Terms of Service

1. The service and these terms

SelfSec provides security tooling — an agentic DAST scanner delivered as self-hosted software, and a managed web application firewall operated as a service — together with this website for accounts, subscriptions, entitlements and support. Core scanning runs on your own infrastructure; requests to sites you place behind the firewall are inspected on SelfSec infrastructure before being forwarded to your origin. Activation, optional diagnostics, out-of-band interaction reporting and firewall processing use the data flows described in the Privacy Policy.

These terms, the License Agreement, the Privacy Policy and the Refund Policy form the entire agreement between you and us. Where they conflict, the License Agreement governs your use of the software, the Refund Policy governs payment disputes, and these terms govern everything else.

2. Your account

You must provide a valid email address and keep your credentials confidential. You are responsible for all activity under your account, and you must be legally able to enter into this agreement. If you accept these terms on behalf of an organization, you warrant that you are authorized to bind it, and "you" means that organization. Notify us immediately through support if you suspect your account has been compromised — you can release any connected device and sign out other sessions yourself at any time.

3. Authorized testing only

SelfSec is built for security professionals testing systems they are allowed to test. You may only scan, attack or otherwise assess systems you own or for which you hold explicit, current authorization from the owner. Using SelfSec against systems without authorization is a material breach of these terms and may be a criminal offense in your jurisdiction. We may suspend or terminate accounts involved in unauthorized testing, and you are solely responsible for the consequences of how you aim the tools.

You warrant, each time you run a scan, that you hold that authorization for every system in scope and that you have not exceeded it. This warranty is a condition of the license granted to you, not merely a promise under it: use outside it is unlicensed use of the software as well as a breach of these terms.

You must be able to produce evidence of that authorization on request. If a third party credibly reports that SelfSec was used against systems they are responsible for, we may suspend your account while we look into it, and we will ask you for that evidence. Suspension on a credible report is not an accusation and is reversed if the report does not hold up. A suspension under this section gives rise to no refund, credit or liability on our part. Keep a written record of the authorization for each system you test — for as long as your subscription runs and for twelve months after it ends — because that record is what we will ask you for.

We publish an abuse contact on our security page and we act on what arrives there. Where a competent authority makes a lawful request, we will preserve and disclose the account records it covers — registration details, sign-in and activation records, and the addresses associated with them. You agree to this as a condition of using the service. We do not disclose your identity to a private complainant.

4. Export control and sanctions

Security testing software is subject to export control and sanctions rules. You may not use the service, and we may not supply it to you, if you are located in or ordinarily resident in an embargoed jurisdiction, or if you are — or act for — a party on an applicable sanctions or denied-party list. You may not re-export, transfer or otherwise make the software available to any such jurisdiction or party. You are responsible for complying with the export rules that apply where you are, and we may refuse or withdraw service where compliance requires it.

5. Subscriptions and billing

• SelfSec is pre-release: checkout runs against a simulated payment provider, so no plan is charged today. The rest of this section applies from the moment real payments are enabled.
• Paid plans bill monthly through our payment provider and renew automatically at the end of each billing period.
• You can cancel at any time from your account. Cancellation takes effect at the end of the current period: you keep full access until then and are not charged again.
• Plan upgrades take effect immediately and start a new billing period at the new plan's price.
• If a renewal payment fails, we may suspend the paid features of your subscription until payment succeeds.
• Prices may change; we will announce price changes in advance and they apply from your next renewal, never retroactively.
• Prices are exclusive of any tax, duty or levy that applies where you are, unless the checkout page states otherwise. Where we are required to collect such a tax, it is added to the amount you pay.

Subscription payments are not refundable; cancellation, billing errors and your statutory rights are described in the Refund Policy. Please raise a billing problem with us before asking your bank to reverse a charge — we can fix an error directly, and a reversal opened without contacting us gives us no way to explain what happened. While a payment is being disputed we may suspend the paid features of the subscription it relates to until the dispute is settled.

6. Entitlements and connected devices

Your subscription grants you a personal, non-transferable right to run the SelfSec software within the limits of your plan, on the terms of the License Agreement. Connected devices sign in with your own account credentials: keep them confidential and do not share your account. We may release devices or revoke entitlements that are abused, shared beyond plan limits or involved in a breach of these terms.

7. Acceptable use of this site

Do not probe, overload or attempt to bypass the security of this website, interfere with other users' accounts, or use the support and contact channels to send spam or malicious content. The authorized-testing rule applies here too: this site is not in scope for uninvited security testing.

8. Intellectual property and feedback

The SelfSec software, this website, and all associated branding, documentation and content remain the property of SelfSec. Except for the subscription right described above, no license — express or implied — is granted to copy, modify, redistribute, resell or create derivative works from them.

