Terms of Service

Version 2026-10-17 · last updated 17 October 2026

Not yet reviewed by a lawyer. These terms describe accurately what the service does and does not do, and they are written to be read rather than skimmed. They are not legal advice and should be reviewed before the service takes money from strangers.

1. Who you are contracting with

Hefes Scan is operated by Hefes LLC, a Wyoming limited liability company ("we", "us"). These terms govern your use of the service at scan.hefes.net.

2. What the scan is

We run automated, external, read-only security checks against a domain you have proven you control. Specifically, we:

• look at what your systems publish to anyone on the internet;
• identify software and versions from what they announce;
• compare those versions against public vulnerability advisories;
• report what we find, in plain language, with suggested fixes.

3. What the scan is not

These are limits on us, not disclaimers. We do not:

• attempt to exploit any weakness we find;
• guess, test or use passwords or other credentials;
• perform denial-of-service or load testing;
• log in to anything, or test anything that requires authentication;
• scan any host outside the domain you verified, the names beneath it and the addresses those resolve to.

Where a finding could only be confirmed by doing one of these things, we say so and recommend a manual review instead of guessing.

4. Your authorisation, and your warranty

You may only have us scan a domain that you own or are authorised to have tested. When you add a domain you prove control of it (by DNS record, a meta tag, or a file on the site) and you accept an authorisation statement. We record the wording you accepted, the time, and the network address it came from, and we check your proof of control again immediately before each scan.

You warrant that you are entitled to authorise scanning of each domain you add, and you agree to indemnify us against any claim arising from a domain you were not entitled to authorise.

5. We may refuse or stop

We may decline a domain, stop a scan in progress, or close an account — including while we investigate a report that scanning was not authorised. Where we stop a paid scan for reasons that are not your fault, we refund it.

6. What a result means, and what it does not

A scan reports what these particular checks found, on that date, from outside. It is not a statement that your systems are secure. It cannot see problems that are only visible from inside, problems in code we are not shown, or problems introduced after the scan ran.

The verification seal says a scan was run on a date and what its outcome was. It does not certify security, and we may withdraw it.

7. Side effects

Our checks are designed to be safe to run against a live system, and we use bounded request rates. Even so, some systems respond badly to ordinary traffic. If you have a service you cannot afford to have behave unexpectedly, scan a staging copy first.

8. Payment

Prices are shown before you buy and charged in US dollars. Card details are handled by Stripe and never reach our servers. A scan is charged when you start it. If a scan fails for reasons on our side, we refund it.

9. Your reports, our seal

Scan results and reports about your domains are yours, and you may share them. The seal, the service and everything we build remain ours.

10. Liability

To the extent the law allows, our total liability for any claim relating to this service is limited to what you paid us for the scan the claim concerns. We are not liable for indirect or consequential loss, including loss of business or data, or for a security incident we did not cause and did not detect.

11. Changes

We may change these terms. Material changes will be notified by email before they take effect, and the version is recorded above.

12. Contact

General: [email protected]. Abuse reports or requests to be excluded from scanning: [email protected] — see also scanner.hefes.net.