Authorized Security Testing Agreement

This Authorized Security Testing Agreement (the "Agreement") is part of the Terms of Service between you (the "Customer") and TAS Group LLC, operator of TasScan ("TAS Group"). It applies each time you instruct TasScan to run an active scan or other security-testing activity against a target, and must be accepted in the product before TasScan performs active testing of a target for the first time and whenever this Agreement changes.

1. Purpose

TasScan sends security-testing requests to targets that you identify. Sending such requests to a system you are not entitled to test may be unlawful. This Agreement sets out what you certify before TasScan does so, what testing involves, and who is responsible for what.

2. Your certifications

Each time you authorize a scan, you certify, on behalf of yourself and your organization, that:

1. Ownership or authorization. You own the target, or you hold explicit authorization from its owner to perform the selected security testing.
2. Continuing validity. That authorization is valid, covers the period in which the scan runs, and has not been withdrawn, expired or limited.
3. Accurate target. The target (domain, host, IP address, URL or application) is accurately identified and is the system you intend to test.
4. Scan profile within scope. The selected scan profile and its checks are within the scope of the authorization you hold.
5. Legal authority. You have the legal authority to instruct TasScan to send security-testing requests to the target.
6. Provider rules considered. You have considered and will comply with the rules of any hosting, cloud, CDN, security or managed-service provider that serves the target, including any requirement to notify or obtain approval from that provider.
7. Lawful. The testing is lawful in every jurisdiction that applies to you, to the target and to its owner.
8. Stop on withdrawal. You will stop testing, and cancel any scan or schedule, immediately if authorization is withdrawn or ceases to apply.

You must not give this confirmation unless every statement above is true.

3. What a scan may do

Depending on the scan profile you select, TasScan may generate and send to the target, from TasScan infrastructure:

• HTTP and HTTPS requests, including requests to common paths and files;
• TLS and certificate tests;
• DNS requests for the target and related names;
• HTTP response header checks;
• cookie attribute checks;
• exposed-service and port tests;
• technology fingerprinting;
• known-vulnerability checks, using safe non-mutating proof techniques; and
• configuration checks.

TasScan scans identify themselves in their requests (see the Security page) and operate within documented rate and size limits. TasScan is designed not to exploit vulnerabilities, deploy payloads, guess credentials, exhaust resources or modify data. Any brute-force, authenticated or other intrusive capability, if offered in future, requires separate explicit authorization through that feature.

4. Risk to fragile systems

Even non-destructive testing can affect fragile, legacy, embedded, rate-limited, or poorly configured systems, and can trigger alerts, logging, blocking or incident response at the target or its provider. You accept that risk.

5. Your responsibilities

You are responsible for:

• Scope. Defining and keeping accurate the assets and scope you authorize.
• Backups. Maintaining backups and recovery capability for the systems you test.
• Timing. Choosing when scans run, and avoiding times when a system cannot tolerate additional load.
• Maintenance windows. Coordinating with your own teams and operators, and keeping scans out of change freezes and maintenance windows where appropriate.
• Third-party permissions. Obtaining permission from owners and providers of any system that is not yours, and notifying them where required.
• Responding to findings. Reviewing results and deciding what action to take.

6. What we record

When you confirm this Agreement, TasScan records, as a legal record that we retain for evidence and investigation of misuse:

• the user who confirmed it and the organization;
• the target;
• the verification state of the target at that time;
• the scan profile and scope selected;
• the date and time;
• the source IP address and user agent of the request; and
• the version of this Agreement that was accepted.

We may disclose these records to the owner of an affected system, to a hosting or infrastructure provider, or to authorities, where we reasonably believe the Service has been misused or where the law requires it.

7. Technical verification does not transfer responsibility

TasScan's technical ownership verification (for example a DNS record, file or meta tag) is an operational safety control. It is not a legal determination of ownership or authority, it does not replace the permissions described in section 2, and it does not transfer legal responsibility away from you. You remain responsible for every scan you authorize.

8. Misuse

Testing a system you are not authorized to test breaches this Agreement, the Terms and the Acceptable Use Policy. We may stop scans, restrict targets, suspend or terminate accounts, preserve records and cooperate with authorities, and you must indemnify us as set out in the Terms.

9. Updates and re-confirmation

When this Agreement changes materially, or when the scope of testing you request broadens beyond what you previously confirmed, TasScan will require a new confirmation before further active testing. Confirmations are tied to the Agreement version recorded at the time.

10. Relationship to other documents

This Agreement supplements and does not replace the Terms. If there is a conflict about scan authorization, this Agreement controls. Section 31 (Limitation of liability) and section 29 (Customer indemnification) of the Terms apply to this Agreement.