Terms of service and sale

CyberCrush analyses the security configuration of publicly accessible websites. From a URL supplied by the user, the service sends ordinary HTTP and DNS requests, then returns a report with a grade from A to F, a list of findings ranked by severity and, for each one, a recommended fix.

The service is provided as is, for information. It is neither a regulatory security audit, nor a penetration test, nor a certification.

The service sends only GET and HEAD requests, which never change the state of the analysed server. It performs no injection, no fuzzing, no brute force, no authentication attempt and no load testing.

The service does not crawl the site exhaustively. It reads the supplied URL and a fixed, public list of well-known public paths, within a per-analysis request cap.

The analysed site's robots.txt is read and respected for every path explored beyond the URL supplied by the user.

The scanner's behaviour is documented in full on the "Our scanner" page.

The user declares that they will not use the service to prepare, facilitate or conceal an intrusion, unauthorised access, or any other interference with an automated data processing system.

The user remains solely responsible for how they use the information in the reports, and for the targets they submit.

The user must not attempt to circumvent the service's technical limitations, in particular its rate limits and destination controls.

Any breach may result in immediate suspension of the account, with no refund of unused credits.

Any domain name owner may request exclusion from the service. Requests are made by email to the contact address given on the "Our scanner" page, from an address on that domain or from the contact published in its WHOIS.

Once the exclusion is recorded, the domain and all its subdomains can no longer be submitted to the service. Any attempt is refused without consuming a credit.

The service may also unilaterally refuse to analyse certain targets, in particular internal network addresses, infrastructure services and its own domain.

One analysis consumes one credit. The credit is charged when the analysis is launched. If the analysis fails for good, the credit is automatically given back.

Pack credits are bought outright, as a one-off payment, and do not expire.

Subscription credits are an allowance refilled at each billing period. They are not cumulative: whatever is left at the renewal date is lost and replaced by the new allowance. When the subscription ends, the remaining allowance is lost; pack credits are never affected.

A subscription is taken out monthly or annually. Annually, the twelve months are charged in one payment at subscription, and the matching allowance — twelve times the monthly one — is credited immediately and expires at the end of the paid period.

During an analysis, subscription credits are consumed before pack credits.

Prices are shown in euros. Payments are processed by Stripe; CyberCrush stores no card data.

The full history of credit movements is available at any time from the Account page.

Under article L221-28 of the French Consumer Code, the right of withdrawal does not apply to digital content supplied immediately after purchase whose performance has begun with the consumer's agreement.

Unused credits may be refunded pro rata on request, within fourteen days of purchase, at the contact address given in the legal notice.

A passive analysis observes headers, DNS records and public responses. It does not prove the existence of an exploitable vulnerability and is no substitute for one.

Where a version number is publicly exposed, the finding concerns that exposure. Known vulnerabilities associated with that version are mentioned as context to be verified on the server, never as a verdict.

A check that cannot conclude is reported as "not determined" and subtracts no points. The absence of a finding on a given point is not a guarantee of compliance.

The user may enable a public share link for a report. The report then becomes readable without an account by anyone holding that link, and may be indexed by search engines.

The user is solely responsible for the decision to share a report and for the consequences of that sharing. Sharing can be disabled at any time.

The service is provided without any guarantee of continuous availability. Interruptions may occur for maintenance or because of third-party providers.

The publisher's liability cannot exceed the amount of credits purchased over the last twelve months, and can under no circumstances cover indirect damages.

The user may delete their account at any time from the Account page. Deletion is immediate and permanent: any running subscription is cancelled without refund and unused credits are lost.

The publisher may suspend or terminate an account in the event of a breach of these terms, in particular where the service is used for intrusion purposes.

These terms are governed by French law. Failing an amicable settlement, any dispute falls within the jurisdiction of the French courts.

Under article L612-1 of the French Consumer Code, consumers may use a consumer mediator free of charge: [MEDIATOR NAME AND DETAILS TO BE COMPLETED].