Terms of Service

1. Agreement and acceptance

These Terms of Service ("Terms") are between you and TAS Group LLC, a Wyoming limited liability company, operator of TasScan ("TAS Group", "we", "us", "our"). They govern your access to and use of the TasScan website, customer portal, APIs, mobile applications, scanners, monitors, reports and related services (together, the "Service").

By creating an account, clicking to accept, or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

2. Business use and age requirement

The Service is intended for business and professional use. You must be at least 18 years old, and you may use the Service only for a business, organizational or professional purpose. The Service is not intended for consumers or for anyone under 18, and we do not knowingly provide it to anyone under 18.

3. Authority to bind an organization

If you register or use the Service on behalf of a company or other organization (a "Customer"), you represent that you have authority to bind that organization to these Terms. In that case, "you" and "Customer" refer to the organization as well as to you personally as its representative. If you do not have that authority, you must not accept these Terms.

4. Incorporated policies

The following documents form part of these Terms and apply to your use of the Service:

• the Privacy Policy;
• the Acceptable Use Policy;
• the Authorized Security Testing Agreement;
• the Data Processing Addendum, which applies where we process personal data on your behalf;
• the Cookie Policy; and
• the Responsible Disclosure Policy, which governs security research on TasScan itself.

If these documents conflict, the Data Processing Addendum controls for the processing of personal data, the Authorized Security Testing Agreement controls for scan authorization, and otherwise these Terms control. A written enterprise agreement signed by TAS Group LLC controls over these Terms only to the extent it expressly says so.

5. The Service

TasScan provides authorized, non-destructive website and external-attack-surface security assessment, including vulnerability scanning, continuous monitoring (for example uptime, TLS certificate, DNS, security header and defacement monitoring), attack-surface discovery for domains you have verified, findings management, notifications and reports. Features depend on your plan and may change as described in section 24.

6. Automated scanning limitations

You acknowledge and agree that:

1. False positives. The Service may report issues that are not real vulnerabilities in your environment.
2. False negatives. The Service may fail to detect vulnerabilities or misconfigurations that exist. A scan with no findings does not mean no vulnerabilities exist.
3. No guarantee of security. Use of the Service does not make a system secure and does not guarantee that it cannot be compromised.
4. Not a penetration test. The Service is an automated assessment tool. It does not replace a manual penetration test, code review, red-team exercise or security audit, including where any of those is required by law, contract, regulation or your own policies.
5. No compliance guarantee. The Service does not guarantee, certify or attest compliance with any law, regulation, standard or framework (for example PCI DSS, ISO 27001, SOC 2, HIPAA or GDPR). Reports may help you gather information but are not compliance advice or certification.
6. Your judgment. You are responsible for reviewing findings, deciding what action to take, and verifying fixes.

7. Accounts and organization administrators

1. You must provide accurate registration information, keep it current, and use a business email address.
2. You are responsible for all activity under your account and for keeping your credentials, authentication factors and API tokens confidential. Notify us promptly of suspected unauthorized access.
3. We strongly recommend multi-factor authentication. An organization owner may require it for the organization.
4. An organization owner or administrator may invite members, assign roles, manage assets and subscriptions, and accept legal terms on the organization's behalf. The organization is responsible for the people it invites and for their compliance with these Terms.

8. Authorized targets only

You may scan or test only assets that you own or for which you hold explicit, current permission from the owner to perform the security testing you request. This applies to every domain, hostname, IP address, URL and application you add to the Service and to every scan or monitor you start.

Specifically:

1. You must not add, verify or scan a target you do not own or are not authorized to test.
2. Third-party systems (including hosting, cloud, CDN, SaaS and managed-service platforms, and systems belonging to your customers, vendors or affiliates) may be tested only with that third party's explicit permission and in compliance with its rules and acceptable-use or penetration-testing policies.
3. Active scanning of a target is available only after the target has been verified through the Service's ownership verification controls and an Authorized Security Testing confirmation has been recorded for it.
4. Technical ownership verification is a safety control, not a legal determination. It does not transfer responsibility away from you and does not replace the permissions described in this section.

9. Scan authorization

Each time you authorize a scan you make the certifications set out in the Authorized Security Testing Agreement. You agree that we may record the authorization (see that agreement) and that the record is evidence of your instruction to us.

