Terms of service and licence

Effective

These terms are an agreement between you and ("we", "us"), company number , registered at , for the use of (the "Service") at . By creating an account or using the Service you agree to them. If you use the Service for a company, you confirm you're allowed to accept these terms for it, and "you" includes that company.

1. Who sells the Service

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries about payments and handles returns. Paddle's own buyer terms apply to your purchase in addition to these terms.

2. The Service

The Service reviews firewall configurations against built-in checks, maps findings to published security standards, produces reports, and converts configurations into FortiGate CLI scripts. Analysis runs in your web browser. Configurations you analyse are not uploaded to or stored by us.

On paid plans, the Service can also monitor assets you list (a device's platform, model and software version, and optionally a name and IP addresses) for publicly reported vulnerabilities. Matching uses public data from the US National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities catalog. It depends on the accuracy and timeliness of that data and of what you enter, and is not a vulnerability scan of your devices.

On paid plans, the Service offers an optional vulnerability scanner add-on. You may use it only against an IP address or asset you have verified you control through the Service, or that you are otherwise lawfully authorised to test. You must not scan any system you do not own or have permission to test. Scanning finds live hosts, open ports and software versions and matches them against public vulnerability data; it does not attempt to exploit anything. An internal scanner agent is licensed to you for use only with your own account and verified targets, and must not be shared, altered to bypass its licence or verification checks, or used after your add-on ends. The MITRE ATT&CK mapping add-on is provided for information; ATT&CK is a trademark of The MITRE Corporation and the Service is not endorsed by MITRE.

The Service is intended for business and professional use. If you use it as a consumer, nothing in these terms affects your statutory rights.

3. Accounts

• Give accurate details and keep them up to date.
• Keep your password and two-factor device secure. Each login is for one named person and must not be shared.
• Company owners and admins are responsible for the people they invite and the roles they give them.
• Tell us straight away at if you think your account has been misused.

4. Licence

While your account is active and you've paid any fees due, we grant you a non-exclusive, non-transferable, revocable licence to use the Service for your internal business purposes, for the number of users your plan allows.

You may use the reports, findings and scripts the Service produces ("Output") for your own organisation and, on any plan, for clients you provide services to. You're responsible for how Output is used.

You must not:

• analyse a configuration, or scan a system, you aren't authorised to handle or test;
• copy, resell, sublicense or provide the Service to others as a service of your own, except by sharing Output as allowed above;
• reverse engineer, decompile or extract the Service's checks, mappings or code, except where the law allows this despite this restriction;
• get around plan limits, seat limits or security controls, or use automated means to access the Service;
• use the Service in breach of the acceptable use policy or any law.

5. Plans, seats and fees

• Paid plans are subscriptions billed monthly or annually in advance and renew automatically until cancelled.
• Prices are shown before tax. Paddle adds VAT or sales tax where it applies.
• A seat is one named user in a company. Pending invitations reserve a seat until they expire. You can add seats or change plan at any time; changes are prorated.
• Payment is by credit or debit card, taken in advance. We don't accept purchase orders, payment on invoice or bank transfer. If a payment fails, Paddle retries it; access may be suspended if it still can't be collected.
• We may change prices for future billing periods with at least 30 days' notice by email. You can cancel before the change takes effect.
• The free plan's limits may change at any time.
• Asset monitoring is charged per asset per day at the price shown on the site (currently £1 plus VAT). Each asset in your list is counted once a day. The total for each calendar month is charged to the card on your subscription early in the following month. Removing an asset stops the charge from the next daily count.
• Referrals. A company that signs up through another customer's referral link within its first 30 days, and hasn't paid before, gets the advertised discount on its first payment. The referring company gets the advertised reward once that first payment succeeds, applied to its next renewal while it has a paid plan. Rewards have no cash value. We may withhold rewards for self-referrals, duplicate accounts or misuse, and may change or end the scheme for future referrals at any time.

6. Cancellation and refunds

You can cancel at any time from your billing page. Your plan continues until the end of the period you've paid for. Refunds are covered by our refund policy.

7. Your data

We handle personal data as described in our privacy notice. Firewall configurations, findings, hostnames, IP addresses and rule names are processed only in your browser. We record usage metadata (when a review, report or conversion ran, the platform, the number of rules, the score, grade, finding counts and chosen standard) to apply plan limits and show your company's usage history. Device records, accepted risks, review sign-offs and the assets you list for monitoring are stored as described in the privacy notice. You are responsible for what you type into labels, notes, reasons and client names, and must not enter configuration details, credentials or other people's personal data there unless you're entitled to.

8. Automated tooling: no professional advice; Output must be reviewed

The Service and Output are guidance to help you improve security and prepare for assessments. They are not an audit, penetration test, certification, legal advice or a guarantee of security or compliance. Findings are based only on the configuration supplied and can't take account of compensating controls, network context or later changes. Mappings to standards are for orientation and may not reflect the latest edition of a standard.

