This Acceptable Use Policy ("AUP") is part of the Terms of Service between you and TAS Group LLC, operator of TasScan. It applies to every user, organization, API token and integration that uses the Service. Capitalized terms have the meanings given in the Terms.
1. Authorized assets only
You may use TasScan only against assets that you own, or for which the owner has given you explicit, current permission to perform the security testing you request. This includes domains, subdomains, hostnames, IP addresses, URLs, APIs and applications. You are responsible for knowing who owns each asset and what permission you hold, including where the asset is hosted by a cloud, CDN, SaaS or managed-service provider that has its own testing rules.
Technical ownership verification in the Service (for example a DNS record, file or meta tag) helps prevent mistakes but does not replace your legal authority and does not shift responsibility away from you.
2. Prohibited: unauthorized scanning
You must not:
- add, verify or scan an asset you do not own or are not authorized to test;
- use the Service to scan a third party's systems, a competitor, a customer, a former employer or any system on the basis of an assumption, a guess, or someone else's unverified claim of permission;
- continue testing after the owner has withdrawn or limited permission;
- misrepresent ownership or authorization to the Service or to a third party; or
- use another person's account, a shared credential, or someone else's identity to obtain access to scanning.
3. Prohibited: harmful activity
You must not use the Service, or any output of it, to carry out or support:
- malware: creating, hosting, delivering or deploying malware, including ransomware;
- credential theft: harvesting, capturing, phishing or exfiltrating credentials, tokens, keys or session data;
- unauthorized data exfiltration: extracting, copying or retaining data from a target beyond what the Service itself collects as evidence;
- destructive activity: deleting, corrupting, encrypting, defacing or modifying systems or data;
- denial of service: any activity intended to or likely to degrade or interrupt a system, including abusive request floods and resource exhaustion;
- persistence: installing backdoors, web shells, scheduled tasks, accounts or other persistence mechanisms;
- phishing and social engineering: deceiving people into disclosing information or taking action, including attacks on staff or customers;
- credential stuffing, password spraying and brute force: automated guessing or replay of credentials. Brute-force testing is prohibited unless a specific feature of the Service explicitly offers it, you have selected that feature, and you hold the owner's separate and explicit authorization for it; or
- any other unlawful, fraudulent or harmful purpose.
4. Prohibited: bypassing controls
You must not attempt to circumvent, disable, probe or weaken any limit or safety control of the Service, including:
- scan limits, account quotas, concurrency limits and plan restrictions;
- ownership and domain verification controls;
- authorization controls, including the Authorized Security Testing confirmation;
- rate limits and request budgets;
- scanner safety limits (such as timeouts, size caps, path and port restrictions); and
- protected, private, internal, loopback, link-local, cloud-metadata and other restricted IP ranges.
You must not use the Service to reach private or internal networks, or use DNS tricks (for example rebinding or changing records during a scan) or redirects to point the scanner at systems that are not yours.
5. Other prohibited uses
You must not: resell or provide the Service to third parties without our written agreement; run automated traffic against the Service that is not an official API use; interfere with other customers or the infrastructure; upload unlawful content or malware; share credentials or API tokens; or use the Service in violation of applicable law, export controls or sanctions.
6. Attacks against TasScan itself
You must not attack, probe or test TasScan's own systems, including the website, portals, APIs, scanners and infrastructure, except as expressly permitted by the Responsible Disclosure Policy and within its limits. Findings should be reported through that policy.
7. Abuse detection
We monitor the Service for misuse using technical signals, which may include verification and authorization records, scan targets and patterns, request volumes, source addresses, failed verifications, reports from asset owners or hosting providers, and account and payment signals. Some controls are automated, for example blocking a target, throttling or stopping a scan. Automated decisions can be reviewed by contacting us (see the Privacy Policy, section on automated security decisions).
8. Enforcement
If we reasonably believe this AUP has been or may be violated, TAS Group LLC may, with or without notice, and without liability:
- stop or cancel scans and monitors in progress;
- restrict specific targets or target types;
- restrict an account's or organization's scanning capability or quotas;
- suspend an account or an entire organization;
- terminate accounts and organizations for serious or repeated violations;
- preserve records (including authorization records, logs, scan configuration and evidence) for investigation and to protect our rights; and
- cooperate with lawful requests from authorities, and report suspected unlawful activity, where legally required or where we consider it appropriate to do so lawfully, and notify an affected asset owner or provider.
We try to apply measures in proportion to the risk and will explain the reason where it is safe and lawful to do so. Suspension does not relieve you of fees owed, and fees are not refunded when an account is suspended or terminated for violation of this AUP.
9. Reporting abuse
If you believe TasScan has been used against a system you own without your permission, please contact us through the official contact page at tasscan.com/contact and include the affected host, the time of the activity and relevant log extracts. TasScan identifies itself in its requests (see the Security page), which helps you find them in your logs. For vulnerabilities in TasScan itself, use the Responsible Disclosure Policy.
10. Changes
We may update this AUP by posting a new version and effective date, as described in the Terms. Where required we will ask you to accept the new version.