10. Safety controls and non-destructive testing

The Service is designed to perform observational and non-destructive checks within documented rate and size limits, to refuse private, internal and other protected network ranges, and to stop on instruction. The Service is not designed to exploit vulnerabilities, deploy payloads, guess credentials, exhaust resources or modify data on a target.

Even non-destructive testing can affect fragile, legacy, rate-limited or poorly configured systems. You are responsible for deciding whether, when and how a target should be tested, as set out in the Authorized Security Testing Agreement. You must not attempt to bypass or weaken any safety control, limit, quota or verification step.

11. Customer responsibilities

You are responsible for: (a) your use of the Service and the accuracy of the targets and scope you configure; (b) obtaining all permissions, consents and notices needed to use the Service lawfully, including from hosting and cloud providers; (c) maintaining backups and recovery capability for the systems you test; (d) the security of your own accounts, devices and integrations; (e) complying with applicable law; and (f) acting on findings. You must comply with the Acceptable Use Policy.

12. Customer Data

"Customer Data" means data you or your users submit to or generate in the Service, including organization details, assets, verification records, scan configuration, scan results, findings, comments, attachments, reports and support communications.

1. Ownership. As between you and us, you retain your rights in Customer Data.
2. License to operate the Service. You grant TAS Group a worldwide, non-exclusive license to host, process, store, transmit, display, analyze and back up Customer Data as needed to provide, secure, maintain and support the Service, to prevent abuse, to comply with law, and to enforce these Terms.
3. Service improvement. We may use aggregated or de-identified data derived from the operation of the Service (for example rule statistics and performance metrics) to maintain and improve the Service, provided it does not identify you, your users or your assets.
4. Personal data. Our handling of personal data is described in the Privacy Policy and, where we act as your processor, the Data Processing Addendum.

13. Sensitive information handling

Scans may incidentally observe sensitive information exposed by a target, such as credentials, tokens, session identifiers, personal data or private keys. The Service is designed to minimize collection and to redact common secrets (such as authorization headers, cookies, API keys, tokens, passwords, session identifiers and private keys) from stored evidence, but redaction cannot be guaranteed to catch every case. You must not use the Service to collect, store or exfiltrate sensitive information, and you must not submit payment card data, health records or other regulated data to the Service in support tickets, comments or attachments unless we have agreed otherwise in writing. Where evidence contains exposed secrets, you should treat them as compromised and rotate them.

14. Customer content warranties

You represent and warrant that: (a) you have all rights necessary to submit Customer Data and to grant the licenses above; (b) Customer Data and your use of the Service will not violate law or the rights of any person; (c) the targets you configure are owned by you or you are authorized to test them; and (d) you will not submit malware or unlawful content.

15. Subscriptions

Access to some features requires a paid subscription ("Subscription") on a plan, billing interval and set of limits shown at the time of purchase (for example number of assets, users, scans, retention and API access). Subscriptions renew automatically for successive periods of the same length until cancelled, unless the order says otherwise. You may cancel at any time effective at the end of the current paid period; cancellation stops future renewals and does not entitle you to a refund of fees already paid except where required by law or stated in a written order.

16. Fees

Fees are stated in the applicable currency at purchase and are exclusive of taxes, which you are responsible for (other than taxes on our income). We may use a third-party payment processor, and you authorize it to charge the payment method you provide. Fees are non-refundable except as required by law or expressly stated. If a payment fails, we may retry it, suspend paid features, or downgrade the account to a free plan after reasonable notice. We may change prices for future periods by giving you notice before the change takes effect; a change does not affect a period already paid for.

17. Free and trial services

Free plans, trials and the free security check are provided as-is, may have reduced limits and retention, may be changed or withdrawn at any time, and are not covered by any service commitment. We may apply stricter limits or require verification before offering them.

18. Service changes

We may modify, add or discontinue features, limits, plans and integrations. If we make a change that materially reduces functionality you have paid for, we will give you reasonable notice and, where the change is adverse and you are on a paid plan, you may cancel and receive a pro-rata refund of prepaid fees for the unused remainder of the then-current period.

