Terms of Service and conditions of use of the Vulscan service

The terms governing the use of the Vulscan service available at vulscan.app.

1. Introductory provisions

1.1 These terms of service (hereinafter the “Terms”) govern the use of the Vulscan service available at vulscan.app (hereinafter the “Service”).

1.2 The operator of the Service is HRUBY Software s.r.o., IČO 05131375, with its registered office at Navrátilova 666/7, Nové Město, 110 00 Praha 1, registered in the Commercial Register kept by the Municipal Court in Prague (hereinafter the “Operator”).

1.3 A User means any person who uses the Service — in particular by running a domain scan or requesting a report.

1.4 By using the Service, the User expresses their consent to these Terms. If the User does not agree with them, they must not use the Service.

1.5 The processing of personal data is governed by a separate Privacy Policy.

2. Description of the Service

2.1 The Service makes it possible to carry out a free, passive security scan of a web domain. The scan checks the publicly available configuration of the website — in particular HTTPS and TLS certificate settings, security headers, email-related DNS records (SPF, DMARC), publicly accessible files and selected elements of common content management systems — and displays an overview of findings.

2.2 The scan is passive. The Operator retrieves solely the information that the target website itself makes publicly available to every visitor. The Operator does not perform logins, password guessing, form submissions, exploitation of vulnerabilities, or any other invasive or load-inducing testing.

2.3 In addition to the free scanner, the Operator may offer further features and paid services (e.g. the Trezor tool for handing over access credentials or a continuous monitoring service). Separate terms always apply to paid services, with which the User is acquainted before ordering.

3. Rules for use of the Service

3.1 The User is entitled to use the Service only for its purpose — to assess the security posture of a website.

3.2 By entering a domain to be scanned, the User confirms that they are authorized in relation to the website of that domain (they are its operator, administrator, or a person acting with their knowledge), or that the scan is directed solely at publicly available information and the User carries it out at their own responsibility. The relationship between the User and the owner of the scanned domain is solely the User's burden; the Operator is not responsible for it.

3.3 The User undertakes not to misuse the Service, in particular:

• not to use it for automated bulk querying, for overloading the Operator's infrastructure, or for circumventing it;
• not to use the scan results to attack third-party systems, to gain unauthorized access to them, or for any other unlawful activity;
• not to disrupt the operation, integrity, or security of the Service;
• not to circumvent the technical or quantitative limitations of the Service.

3.4 The Operator is entitled to restrict or block access to the Service for a User who breaches these Terms or misuses the Service, even without prior notice.

4. Nature of the scan results

4.1 The scan results are for informational purposes only. The scan is an automated tool and does not replace a full security audit, a penetration test, or an expert assessment.

4.2 The Operator does not guarantee that the scan will reveal all of a website's security weaknesses, nor that every displayed finding represents an actual risk. The scan evaluates the state of the website at the moment of the scan and only to the extent of the publicly visible configuration.

4.3 The scan results are not a promise, guarantee, or confirmation of a website's level of security. Decisions made on the basis of the results are made by the User at their own responsibility; for significant steps we recommend consulting an expert.

5. Intellectual property

5.1 The Service, its source code, design, texts, methodology, and generated reports are protected by intellectual property rights and belong to the Operator.

5.2 The User may freely use the scan results and the report concerning their own website for their own needs. The User is not entitled to copy the Service or its parts, to further distribute it for a fee, to reverse-engineer it beyond what is permitted by law, or to create derivative services from it without the Operator's consent.

6. Report and newsletter

6.1 The User may have a PDF report sent to their email. This is a voluntary feature conditional on granting consent to the processing of the email address; consent is not a condition for carrying out the scan.

6.2 On the basis of the same consent, the Operator may send an occasional newsletter with security tips and related offers. You can unsubscribe at any time free of charge using the link in every email or by a message to hello@vulscan.app.

7. The Operator's outreach activity

7.1 As part of its activity, the Operator proactively notifies website operators of security weaknesses identified by a passive scan of their website, by means of a one-off email message.

7.2 Receipt of such a message does not create any contractual relationship or obligation between the recipient and the Operator; the recipient is not obliged to respond to the message or to pay anything.

7.3 The recipient may opt out of further outreach at any time and free of charge — using the link in the message, the unsubscribe button in the message header, or by replying to it. The Operator unconditionally respects any opt-out.

7.4 The way in which the Operator handles personal data in its outreach activity (in particular where it obtains the contact and on what legal basis) is described in the Privacy Policy, in the section “If we contacted you by email”.

8. Disclaimer and limitation of liability

8.1 The Service is provided “as is” and “as available”, free of charge and without warranties of any kind beyond the mandatory provisions of legal regulations.

8.2 To the extent permitted by legal regulations, the Operator is not liable for:

• damage arising as a result of decisions made on the basis of the scan results;
• the inaccuracy, incompleteness, or unavailability of the scan results;
• the unavailability or outages of the Service;
• damage caused by misuse of the Service by the User or a third party.

8.3 The limitation of liability under Article 8.2 does not apply to the extent prohibited by legal regulations — in particular for damage caused intentionally or by gross negligence and for harm to a person's natural rights. If the User is a consumer, these Terms are not interpreted to their detriment in conflict with their statutory protection.

8.4 The Operator is not liable for the content, availability, or security of third-party websites that are the subject of a scan.

9. Availability of the Service

9.1 The Operator makes reasonable efforts to keep the Service running continuously, but does not guarantee it. It may modify, restrict, or terminate the free Service at any time, even without compensation.

10. Final provisions

10.1 These Terms and the relationships arising from them are governed by the laws of the Czech Republic, in particular Act No. 89/2012 Coll., the Civil Code (zákon č. 89/2012 Sb., občanský zákoník). Any disputes are decided by the courts of the Czech Republic. This does not affect a consumer's rights under mandatory regulations, including the option of out-of-court dispute resolution before the Czech Trade Inspection Authority (Česká obchodní inspekce, coi.cz).

10.2 The Operator is entitled to amend these Terms. The new wording becomes effective upon publication at vulscan.app; the effective date in the header always corresponds to the latest version. For use of the Service that has already commenced, the wording effective at the moment of such use applies.

10.3 If any provision of the Terms is invalid or ineffective, this does not affect the validity of the remaining provisions.

10.4 Contact: hello@vulscan.app.