DRAFT. Not legal advice. Chris Kirby must review this, ideally with a solicitor check, before going live. Items in [brackets] need completing.
Free summary check (any domain). Anyone may request a free summary score for a domain. It only reads information the domain already publishes to the whole internet (public DNS records, one standard TLS connection, ordinary web page requests), exactly as a browser or mail server would. It shows a score and a short summary of the top issues, never a detailed technical breakdown. Free checks are limited and logged to prevent abuse. Current limits: up to 5 per hour and 10 per day per visitor, up to 3 per hour and 3 per day for any one domain, plus an overall daily cap. Limits may change. Verified owners of a domain aren't subject to the free-check limits for that domain.
Verified domains only for full reports and monitoring. The full report (External Vulnerability Assessment), monitoring and dashboard domains are only available for domains you own or are authorised in writing to manage, and each must pass our DNS TXT verification first.
Computer Misuse Act 1990. Unauthorised access to computer material, and making or supplying tools for that purpose, are criminal offences. Do not use the Service to try to gain information about systems you are not authorised to assess.
Passive only. The Service performs only non-intrusive lookups (public DNS queries, a standard TLS handshake, ordinary web page requests). It does not port-scan, exploit or brute-force anything. Do not try to make it do so, or abuse it to generate traffic against third parties.
No reselling of results about others. Monitor+ customers (e.g. IT providers) must have written authority from each client whose domain they add, and must produce that authority on request.
Fair use. Don't use free checks to bulk-survey domains you don't control, to harass or shame other organisations, or to get around our limits (e.g. by rotating IP addresses).
Enforcement. We may suspend access, refuse service, and report suspected unlawful activity to the relevant authorities.
