Terms of use

BadgerScan is operated by CyberBadger (“CyberBadger”, “we”, “us”), based in Ontario, Canada. By using badgerscan.cyberbadger.ca, the BadgerScan WordPress plugin, or any related service (together, the “service”), you agree to these terms. If you use the service on behalf of a business, you confirm you have authority to bind that business, and “you” includes it. If you don't agree with these terms, don't use the service.

The free scan reads publicly available data about a domain and produces an informational report and letter grade. It is a point-in-time signal, not a guarantee that a site is secure or free of vulnerabilities. A good grade does not mean a site cannot be compromised, and a poor grade does not mean it has been. The scan is not a substitute for a full security assessment, and no report constitutes professional, legal, or compliance advice, nor evidence of compliance with any standard (such as PCI DSS or PIPEDA). Our paid offerings (BadgerScan Pro, BadgerAudit, BadgerWatch, and analyst services) are governed by these terms plus any separate agreement for that offering; if the two conflict, the separate agreement wins for that offering.

You may only scan domains you own or are authorized to assess. The scan is passive and read-only: it reads public DNS records, fetches pages a browser could fetch, and never tests, exploits, or modifies a target. Even so, you are solely responsible for having the right to scan any target you enter, and for complying with the laws that apply to you. If you connect the WordPress plugin to a site, you confirm you are an administrator of that site or act with its administrator's permission.

You agree not to:

• use the service to plan, facilitate, or carry out any attack or unlawful activity;
• probe, disrupt, overload, or interfere with the service or its infrastructure, or circumvent rate limits, access controls, or scan caps;
• scrape, harvest, or bulk-collect reports, scan results, or site content by automated means, or resell or white-label the service without a written agreement with us;
• misrepresent a report, alter a grade, or present BadgerScan output as a certification or endorsement;
• share account credentials or connect keys, or use another person's account without permission.

We may suspend or block use that we reasonably believe violates this section.

You must provide accurate information when creating an account, keep your credentials (including two-factor recovery codes and plugin connect keys) confidential, and tell us promptly about any unauthorized use. You are responsible for activity under your account. We may suspend or close accounts that violate these terms, present a security risk, or have been inactive for an extended period; you can close your account at any time from the dashboard.

The BadgerScan plugin's code is licensed separately under the GNU General Public License (v2 or later), as required for distribution through WordPress.org; nothing in these terms limits your GPL rights in that code. These terms govern the service the plugin connects to: scan processing, accounts, reports, and any Pro features unlocked server-side. The plugin is read-only on your site and makes no changes to your content or configuration.

Features labelled preview or free are provided for evaluation, may change or be withdrawn, and come with no availability commitment. Any promotional benefit or grandfathered pricing applies as described when it was offered, and we honour a lifetime license for as long as the account remains active. We may set and change usage limits (such as scan frequency or the number of connected sites) to keep the service reliable for everyone.

Paid plans are billed as described at purchase. Prices are in Canadian dollars unless stated otherwise and exclude applicable taxes, which you are responsible for. We may change pricing with at least 30 days' notice; changes take effect at your next renewal. Except where required by law, fees are non-refundable.

You retain all rights in your sites and data. You grant us the limited licence needed to operate the service: to scan targets you submit, process the results, and show them back to you. The service itself, including our software, brand, report formats, grading methodology, and site content, belongs to CyberBadger or its licensors, and no rights in it are granted beyond what these terms say. If you send us feedback or suggestions, we may use them without obligation to you.

We analyse scan data in aggregate and publish regional research findings under the CyberBadger Labs name. Published figures are aggregated and anonymized: no individual business is named or identifiable, and results are only published above a minimum sample size. Region scans read the same public data any visitor's browser could read. If you believe published data raises a concern about your business, contact us and we will review it.

Reports draw on third-party sources, including OpenStreetMap (© OpenStreetMap contributors), public vulnerability databases such as the NVD, certificate transparency logs, and public DNS. We don't control these sources and can't guarantee their accuracy or availability. Links to third-party sites are provided for convenience and are not endorsements.

Where you request emails from us (such as a report, monitoring alerts, or scheduled summaries), we send them in accordance with Canada's Anti-Spam Legislation, and every recurring email includes a working unsubscribe. Transactional messages (such as email verification and password resets) are part of operating the service.

The service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties and conditions, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service will be complete, accurate, uninterrupted, or error-free. Passive scanning has inherent limits: findings can be incomplete or wrong, and a scan cannot see everything an attacker or an authenticated assessment could.

To the maximum extent permitted by law: (a) CyberBadger is not liable for indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, data, or goodwill; (b) we are not liable for decisions you make, or actions you take or don't take, based on a scan, grade, or report; and (c) our total liability for all claims arising out of the service is capped at the greater of the amounts you paid us for the service in the 12 months before the claim and C$100. Some jurisdictions don't allow certain exclusions; where that's the case, these limits apply to the fullest extent permitted, and nothing in these terms overrides consumer rights that cannot be waived, including under Ontario's Consumer Protection Act.

If you are a business, you will defend and indemnify CyberBadger against third-party claims, damages, and reasonable legal costs arising from: scanning a target you were not authorized to scan, your violation of these terms or of applicable law, or your misuse of a report. This section doesn't apply to you as an individual consumer where such indemnities are unenforceable.

You may stop using the service at any time. We may suspend or terminate access (entirely or per feature) for violation of these terms, risk to the service or others, or legal requirement, and we'll use reasonable efforts to notify you unless doing so is prohibited or would create risk. Sections that by their nature survive (including 9, 10, and 13 through 19) survive termination.

We may update the service and these terms. For material changes, we'll give notice, by posting the updated terms with a new date, and, if you have an account, by email or a dashboard notice. Changes apply going forward from their effective date; continued use after that date means you accept them. If you don't agree, stop using the service.

These terms and the documents they reference (including the privacy notice) are the entire agreement between you and us for the service. If any provision is found unenforceable, the rest remain in effect. Our not enforcing a provision isn't a waiver of it. You may not assign these terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. Neither party is liable for delay or failure caused by events beyond its reasonable control.

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, and the courts of Ontario have exclusive jurisdiction, except where the law of your province of residence necessarily applies to you as a consumer. Questions and legal notices: cyberbadger.ca.