If you send us feedback, feature requests, bug reports or suggestions, you grant us a perpetual, worldwide, irrevocable, royalty-free right to use them in the service without restriction or obligation to you. You are not required to send us feedback, and nothing you send is treated as your confidential information unless we agree otherwise in writing.

9. Pre-release features

Features labelled pre-release, preview or beta are supplied for evaluation only. They are provided without warranty or support, may behave unpredictably, and may be changed or withdrawn at any time without notice and without liability. Do not rely on them for production security work.

10. No security guarantee

SelfSec is a tool that supports your security work. It is not a guarantee of security, an audit, a certification, or professional advice, and it does not make you compliant with any standard or regulation. False positives and false negatives are inherent to automated scanning and to automated traffic inspection: no scanner finds every vulnerability, and no firewall blocks every attack while never blocking legitimate traffic. Findings and enforcement decisions require your professional judgment before you act on them, and you remain solely responsible for your own security posture, your remediation decisions and your regulatory obligations.

The scanner works by attacking the systems you point it at, and it decides for itself how to do that. Testing is not a passive observation: it can submit forms, create, modify or delete data, trigger workflows and notifications that reach real people, exhaust rate limits and quotas, lock accounts, and slow or bring down the system under test. Findings are produced by acting, so these effects are inherent to the tool and not a defect in it. You choose the targets and you accept those consequences.

Where you point the software at a production system, you warrant that you have taken a backup or snapshot immediately beforehand, that you can roll back any change made during the run, and that you have weighed and accepted the risk of disruption to your business, your users and any third party whose systems carry that traffic. Do not run it against systems where you do not accept that risk, and do not run it against industrial control, safety, medical or vehicle systems, where the consequences of a failed test are not measured in downtime.

Unless we sign a separate written service level agreement with you, we make no commitment about uptime, latency, response time or the availability of the managed firewall. Traffic inspection sits in the path of requests to the sites you protect: you are responsible for monitoring those sites and for maintaining your own fallback so that an interruption, a misconfiguration or a blocking decision on our side does not become an outage you cannot recover from.

11. Disclaimers

To the maximum extent permitted by law, the service and software are provided "as is" and "as available", without warranty of any kind, whether express, implied or statutory — including any implied warranty of merchantability, fitness for a particular purpose, accuracy, quiet enjoyment or non-infringement. We do not warrant that the service will be uninterrupted, secure or error-free, that defects will be corrected, or that results obtained from it will be accurate or complete. No advice or information you obtain from us creates any warranty not expressly stated here.

12. Limitation of liability

To the maximum extent permitted by law, SelfSec is not liable for indirect, incidental, special, punitive or consequential damages, loss of profits, revenue, goodwill, business or data, cost of substitute services, or damage arising from how you use the tools against your targets — even if we were advised that such damage was possible.

Our total aggregate liability for all claims connected to the service, taken together and regardless of the legal theory relied on — contract, tort, negligence, strict liability, statute or otherwise — is limited to the amount you paid us in the twelve months before the event first giving rise to the claim. Where you paid us nothing in that period, our total aggregate liability is limited to one hundred euros.

You and we agree that these limits are a fundamental basis of the bargain between us: the price of the service reflects this allocation of risk, and without these limits the service would not be offered on these terms or at this price. Nothing in these terms limits liability that cannot be limited by law, including liability for death or personal injury caused by negligence, for fraud, for wilful misconduct, or for gross negligence.

13. Our indemnity to you

If a third party claims that the SelfSec software, used as we intended and within these terms, infringes a patent, copyright, trade secret or registered trademark of theirs in Türkiye, the European Economic Area, the United Kingdom or the United States, we will defend you against that claim at our expense and pay the damages or settlement finally awarded against you for it, provided you tell us promptly, let us control the defense, and do not settle without our agreement.

If such a claim is made or we think one is likely, we may at our own choice obtain the right for you to keep using the software, modify or replace it so that it no longer infringes, or — if neither is reasonably available to us — end your subscription and refund the unused part of the period you have paid for. This section does not apply where the claim arises from your modification of the software, from combining it with anything we did not supply, from your use of it in breach of these terms or the License Agreement, from a pre-release feature, or from use for which you paid us nothing. Our liability under this section is subject to the cap in section 12, and this section states your only remedy for a claim that the software infringes someone's rights.

