Terms of service

01

Agreement

These terms govern your use of trustpect.com, the free site check and the Trustpect application. By using the service, you agree to them. If you act for an organisation, you confirm that you may accept them on its behalf. Our privacy policy explains personal data processing. Accepting these terms does not itself authorise a scan.

These terms take effect on the day this site is published; the date shown at the top is updated at that time.

02

The service

Trustpect maps website attack surfaces, runs permitted security checks, shows findings with masked evidence, suggests fixes and retests them. Checks may be selected in response to a change or a relevant vulnerability advisory, within existing permissions. Available checks, targets, retention and usage limits depend on the selected plan and profile.

You decide which fixes to make and apply them yourself or through your developer. Trustpect does not modify or repair your systems. Changes that reduce the scope of a paid plan will be communicated before they take effect.

03

Your account

Provide accurate account information. Keep sign-in details secure, protect any second authentication factor and assign appropriate roles to team members. You are responsible for use you authorise through your account. Report suspected misuse promptly through the contact you received with your invitation.

For signed-in scans, use dedicated test accounts with the least access needed. Keep those accounts and their permissions current, and exclude actions that must not be tested. Giving us credentials does not give us permission to scan.

04

Authorisation to scan

Except for the public passive check described below, scan only systems you own or whose owner has authorised you in writing to have tested. Keep that authority current. Active scans require both ownership proof and a separate, explicit, time-limited permission that can be revoked. A proof alone never starts a scan.

• Permission covers one exact origin: scheme, host and port, with the agreed profile and limits. Discovered hosts and subdomains need their own verification and permission.
• Choose a scan window suitable for the system. Use the emergency stop or revoke permission when testing must end.
• Once permission is revoked or expires, or an emergency stop is accepted, no new scan request is dispatched under it. An already sent request cannot be recalled.
• We may refuse or stop scans outside the authorised scope. You remain responsible for obtaining the owner's written authority.

05

The free check

The free check needs no account or ownership proof. It reads only publicly visible information about public domain names: certificates, response headers, cookie flags, public DNS records and a short, fixed list of public paths. It uses at most 15 requests, sends no attack payloads and never signs in. IP addresses, internal names and reserved names are not accepted as targets.

Daily limits apply by domain and connection, and results are cached for 24 hours. Without an account you see the grade and the first three items; an account gives access to the full list and explanations. Active or signed-in scans still require ownership proof and separate permission.

06

Acceptable use

• Do not start active or signed-in scans without the owner's authority and the required proof and permission.
• Do not bypass target scope, budgets, daily limits, permissions, scan windows or the emergency stop.
• Do not overload the service, access another customer's data or use results to harm others or break the law.
• Do not use the free check for automated bulk requests or resale.

Report a security issue or unwanted traffic as described on our security page. Reporting an issue does not itself grant permission to attack Trustpect or another system.

07

Results and their limits

Trustpect does not guarantee that every vulnerability, including an unknown vulnerability, will be found, or that a site is fully secure. Untested is not secure. A grade and an absence of findings describe only the checks that ran successfully in the stated scope.

Timeouts, blocked requests, lost sessions, errors and exhausted budgets are reported as partial, inconclusive or unsupported, never as a clean result. A finding closes only after a successful retest under equivalent scope. Retests are targeted checks and are subject to plan and fair-use limits; they are not unlimited full scans.

08

Your data and credentials

You retain your rights to the data you submit and the reports produced for you. You permit Trustpect to process that data to provide and secure the service. You are responsible for having the rights and legal basis needed to submit it, and for the recipients of reports or share links you create.

Credentials for signed-in scans stay in an encrypted vault. Plaintext is used only in memory for authorised sign-in tests and scans, and never enters logs, reports or AI inputs. You can delete the stored credentials by revoking the profile.

Trustpect retains its rights to the platform, software, branding and service content. Rights in your reports do not transfer ownership of the platform or of third-party material referenced in them.

09

Plans, prices and payment

Plan features and limits are described on our pricing page. Prices are in US dollars and exclude applicable taxes. Signing up does not require a card and does not start a paid plan.

When payments are accepted, the price, billing period and payment terms will be shown before you choose and pay for a plan. Monthly subscriptions may be cancelled at any time; cancellation takes effect at the end of the current paid monthly period. There is no refund for the unused part of that period, except where mandatory law requires one. A one-time scan is paid once per site and includes the retest described on the pricing page; once the scan has started there is no refund, except where mandatory law requires one.

Any price change will be communicated before it applies to your next billing period. These terms do not remove mandatory withdrawal, refund or other consumer rights.

10

Suspension and termination

You may close your account at any time. We may suspend or end access for misuse, unauthorised targets, serious or repeated breaches of these terms, or a legal requirement. If there is an immediate security risk, we may stop activity first. Where circumstances allow, we will explain the reason and give you an opportunity to address it or export your data.

Closing an account does not extend scan permission. Data retention and deletion are described in the privacy policy.

11

Disclaimers and liability

To the extent permitted by law, the service carries no warranty of uninterrupted operation or complete security, and Trustpect is not liable for indirect or consequential losses. Its total liability arising from the service is limited to the fees you paid to Trustpect for it in the 12 months before the event giving rise to the claim.

These exclusions and limits do not apply where liability cannot lawfully be excluded or limited, including mandatory consumer rights. You remain responsible for acting within your authority and for applying and checking your own fixes.

12

Changes, law and contact

We will update the date at the top when these terms change and communicate significant changes before they take effect. Changes do not remove rights that mandatory law gives you.

Applicable law and competent courts are determined under the mandatory rules that apply to your relationship with Trustpect. Nothing in these terms restricts mandatory consumer protections or your right to use a legally competent court.

For questions about these terms, billing or cancellation, use the contact you received with your invitation.