Effective date: 14 October 2026 · Version: 1.0
This policy is part of the Terms of Service. It applies to everyone who uses ScanDefend, with or without an account. ScanDefend is a trading name of IronSky Limited.
ScanDefend exists to help people find and fix weaknesses in websites they are responsible for. You may use it only for that purpose and only lawfully.
1. You may
- Scan your own websites, and websites you manage or are responsible for.
- Scan a client's website when you have their agreement.
- Run a Quick Scan of a public website you have a legitimate reason to check (for example, a supplier you are about to trust), within the limits in the Scan Authorization Terms.
- Share your own reports with people who need them to fix the issues.
2. You must not
Scanning without authority
- Order a scan of a website you have no legitimate reason to check, or where the law, a contract or the site owner forbids it.
- Scan a website whose owner has told you not to, or that has opted out of ScanDefend.
- Give false information about who you are, who you act for, or your authority over a website.
Getting around our limits
- Try to bypass per-site, per-customer or rate limits, for example by using several wallets, accounts, payment cards or email addresses to scan the same site more often.
- Try to make ScanDefend reach private networks, internal addresses or anything other than a public website.
- Try to defeat Turnstile, our bot checks, or our checkout and fraud controls.
- Order scans with automated tools, scripts or bots, except through an interface we provide for that purpose.
Misusing results
- Use results to attack, break into, disrupt, threaten, extort, shame or harass anyone.
- Publish, sell or share results about websites you don't own or manage in a way that helps others attack them.
- Present a ScanDefend report as a penetration test, an audit, a certification or proof that a site is secure.
- Use ScanDefend or its results to build or train a competing product or dataset.
Misusing ScanDefend itself
- Attack, probe, overload, scrape or reverse engineer ScanDefend, except with our prior written permission.
- Access another customer's reports, wallet or account.
- Share, sell or misuse resume links, claim sessions, report links or sign-in links.
- Use stolen or unauthorised payment details, or make a false or fraudulent payment dispute.
- Resell or sublicense access to ScanDefend without our written permission.
- Break any law, infringe anyone's rights, or help or encourage anyone else to break this policy.
3. What we do if this policy is broken
We decide whether this policy has been broken. Depending on what happened, we may, without notice:
- refuse or stop scans, and block a website from being scanned;
- freeze or cancel credits, and suspend or close a wallet or account;
- keep the records we need to deal with the matter;
- give the affected site owner, our payment and infrastructure providers, or the authorities relevant information, where the law allows or requires it;
- report suspected illegal activity to law enforcement and co-operate with any investigation; and
- take legal action and recover our costs.
If we suspend or close a wallet or account because you broke this policy, unused credits are cancelled without refund, except where the law requires a refund. Where we can, and unless the law, an investigation or safety reasons prevent it, we will tell you what we did.
4. Reporting misuse
If you think someone has used ScanDefend against your website, email abuse@scandefend.com or use the form on our bot page. We aim to acknowledge reports within 24 hours, and we block the site from new scans while we look into it.