14. Your indemnity to us

You will defend, indemnify and hold harmless SelfSec, its operators and its personnel against any third-party claim, demand, complaint, investigation, fine or proceeding — and the resulting damages, settlements, legal fees and costs — arising out of your breach of section 3, section 4 or section 7, or out of your use of the software against a system you did not own or were not authorized to test. This applies in particular where you exceeded the scope of an authorization you did hold, and where the claim is brought by the owner or operator of a system you assessed, by a hosting or network provider carrying that traffic, by your own end users or customers, or by a regulator. It does not apply to the extent the claim is caused by our failure to supply the software materially in accordance with its documentation.

We will tell you promptly about any claim covered by this section. You may take over the defense with counsel of your choosing, provided we can participate at our own cost and you do not settle in a way that admits fault on our part or imposes any obligation on us without our written agreement. If you do not take up the defense promptly, we may defend the claim ourselves at your expense. This obligation survives the end of your subscription and the closure of your account.

15. Termination

You can close your account at any time from your profile page; this cancels active subscriptions immediately without refunding the remaining paid period, signs out every connected device and anonymizes your personal data as described in the Privacy Policy. If you want to keep access you have already paid for, cancel the subscription instead and let the current period run out. We may suspend or terminate accounts that materially breach these terms — in particular the authorized-testing requirement — or that fail to pay.

On termination your license to the software ends and you must stop using it. Sections 3, 4, 8 and 10 through 20 survive termination, along with any payment obligation accrued before it.

16. Resolve it with us first

Before starting any court or arbitration proceeding, you must send us a written notice of dispute through the contact form or from your account, describing the claim, the facts it rests on and the specific relief you want. We will do the same before bringing a claim against you. Neither of us may commence proceedings until 30 days after that notice is received, and during that period both of us will negotiate in good faith to resolve the dispute. Any limitation period is suspended while this process runs, so nothing is lost by using it. This does not prevent either of us from seeking urgent injunctive relief to stop ongoing unauthorized use or infringement, and it does not apply where you are a consumer and the law that protects you does not permit it.

17. Time limit for claims

You must notify us of any claim arising out of or relating to the service within 12 months of the date it first accrued, using the notice procedure in section 16. A claim you do not raise with us in that window may be treated as waived. Where the law that applies to you does not allow a limitation period to be shortened by agreement, this section operates only as a duty to notify and takes nothing away from the period the law gives you.

18. Claims are brought individually

Claims are brought in an individual capacity only, and not as a claimant or class member in any purported class, collective, consolidated or representative proceeding. This section does not apply where you are a consumer and the law that protects you does not permit it, and its unenforceability in that case does not affect the rest of these terms.

19. General

• Severability and reformation. If any provision is held invalid or unenforceable, it is not struck out but narrowed to the minimum extent needed to make it enforceable, preserving as much of its original effect as the law allows; if it cannot be narrowed, it is severed and the rest of these terms continue in force.
• No waiver. Not enforcing a provision, once or repeatedly, is not a waiver of it or of any other provision.
• Assignment. You may not assign or transfer this agreement without our written consent. We may assign it to a successor in connection with a merger, acquisition or sale of assets.
• Force majeure. Neither party is liable for a failure to perform caused by events beyond its reasonable control, including network and infrastructure failure, denial-of-service attacks, acts of a public authority, natural disaster, armed conflict and industrial action.
• Notices. We give notice by email to the address on your account or by publishing it in the service; you give notice through the contact form or a support ticket. You consent to receiving communications and agreements from us electronically.
• No third-party rights. This agreement creates no rights for anyone other than you and us.
• Independent parties. Nothing here creates a partnership, agency, joint venture or employment relationship.
• Language. These terms are written in English. Any translation is provided for convenience; the English text governs.
• Headings. Section headings are for reference only and do not affect interpretation.

20. Governing law and venue

This agreement and any dispute arising out of it, including non-contractual disputes, are governed by the laws of the Republic of Türkiye, without regard to conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods, and the courts and enforcement offices of İstanbul (Çağlayan), Türkiye have exclusive jurisdiction over them. Where the law that applies to you allows a jurisdiction agreement only between merchants or public legal entities, this venue clause applies only so far as that law permits, and the ordinary rules of jurisdiction apply otherwise.

If you are a consumer resident in the European Economic Area, the United Kingdom or Türkiye, this section does not deprive you of the protection of mandatory provisions of the law of your country of residence, nor of the right to bring proceedings there or before a consumer arbitration committee where the law gives you that right.

21. Changes to these terms

We may update these terms as the service evolves. Material changes will be announced by email to account holders at least fourteen days before they take effect. If a material change is to your disadvantage and you do not accept it, tell us within those fourteen days: you may cancel immediately and we will refund the unused part of the period you have already paid for. If you keep using the service after the change takes effect, that is acceptance. The current version is always published on this page, and the date it took effect is shown at the top.

22. Contact

Questions about these terms? Use the contact form or open a support ticket from your account.