Terms of service

AppScan.sh is operated by NCode. "We" and "us" mean that company. "You" means the person or organisation using the service.

Using the service means you accept these terms. If you are accepting them for an organisation, you confirm you may bind it.

AppScan.sh is a business-to-business application security testing service. It examines web applications and source repositories that you control, and reports weaknesses it finds: exposed secrets, vulnerable dependencies, insecure configuration, missing authorisation checks and similar defects.

It is diagnostic. It reads and reports; it does not modify your application, your servers or your data, and it is not antivirus, device repair, or performance optimisation software.

This is the central obligation of these terms, and the one we enforce technically as well as contractually. Before a site can be monitored you must prove control of the domain through the verification step in the product, and a repository can only be connected through a GitHub App installation that you authorise.

You must not use the service against any system you do not own or have documented, current permission to test. Scanning a third party’s property without authorisation is unlawful in most jurisdictions. If we believe an account is doing it, we will suspend it without notice.

You also agree not to resell scanning of third-party targets, and not to use findings from the service to attack, extort or publicly disclose a vulnerability in a system that is not yours.

You are responsible for your credentials and for what is done with your account. Tell us promptly at support@appscan.sh if you believe it has been compromised. You must be at least 18 and able to enter a contract.

Paid plans are subscriptions, billed monthly or yearly in advance at the price shown when you subscribe. They renew automatically for the same period until cancelled.

Some analysis is metered in credits. Your plan includes an allowance each usage window, and you may buy additional credits as a one-off purchase. Included allowance is consumed before purchased credits. Purchased credits do not expire with the usage window; included allowance does.

Prices are set by us and shown before you commit. Where a payment method adds a processing fee, that fee is shown to you before you pay, not added afterwards.

Our order process for paid subscriptions is conducted by our online reseller Paddle.com Market Ltd. Paddle.com Market Ltd is the Merchant of Record for those orders: it handles the transaction, customer service enquiries about the payment, and any sales tax or VAT due.

Your bank statement will show PADDLE.NET* APPSCAN rather than our company name. Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom.

Where a payment is taken by another provider instead, the invoice and the statement descriptor will reflect that provider. The service you receive from us is the same either way.

You can cancel at any time from the billing screen in your account. Cancellation takes effect at the end of the period you have already paid for; you keep full access until then, and you are not charged again.

We do not require you to contact support, wait for business hours, or explain yourself in order to cancel.

When a paid plan ends, your account returns to the free plan. Your findings, reports and history are kept, not deleted.

Refunds are covered by our Refund Policy, which forms part of these terms.

You keep all rights in your applications, your source code and your data. You grant us only the permission needed to run the service: to fetch, analyse and report on the assets you connect.

Source code is analysed and discarded; we are not a mirror. Detected secrets are masked before they are stored. What we keep and what we do not is described in the Privacy Policy and on the Security page.

Security testing is not a guarantee. A scan that reports nothing does not mean an application has no vulnerabilities, and a clean report is not a certification, an audit, or a substitute for a penetration test or professional advice.

We aim to keep the service available and correct, but we provide it "as is" and do not warrant that it will be uninterrupted, error-free, or that it will detect every defect.

To the extent permitted by law, neither party is liable for indirect, incidental or consequential loss, or for lost profits or data. Our total liability arising out of or relating to the service is limited to the amount you paid us in the twelve months before the event giving rise to the claim. Nothing here limits liability that cannot be limited by law.

We may suspend or terminate an account that breaches these terms, particularly the obligation to scan only what you own, or that puts the service or other customers at risk. We will tell you why where we lawfully can. You may close your account at any time.

We may update these terms. Where a change materially reduces your rights we will give reasonable notice before it takes effect, and continuing to use the service after that is acceptance. The date at the top of this page is when it last changed.

These terms are governed by the laws of the country of registration, whose courts have exclusive jurisdiction. Questions about them go to legal@appscan.sh.