19. Third-party services

The Service relies on and may integrate with third-party services (for example hosting, content delivery, email delivery, payment processing, push notification delivery and integrations you enable). Those services are governed by their own terms. We are not responsible for third-party services we do not control, and your use of integrations is at your own risk.

20. Intellectual property

The Service, including software, scanning rules, content, report templates, documentation, trademarks and the TasScan name and logo, is owned by TAS Group LLC or its licensors and is protected by law. Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable right to use the Service for your internal business purposes during the term. You must not copy, modify, reverse engineer, resell, sublicense or provide the Service to third parties as a competing service, or remove proprietary notices, except to the extent that law does not permit these restrictions. Reports generated for you may be used by you for your internal security and compliance purposes and shared with your advisers, auditors and customers.

21. Feedback

If you give us suggestions or feedback, you grant TAS Group a perpetual, irrevocable, worldwide, royalty-free license to use it without restriction or obligation, provided we will not identify you as its source without your permission.

22. Confidentiality

Each party will protect the other's non-public information that is marked confidential or that a reasonable person would understand to be confidential, using reasonable care and using it only to perform or exercise rights under these Terms. This does not apply to information that is public through no fault of the recipient, was already known to or independently developed by the recipient, or was lawfully received from a third party. A party may disclose confidential information where required by law, after giving notice where lawful. Customer Data is your confidential information.

23. Security

We maintain technical and organizational measures designed to protect the Service and Customer Data, as described in the Data Processing Addendum and on our Security page. No system is completely secure, and we do not guarantee that the Service will be free of vulnerabilities, interruption or loss. You are responsible for configuring your account securely (for example by enabling multi-factor authentication). Security researchers should follow the Responsible Disclosure Policy.

24. Support, availability and changes

We provide support through the channels and during the times described for your plan. We use reasonable efforts to keep the Service available, but we do not guarantee uninterrupted or error-free operation and may perform maintenance, sometimes without notice. No uptime commitment applies unless set out in a written enterprise agreement.

25. Suspension

We may suspend or restrict all or part of the Service, a scan, a target, a user or an organization immediately and without liability if we reasonably believe that: (a) you have violated or are likely to violate these Terms, the Acceptable Use Policy or the Authorized Security Testing Agreement; (b) use is unauthorized, abusive or creates a risk to the Service, to other customers or to third parties; (c) a legal or regulatory requirement applies; or (d) fees are overdue. Where practical, we will tell you why and what is needed to restore access.

26. Termination by you

You may stop using the Service and close your account or organization at any time from the portal or by contacting us. Closure takes effect as described in section 28.

27. Termination by TasScan

We may terminate your access and these Terms: (a) for material or repeated breach, immediately for serious misuse such as scanning targets you are not authorized to test; (b) if we stop offering the Service, with reasonable notice; or (c) where required by law.

28. Effect of termination

On termination or closure: your right to use the Service ends; scheduled scans and monitors stop; and Customer Data is retained for a restoration period (30 days by default) and then deleted or de-identified according to the Privacy Policy and the Data Processing Addendum, subject to legal retention obligations, backups that expire on their normal cycle, and records we keep to evidence authorization and investigate misuse. You can export reports and findings before closing. Sections that by their nature should survive (including sections 6, 8, 12 to 14, 20 to 22 and 29 to 40) survive. Termination does not relieve you of fees owed for the period before termination.

29. Customer indemnification

You will defend, indemnify and hold harmless TAS Group LLC, its members, managers, officers, employees, contractors and affiliates from and against all claims, demands, investigations, losses, damages, liabilities, penalties, costs and expenses (including reasonable attorneys' fees) arising out of or related to: (a) any scan, test or monitor of a target that you were not authorized to test, or any breach of section 8 or the Authorized Security Testing Agreement; (b) your misuse of the Service or violation of the Acceptable Use Policy or applicable law; (c) any effect on a target or on any third party caused by testing you authorized; (d) Customer Data or your instructions infringing or violating the rights of a third party; or (e) your breach of these Terms. We will give you prompt notice of a claim, reasonable cooperation at your expense, and the right to control the defense, except that you may not settle a claim in a way that imposes obligations on us or admits fault on our behalf without our consent, and we may participate with our own counsel at our expense.

