Terms of Service

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User", "you", or "your") and Orbitwise Ltd ("Company", "we", "us", or "our"), governing your access to and use of the BoringSecwebsite, platform, and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. If you do not agree, you must not access or use the Service.

We reserve the right to modify these Terms at any time. We will notify you of any material changes by posting the updated Terms on this page with a new "Last updated" date. Your continued use of the Service after any such changes constitutes your acceptance of the modified Terms.

BoringSec is a web-based security analysis platform that provides:

• Automated security scanning of websites and web applications
• Analysis of HTTP security headers, SSL/TLS certificates, and DNS configurations
• Vulnerability detection and security recommendations
• User-authorized repository and source-archive security analysis
• Optional authenticated scanning for verified-owner domains
• API access for programmatic scanning
• Reporting and compliance documentation

The Service is provided on an "as is" and "as available" basis. We reserve the right to modify, suspend, or discontinue any aspect of the Service at any time without prior notice.

To access certain features of the Service, you must create an account. When registering, you agree to:

• Provide accurate, current, and complete information
• Maintain and promptly update your account information
• Maintain the security and confidentiality of your login credentials
• Accept responsibility for all activities that occur under your account
• Notify us immediately of any unauthorized use of your account

You must be at least 18 years old or the legal age of majority in your jurisdiction to create an account. We reserve the right to refuse service, terminate accounts, or remove content at our sole discretion.

You agree to use the Service only for lawful purposes and in accordance with these Terms. You shall not:

• Scan websites, systems, or networks without proper authorization from the owner
• Use the Service to conduct attacks, exploit vulnerabilities, or cause harm to any system
• Attempt to gain unauthorized access to any part of the Service or its infrastructure
• Use the Service to transmit malware, viruses, or other harmful code
• Engage in any activity that interferes with or disrupts the Service
• Reverse engineer, decompile, or disassemble any part of the Service
• Use automated systems or scripts to access the Service beyond API limits
• Resell, sublicense, or redistribute the Service without our written consent
• Use the Service for any illegal, fraudulent, or unauthorized purpose
• Violate any applicable laws, regulations, or third-party rights

You represent and warrant that you have proper authorization to scan any domains or systems you submit to the Service. Scanning websites without authorization may violate applicable laws and these Terms.

Authenticated scanning and active background engines require a signed-in user, an owned domain marked verified, explicit authorization, and an eligible scan. Public or anonymous scans do not gain those privileges. A configured credential is scoped to the verified hostname/origin inside the isolated ZAP boundary; the test path validates access and a form-login path establishes the bounded session, but ZAP may traverse other paths on that same host. Credentials expire automatically and may be revoked earlier. The current single-credential flow does not implement MFA, account-enumeration, two-identity IDOR or tenant-isolation, or transaction-authorization scenarios; those controls require dedicated authorized testing or manual review and remain not assessed by this flow.

When you connect a repository or submit a source archive, you represent that you have authority to provide and analyze that code. You must not submit third-party source, personal data, or credentials that you are not authorized to process.

The Service offers various plans, including free and paid tiers. By selecting a paid plan, you agree to:

• Pay all applicable fees as described on our pricing page
• Provide accurate and complete billing information
• Authorize us to charge your selected payment method

Billing. Subscriptions are billed in advance on a monthly or annual basis. All fees are non-refundable except as required by law or as otherwise stated in these Terms.

Automatic Renewal. Unless you cancel before the end of the current billing period, your subscription will automatically renew at the then-current rate.

Price Changes. We reserve the right to modify our pricing at any time. Price changes will take effect at the start of your next billing cycle, and we will provide reasonable notice of any increases.

Cancellation. You may cancel your subscription at any time through your account settings. Upon cancellation, you will retain access to paid features until the end of your current billing period.

5.1 Per-Report Purchases and Credits

One-time payments grant scan credits valid 365 days from purchase. Each scan unlock consumes one credit; refunds re-lock the associated scan.

Delivery failures and our voluntary refund policy. If we fail to deliver the purchased report because of a scan error, produce no report, or charge you twice, we will refund the affected charge in full. In addition, you may request a voluntary refund within 7 days of purchase by emailing support@boringsec.com, provided that you have not accessed the full report or consumed the relevant scan credits. Refunded scans are immediately re-locked. This voluntary policy supplements, and does not replace or restrict, any non-waivable rights or remedies that apply under consumer law, including rights relating to digital content or services that are not supplied as agreed.

Consumer withdrawal rights and immediate performance. Consumers may have a statutory withdrawal period, including the 14-day period that generally applies to qualifying EU distance contracts. Before we create a one-time report checkout, we present a separate, unticked confirmation that is not combined with optional marketing consent. To receive immediate access, you must expressly request that performance begin before any applicable withdrawal period expires and acknowledge that, where the law provides, the right of withdrawal is lost for digital content when access begins, or for a service once it has been fully performed. We record that request and acknowledgement with the purchase and include confirmation in the purchase receipt. These rules are applied only to the extent permitted by mandatory law (including, for qualifying EU digital-content contracts, Article 16(m) of Directive 2011/83/EU).

