Skip to main content
Legal Agreement

Terms of Use

Last updated: November 9, 2026

1. Acceptance of Terms

By accessing or using SurfaceScan ("the Service"), operated by SurfaceScan Technologies, you agree to be bound by these Terms of Use. If you do not agree with any provision herein, you must immediately discontinue use of the Service.

2. Informational Disclaimer & No Warranty

SurfaceScan performs strictly non-intrusive, passive evaluations of public configurations. All security letter grades (A+ through F), numerical scores (0–100), and automated AI recommendations are provided purely for informational and educational purposes.

An "A" grade does not certify, warrant, or guarantee that a website is impenetrable or free from vulnerabilities. Conversely, lower grades represent configuration opportunities rather than confirmed security breaches. SurfaceScan is not a substitute for formal manual penetration testing, code auditing, or certified compliance reviews.

3. AI Advisory Disclaimer

Guidance generated by the "What to fix first" AI advisor is produced using automated language models and heuristic rules. While tailored to the observed telemetry, automated advice can contain mistakes or omit stack-specific nuances. Site owners must independently verify all directives before executing changes on production servers.

4. Acceptable Use Policy

You agree not to abuse, disrupt, or overload the Service. Prohibited actions include:

  • Conducting bulk, automated, or scripted mass scanning of third-party domains without prior authorization.
  • Circumventing domain opt-out controls (_surfacescan.<domain> TXT opt-out records or blocklist restrictions).
  • Bypassing in-memory rate limits (8 scans/min, 60 scans/day per IP).
  • Submitting fraudulent contact inquiries or spamming the honeypot mechanisms.
  • Attempting Server-Side Request Forgery against private, internal, or loopback IP ranges.

When running the open surfacescan CLI or CI workflow integration, you represent that you own or hold explicit authorization to assess every target domain. Details on request behavior and opt-out are documented at /about-scanner.

5. Shared Report Links

When you generate a shared report link (`/report/:id`), you acknowledge that anyone possessing the URL can view the technical evaluation. Reports remain accessible for 30 days before automatic expiration and deletion.

6. Paid Plans, Billing & Refunds

SurfaceScan offers an optional SurfaceScan Pro digital plan ($5/month) with expanded continuous watchlist monitoring (up to 50 domains) and higher Personal API rate limits (120 req/min, 10,000 req/day).

Access is provisioned automatically and digitally upon verified payment confirmation via supported checkout providers. Subscriptions may be cancelled prior to renewal without penalty while retaining access through the paid 30-day cycle end date. Full refund eligibility rules are detailed in our Refund Policy.

7. Contact & Questions

For legal inquiries or questions regarding these Terms, please reach out via our Contact Page or write to [email protected].