Authorized Scan Agreement

Section 1 Authorization Granted#

Customer authorizes LeakTrace Inc. ("LeakTrace") to perform the External Cybersecurity Assessment (the "assessment") against the domain and associated public-facing services submitted at checkout (the "Target"). This authorization extends to LeakTrace personnel, approved contractors, and the automated scanning systems LeakTrace operates.

This authorization is valid from the time of payment until the assessment report is delivered, or thirty (30) calendar days from purchase, whichever is earlier. Re-scans within the same engagement are covered by the same authorization.

Where Customer buys business monitoring and accepts this agreement for it, the authorization also covers the re-checks monitoring runs, for as long as the subscription is active, and ends when the subscription ends or Customer revokes it under Section 9.

Section 2 Customer Representation of Authority#

Customer represents and warrants that:

• Customer owns the Target, or is a duly authorized representative of the entity that owns the Target;
• Customer has the legal authority to authorize a third party to perform reconnaissance and security inspection of the Target;
• If the Target is hosted by a third-party provider (e.g., Shopify, Squarespace, GoDaddy, Microsoft 365, Google Workspace), Customer has reviewed the provider's terms of service and confirms that authorized security review of Customer's own account or domain is permitted;
• No third-party consent is required that has not already been obtained.

If Customer's representation under this section is inaccurate, Customer assumes full responsibility for any consequences and indemnifies LeakTrace per Section 7.

Section 3 Scope of Scanning Activities#

The assessment is a reconnaissance-tier inspection of the Target's public-facing surface, the same surface visible to any internet user. Specifically, LeakTrace will perform:

• DNS record retrieval (A, AAAA, MX, NS, TXT, SOA);
• Email authentication record inspection (SPF, DKIM, DMARC, BIMI);
• TLS / SSL certificate inspection (chain, expiry, configuration);
• HTTP/HTTPS response header analysis;
• Retrieval of the public homepage, a few pages it links to, the JavaScript files it loads and their source maps, the standard machine-readable files (robots.txt, the sitemap and the mail-security policy file) and the front page of public subdomains (the same content a browser would receive);
• Pattern-matching of public JavaScript and HTML for hardcoded API key formats, credential patterns, and configuration leaks;
• Connection checks (run only under this agreement): whether 15 commonly exposed service ports, such as remote desktop, database and file-transfer ports, accept a connection on every IPv4 address of the Target and of its www host, plus two control ports that show whether a server answers on every port. LeakTrace opens the connection, reads any greeting the service sends on its own, and closes it, without sending credentials;
• Hidden-path requests (run only under this agreement): one request to each of a short list of well-known paths, such as /.env, /.git/config, credential and key files, server-status pages and debug or API-description endpoints, to determine whether they are publicly served, without attempting to authenticate or bypass any access control. Where a file is served, Customer’s evidence includes a short extract with any passwords, keys or tokens removed;
• Name checks (run only under this agreement): whether a public storage bucket exists under names that match Customer, whether a WordPress site lists its authors publicly (LeakTrace stops at three names), and whether common client-portal addresses answer;
• Reading public internet indexes that already list the services a server answers on, and public reputation and registration records for the Target;
• Cross-referencing the domain's known email accounts against publicly-disclosed breach databases;
• Public-source intelligence gathering (search-engine indexed pages, and keys left in the Target's own website code) relating to the Target.

For full technical detail of scanning behaviour, including request volume and identification headers, see the LeakTrace Scanning Policy.

Section 4 Activities LeakTrace Will Not Perform#

LeakTrace will not, under this authorization:

• Attempt to authenticate to any Customer account, system, or service;
• Attempt to exploit, manipulate, or "break" any vulnerability or misconfiguration discovered (LeakTrace will detect and report, not exploit);
• Perform denial-of-service, traffic flooding, or load testing;
• Decrypt or attempt to decrypt any encrypted traffic;
• Access, read, modify, or exfiltrate any private user data, customer records, or content behind authentication;
• Install software, persistent agents, or any other artifact on Customer systems;
• Scan any domain or asset not expressly submitted at checkout, even if discovered through DNS records or links.

Section 5 Confidentiality of Findings#

All findings produced by the assessment are confidential to Customer. LeakTrace will not disclose findings to any third party except: (a) at Customer's written direction; (b) where required by law or court order; (c) in aggregated, de-identified form for internal research and product improvement that does not identify Customer or the Target; (d) to the service providers that process information for LeakTrace, such as hosting, encrypted backups, email delivery and the AI model that reviews findings before a person approves the release, each only to provide its service to LeakTrace and as listed on the subprocessor list; or (e) where Customer came to LeakTrace through a referral partner and agreed on its consent page to share results with that partner, to that partner as agreed.

LeakTrace keeps assessment findings until Customer asks us to delete them, as the Privacy Policy states. A deletion request is made to [email protected] from the purchasing email address.

Section 6 Operational Safeguards#

LeakTrace operates scanning infrastructure with the following safeguards:

• Identifiable User-Agent header on all requests, enabling Customer or third-party hosts to identify LeakTrace traffic;
• Rate-limiting designed to stay below the threshold of normal browser traffic;
• No persistent connections or long-running sessions;
• Source IP addresses available on request for allowlist or audit purposes (email [email protected]).

Section 7 Indemnification by Customer#

If Customer's representation of authority under Section 2 is inaccurate (including but not limited to scanning a domain Customer does not own or have authority over) Customer agrees to indemnify, defend, and hold harmless LeakTrace, its officers, directors, employees, and contractors from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising therefrom.

Section 8 Limitation of Liability#

LeakTrace's total aggregate liability under or in connection with this authorization is limited to the fees paid by Customer for the assessment. The limitations and disclaimers set out in the general LeakTrace Terms of Service apply.

Section 9 Revocation of Authorization#

Customer may revoke this authorization at any time by emailing [email protected] with the subject line "Revoke scan authorization" and the Target domain. LeakTrace will halt scanning within one (1) business day of receipt.

If Customer revokes before the assessment is released, the order is cancelled and LeakTrace refunds it in full. If Customer revokes after the assessment has been released, further checks stop and the revocation does not create a refund; the LeakTrace Refund Policy in effect at the time of purchase then governs any refund.

Section 10 Acceptance & Record#

Acceptance is recorded when Customer completes checkout for the assessment and confirms the agreement checkbox displayed at the checkout step. LeakTrace retains a timestamped record of acceptance, including the IP address used at checkout, the purchasing email address, and the Target domain submitted, as proof of agreement.

Customer may request a copy of the acceptance record at any time by emailing [email protected].