If a mandatory right of withdrawal still applies, you may exercise it by sending an unequivocal statement to support@boringsec.combefore the applicable deadline. You may use the following wording, although it is not required: "I hereby give notice that I withdraw from my contract for [package], ordered on [date], under purchase ID [ID]. My name and account email are [details]." We will assess the request under the law that applies to you; nothing in these Terms excludes rights that cannot lawfully be excluded.

Subscription cancellations. Cancelling stops automatic renewal and does not immediately remove paid access. Subscription features and subscription-funded report access remain available through the end of the current paid billing period. After that period, access changes to the entitlements of your then-current plan. Per-report purchases paid for separately remain accessible regardless of subscription status, except that a report or credit specifically refunded under the policy above may be re-locked.

The Service, including its original content, features, functionality, and underlying technology, is and will remain the exclusive property of Orbitwise Ltd and its licensors. The Service is protected by copyright, trademark, and other intellectual property laws.

Our trademarks, service marks, and logos may not be used in connection with any product or service without our prior written consent.

You retain ownership of any data you submit to the Service. By using the Service, you grant us a limited, non-exclusive license to process your data solely for the purpose of providing the Service to you.

Your use of the Service is also governed by our Privacy Policy, which is incorporated into these Terms by reference. Please review it to understand our data collection and processing practices.

You acknowledge that scan results and security reports may contain sensitive information about your systems. We implement appropriate security measures to protect this data, but you are responsible for determining the appropriate level of confidentiality for your scan results.

The Privacy Policy includes a data-class retention matrix for anonymous reports, owned scan history, authenticated-scan credentials, connected source, analytics, audit logs, support, and billing records. Feature labels such as "not observed", "inconclusive", or "not assessed" are scope statements and must not be interpreted as a passing result.

AI-assisted analysis is optional and deployment-dependent. It does not calculate the Security Score. If an external AI provider is enabled, the minimized processing boundary and provider safeguards described in the Privacy Policy apply.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

We do not warrant that:

• The Service will be uninterrupted, secure, or error-free
• Scan results will be complete, accurate, or detect all vulnerabilities
• The Service will meet your specific requirements or expectations
• Any defects or errors will be corrected

BoringSec is a security analysis tool that provides automated scanning and recommendations. It is not a substitute for professional security audits, penetration testing, or compliance assessments. You should not rely solely on the Service for your security decisions.

Privacy, Terms, cookie-consent, accessibility, copyright, licensing, and authentication observations are bounded technical signals. They are not legal advice, a complete WCAG conformance audit, an intellectual-property clearance, or proof that a control is effective in every user journey or jurisdiction.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, ORBITWISE LTD AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND LICENSORS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO:

• Loss of profits, revenue, data, or business opportunities
• Security breaches or vulnerabilities not detected by the Service
• Damages resulting from unauthorized access to your systems
• Service interruptions or data loss
• Any other damages arising from your use of the Service

OUR TOTAL LIABILITY FOR ANY CLAIMS ARISING FROM OR RELATED TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR ONE HUNDRED US DOLLARS ($100), WHICHEVER IS GREATER.

You agree to indemnify, defend, and hold harmless Orbitwise Ltd, its affiliates, officers, directors, employees, agents, and licensors from and against any claims, liabilities, damages, losses, costs, or expenses (including reasonable attorneys' fees) arising out of or related to: (a) your use of the Service; (b) your violation of these Terms; (c) your violation of any rights of another party; (d) your scanning of systems without proper authorization; or (e) any content you submit to the Service.

We may terminate or suspend your account and access to the Service immediately, without prior notice or liability, for any reason, including but not limited to:

• Breach of these Terms
• Fraudulent, abusive, or illegal activity
• Non-payment of applicable fees
• At our sole discretion for any or no reason

Upon termination, your right to use the Service will immediately cease. All provisions of these Terms that by their nature should survive termination shall survive, including but not limited to ownership provisions, warranty disclaimers, indemnification, and limitations of liability.

These Terms shall be governed by and construed in accordance with the laws of the jurisdiction where Orbitwise Ltd is incorporated, without regard to its conflict of law provisions.

Any dispute arising from or relating to these Terms or the Service shall first be attempted to be resolved through good-faith negotiation. If the dispute cannot be resolved through negotiation within thirty (30) days, either party may pursue resolution through binding arbitration or in the courts of competent jurisdiction.

Entire Agreement. These Terms, together with our Privacy Policy, constitute the entire agreement between you and Orbitwise Ltd regarding the Service and supersede all prior agreements.

Severability. If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full force and effect.

Waiver. Our failure to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision.

Assignment. You may not assign or transfer these Terms or your rights hereunder without our prior written consent. We may assign our rights and obligations under these Terms without restriction.

Force Majeure. We shall not be liable for any delay or failure in performance resulting from causes beyond our reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, or government action.