekly scanning after that first scan, with its reports and fix verification, is part of a paid plan.

Paid plans renew automatically at the end of each billing period. You can cancel at any time from your billing settings; cancellation takes effect at the end of the current period.

We may change pricing for future billing periods with 30 days' notice via email. All prices are exclusive of any applicable taxes.

Refunds.We offer a 14-day money-back guarantee on the first paid month of any subscription, and a 30-day window on the first year of an annual subscription. After that window, partial periods are not refunded. A full refund ends the subscription it refunds straight away, rather than at the end of the period. Pro-rata credits are available for verified service outages lasting more than 24 hours — email us with the affected dates and we'll verify them against our incident record and credit your next invoice. Full details — including how to request, processing time, and dispute handling — are in our Refund Policy, which is incorporated into these Terms by reference.

VulnVerify owns the service, the verified vulnerability database, the website, and all related intellectual property. We grant you a limited, non-exclusive, non-transferable license to use the service in accordance with these Terms and your subscription tier.

You retain ownership of any data you submit. By submitting data (e.g. a saved search) you grant us a license to process it for the purpose of delivering the service.

The results of the scans we run of your own domains — the findings, the evidence that shows them, and the reports we issue from them — are your data, not part of our database. We process them on your behalf only to deliver the service, as section 6 of our Privacy Policy and our Data Processing Agreement describe. What remains ours is our vulnerability intelligence: the findings our research team gathers and verifies.

Findings reach your account in two ways: from the authorized scans of your domains described in Section 7, and from our vulnerability intelligence, which is gathered and verified by our research team. We make commercially reasonable efforts to keep records accurate and current, but we provide the service on an “as-is” basis with the disclaimers in Section 9.

Automated scanning has limits. A scan can miss a vulnerability, and it can report one that turns out not to be exploitable in your environment. A report with no findings means the checks we ran found nothing; it is not a statement that your systems are secure.

You may use our vulnerability intelligence internally to assess, defend, and remediate vulnerabilities on systems and assets your organization owns or is contractually authorised to defend. Re-use against third-party assets is prohibited. Re-publishing or redistributing our vulnerability intelligence outside your organization requires written permission.

Scan results about your own domains are different: they are your data (Section 5), and you may share them with anyone you choose, such as your auditors, customers, insurers, or a provider you engage to fix them. The scan reports and other documents we issue about your own domains are yours to share in the same way, and anyone holding one can check that we issued it at vulnverify.com/verify/<the file's SHA-256>.

This section applies whenever we send traffic to systems that belong to you rather than reading what is already published: the external vulnerability scans we run of a domain you have verified and authorized, and the re-tests of findings on its hosts. Everything else in our intelligence comes from publicly-accessible sources, and outside this section we do not test anyone's infrastructure. A domain appearing in our findings is never, on its own, a reason to scan it.

How you authorize it. Authorization is given per domain, in two steps in your account. First you prove that you control the domain — with a DNS record, a file served from its website, or a link sent to one of its administrative mailboxes. Then you accept the scan authorization for that domain, giving your name and job title. We record who gave it, their title, when, how the domain was verified, and the version of the authorization text accepted; if we later change that text, an authorization already given stays tied to the version it was given under. By giving it, you authorize VulnVerify to carry out the security testing described in this section on that domain, and you warrant that you own or control the domain and its hosts and have the authority to authorize this testing on behalf of the organization that owns them. Where a hosting, cloud, or other third-party provider requires its own notice or consent before its customers are tested — including a host under your domain that points to a service someone else runs — obtaining it is your responsibility. We do not scan a domain until both steps are complete, and an authorization given for one domain does not extend to any other.

What it covers. External vulnerability scanning of the domain under our safe profile: the free first scan, weekly scans after it while scanning is enabled for the domain, and any scan you start yourself. Which of those your account receives depends on your plan, as Section 4 describes; this authorization is what permits each of them. It also covers re-tests of reported findings on the domain's hosts — including findings from our intelligence on those hosts — to confirm whether a fix holds. A re-test is normally part of the next scan; where a finding needs confirming by hand, one of our researchers may re-test that finding on that host, under the same rules. If your subscription is on a plan we no longer sell that includes testing by our researchers, that testing is covered by this section too: it runs only on a domain you have verified and authorized as described above, it is confined to the scope below, and we confirm its window with you in writing before it starts.

Scope. The scope is the root domain you verified — the registrable domain, such as example.com — and the hosts under it that resolve to it, at any level (www.example.com, api.eu.example.com). Nothing else is in scope: not a different registrable domain, not a lookalike name, not a bare IP address, and not a destination outside the domain that a redirect points to. Our scanner drops any host outside the scope before sending it a request, and our platform rejects any scan result that names one. Individual hosts cannot currently be excluded from a scan; if a host under the domain must not be tested, pause scanning for the domain or remove it.

How we test (rules of engagement). Testing is non-destructive. Scans run only under the safe profile we publish on our scanning page, which excludes denial-of-service, brute-force, fuzzing and intrusive tests and bounds the request rate and concurrency. We do not modify or delete your data. Of what your hosts send back, we keep only a short, size-limited excerpt that shows a finding, with the credentials, keys and tokens our scanner recognises redacted before it leaves the scanner. Scanner traffic comes from the source addresses listed on the scanning page and names VulnVerify in its User-Agent. We may decline, pause, or stop scanning at any time.

How to stop it. Press Pause scanning on the domain in your account to take it out of the schedule, or email security@vulnverify.com and we will stop. Anyone who receives scanner traffic they did not expect can use the same address.

Revoking it. You may withdraw this authorization at any time, for any reason, by removing the domain from your account or by writing to us at the address above. We stop on receipt. Withdrawal does not by itself cancel or refund your subscription — that is governed by Section 4 and the Refund Policy.

Risk and liability. Security testing carries a residual risk of disruption to live systems even when it is non-destructive and in scope. You accept that risk as a condition of authorizing it, and our liability for any effect of testing you authorized is subject to the limit in Section 10. Nothing in this section makes us responsible for a vulnerability that already existed in your systems.

You can terminate your account at any time from settings. We may terminate or suspend your account for material breach of these Terms with notice, or immediately for severe abuse, fraud, or illegal activity. Upon termination, your right to use the service ends and we may delete your data in accordance with our Privacy Policy. Deleting your account removes its domains, with their scans, findings and the report files we issued for them, and every scan authorization given from it ends with them.

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT GUARANTEE THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.

TO THE FULLEST EXTENT PERMITTED BY LAW, OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE IS LIMITED TO THE AMOUNT YOU PAID US IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. WE ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.

You agree to indemnify and hold us harmless from any claim, demand, or loss (including reasonable legal fees) arising from your misuse of the service or violation of these Terms.

These Terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws principles. The state and federal courts located in Delaware have exclusive jurisdiction over any dispute.

Nothing in this section limits your right to bring a claim in the courts of your country of residence if local law requires it.

We may update these Terms from time to time. Material changes will be announced by email and on this page. Continued use of the service after a change becomes effective constitutes acceptance of the revised Terms.

Email contact@vulnverify.com with any questions about these Terms.