30. Warranty disclaimer

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, TAS GROUP LLC DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY AND QUIET ENJOYMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE, THAT IT WILL DETECT ALL OR ANY VULNERABILITIES, THAT FINDINGS WILL BE ACCURATE OR COMPLETE, OR THAT USE OF THE SERVICE WILL ACHIEVE OR MAINTAIN SECURITY OR COMPLIANCE.

31. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

1. TAS Group is not liable for indirect, incidental, special, consequential, exemplary or punitive damages, lost profits, lost revenue, lost business, business interruption, goodwill loss, data loss or substitute services, however caused and under any theory of liability, even if advised of the possibility of such damages.
2. For paid services, TAS Group's aggregate liability arising out of or related to the Service and these Terms will not exceed the fees you actually paid to TAS Group for the Service in the 12 months preceding the first event giving rise to liability.
3. For free services, TAS Group's aggregate liability will not exceed USD 100.
4. These limits apply to all claims in the aggregate and are not increased by the number of claims.

Nothing in these Terms excludes liability that cannot lawfully be excluded or limited.

32. Allocation of risk

You acknowledge that the fees and the limited scope of the Service reflect an allocation of risk between the parties, that the disclaimers and limitations in sections 30 and 31 are an essential basis of the bargain, and that we would not provide the Service without them. You are responsible for decisions you make based on the Service and for the effect of testing you authorize on your own and third-party systems.

33. Export controls and sanctions

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions, and that you are not on, or owned or controlled by a person on, any U.S. government restricted-party list. You will not use the Service in violation of U.S. export control or sanctions laws or permit its use by a person or for a purpose prohibited by them.

34. Force majeure

Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disaster, war, terrorism, labor disputes, government action, failure or degradation of utilities, telecommunications, cloud, network or third-party service providers, malicious attacks, or pandemic.

35. Governing law

These Terms and any dispute arising out of or relating to them or to the Service are governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

36. Dispute handling

1. Informal resolution. Before starting a formal proceeding, the party raising a dispute will send written notice describing it, and the parties will try in good faith to resolve it within 30 days.
2. Venue. Subject to the preceding step and to any mandatory law that gives you other rights, the state and federal courts located in the State of Wyoming have exclusive jurisdiction over disputes under these Terms, and each party consents to that jurisdiction and venue.
3. Injunctive relief. Either party may seek injunctive or equitable relief in any competent court to protect its intellectual property, confidential information or the security of its systems.
4. Time limit. To the extent permitted by law, a claim must be brought within one year after it arose.

37. Class-action waiver

To the maximum extent permitted by law, you and TAS Group each agree that claims will be brought only in an individual capacity and not as a plaintiff or class member in any purported class, collective, consolidated or representative action. If this waiver is held unenforceable as to a claim, that claim will proceed in court on an individual basis and not as a class action. This section does not apply where applicable law prohibits it.

38. Assignment

You may not assign or transfer these Terms without our prior written consent, except to a successor to all or substantially all of your business that agrees in writing to be bound. We may assign these Terms to an affiliate or to a successor to the business of the Service. Any other attempted assignment is void.

39. Notices

We may give notice by email to the address on your account, by in-product notice, or by posting on this website. You may give notice to us through the official contact page at tasscan.com/contact. Notices are effective when sent or posted, except that notices of a dispute must be sent as described in section 36.

40. Changes to these Terms

We may update these Terms from time to time. We will post the updated Terms with a new version and effective date, and for material changes we will give notice by email or in the product at least 30 days before the change takes effect where practical. Where required, we will ask you to accept the new version before you continue to use the Service. If you do not agree to a change, you may close your account before it takes effect; continued use after the effective date is acceptance.

41. Severability, no waiver and entire agreement

1. Severability. If a provision is held invalid or unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions continue in effect.
2. No waiver. A failure or delay in exercising a right is not a waiver of it. A waiver is effective only if in writing.
3. Entire agreement. These Terms, with the documents they incorporate and any written order or enterprise agreement signed by TAS Group LLC, are the entire agreement between us about the Service and supersede earlier understandings. In the event of conflict, these Terms control unless a signed enterprise agreement expressly overrides them.