Converted configurations and scripts. The converter translates one vendor's configuration into another's using automated parsing and mapping. Firewall platforms differ in how they handle rule order, implied rules, NAT, objects, zones, VPNs, routing, user and application rules and defaults, so a converted script can be incomplete, translate something differently from how the source device behaved, or contain errors, including errors that open access you did not intend or block traffic you need. The conversion notes highlight some of these issues but will not catch them all. Before you load any converted script or fix command onto a device you must:

• have it reviewed line by line by someone competent on the target platform;
• back up the target device and have a tested way to roll back;
• test it on non-production or lab equipment first; and
• apply it only through your own change-control and approval process.

You decide whether and how to use Output, and you are solely responsible for any change made to your systems and for its results. Copying or downloading a converted script confirms you have read and accept this section. See also the disclaimer.

9. Availability and changes

We aim to keep the Service available but don't promise it will be uninterrupted or error-free. We may improve, change or withdraw features. If we withdraw the Service entirely, we'll give at least 30 days' notice and refund any prepaid fees for the unused period.

9A. Data sources, versions and updates

The Service relies on third-party data and published standards, including vulnerability catalogues, vendor advisories, standards and frameworks, and (if you configure them) threat-intelligence services. Our Data sources and versions page lists each one, the edition or version the Service uses, how often we check it, and the terms we use it under. That page forms part of these terms and we keep it up to date.

• Third-party content. We don't control these sources and don't guarantee they are accurate, complete or current. There will always be some delay between a source changing and the Service reflecting it. Mappings to standards follow the edition shown on that page, which may not be the latest one published.
• How updates are delivered. On the hosted Service we apply updates ourselves. On the self-hosted edition, updates come in three forms: data packs (vulnerability and firmware data), rules packs (checks, mappings and converters) and platform releases (the software itself). All are signed by us. Data packs install automatically unless you change the setting; rules packs need an administrator's approval unless you change the setting; platform releases are only ever applied by you.
• Your responsibility on the self-hosted edition. You decide your update settings and are responsible for applying updates promptly, for allowing the appliance to reach our update server (or for loading packs by hand on an isolated network), and for testing updates under your own change control. Results produced with out-of-date content may miss issues that newer content would find, and we aren't responsible for that.
• Supported versions. We provide content packs for the current platform release and the one before it. Older releases may stop receiving packs, and we may require you to apply a platform release before a pack will install.
• Your own API keys. If you connect a service with your own key (for example Shodan or Have I Been Pwned), your use of it is under your agreement with that provider, and you are responsible for having the right plan and licence for your use.
• Changes to sources. We may add, replace or remove a source, or move to a new edition of a standard. If a source changes its terms so that we can no longer use it, we may remove the related checks or mappings. Where a change materially reduces what the Service does, we'll tell you in the release or pack notes.

10. Warranties

We will use reasonable care and skill in providing the Service. Apart from that and what these terms expressly say, the Service and Output are provided "as is" and "as available". To the extent the law allows, we exclude all implied terms, warranties and conditions, including about fitness for a particular purpose, accuracy and completeness. We do not warrant that Output will be error-free, that a converted configuration will behave the same as the original, or that the Service will find every issue.

11. Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that can't be limited by law.

Subject to that, we are not liable for: loss of profits, revenue, business, goodwill or anticipated savings; loss or corruption of data; business interruption; any security incident, outage or misconfiguration on your systems; or any indirect or consequential loss.

In particular, and subject to the first paragraph of this section, we are not liable for any loss or damage arising from applying, or relying on, Output (including converted configurations, scripts and fix commands) without the review, testing and change control described in section 8, or from a finding the Service did not report. Because the Service is automated tooling that you are required to check, you agree this allocation of risk is reasonable and is reflected in our fees.

Our total liability arising out of or in connection with these terms in any 12-month period is limited to the fees you paid for the Service in that period, or £100 if you only used the free plan.

12. Intellectual property

We (and our licensors) own the Service, including its checks, mappings, software and content. You own your configurations and your Output. If you send us feedback, we may use it without obligation to you.

Product names, vendor names and the names of standards are trademarks of their owners and are used only to describe compatibility. We are not affiliated with or endorsed by any firewall vendor or standards body.

13. Suspension and termination

We may suspend or end your access if you materially break these terms, don't pay fees when due, or if we need to for legal or security reasons. Where reasonable we'll warn you first. You can stop using the Service and delete your account at any time. After an account or company is deleted, we delete its data as described in the privacy notice.

14. Export and sanctions

You must not use the Service in, or for the benefit of, any country, person or organisation subject to UK, EU or US sanctions where that would be unlawful.

15. Changes to these terms

We may update these terms. If a change is material, we'll email account owners at least 30 days before it applies. Continuing to use the Service after that date means you accept the new terms.

16. General

These terms, the privacy notice, the acceptable use policy, the refund policy and (for business customers who request it) the data processing agreement are the whole agreement between us about the Service. Neither of us is responsible for delays caused by events outside our reasonable control. If any part of these terms is found unenforceable, the rest stays in force. You may not transfer these terms without our consent; we may transfer them to a successor business. No one else has rights under these terms. These terms are governed by the law of , and its courts have exclusive jurisdiction, except that consumers may also bring claims in their home courts.

17. Contact

Questions about these terms: or the contact page. To complain, see our complaints procedure.