Terms of Service

These Terms of Service ("Terms") govern your access to and use of the ExposureSignal website, web application, scanning services, endpoint and network agents, reports, AI-assisted features, and related services (together, the "Service"), provided by Exposure Signal LLC, a New York limited liability company ("ExposureSignal," "we," "us," or "our").

By creating an account, starting a trial, checking a box indicating your agreement, or using the Service, you agree to these Terms. If you use the Service on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to that organization. If you do not agree, do not use the Service.

If you have signed a separate written agreement with ExposureSignal covering the Service, that agreement controls to the extent it conflicts with these Terms.

ExposureSignal provides cybersecurity exposure assessment tools, which may include external attack-surface and vulnerability scanning, internal network scanning, endpoint agents, security findings and risk scoring, remediation guidance, AI-assisted analysis, and reporting. Features available to you depend on your plan.

We may modify, add, or remove features from time to time. We will not materially reduce the core functionality of a paid plan during a paid subscription term without notice.

You must be at least 18 years old and able to form a binding contract to use the Service. You must register using a valid work email address at the organization domain you identify, and you agree to provide accurate, current information.

You are responsible for safeguarding your credentials, for all activity under your account, and for the actions of any users you invite. Notify us promptly at contact@exposuresignal.com if you suspect unauthorized access to your account.

Security testing of systems you do not own or control may be illegal. Before you add any domain, IP address, network range, host, application, or device (an "Asset") to the Service or initiate any scan, you represent and warrant that (a) you or your organization own the Asset, or (b) you have obtained express written authorization from the owner to perform the testing you request, including from any hosting, cloud, or managed service provider whose terms require it.

No scan begins until you authorize testing in the Service. We may require domain or ownership verification, and we may decline, pause, or stop any scan at any time if we believe authorization is missing, insufficient, or in doubt.

You are solely responsible for confirming the scope of your authorization, for complying with all laws and third-party agreements that apply to testing your Assets, and for any consequences of testing Assets you were not authorized to test. You agree to keep records of your authorization and provide them to us upon request.

Scanning and testing involve sending network traffic to, and in some cases interacting with, your systems. Although the Service is designed to be non-destructive, testing may occasionally cause performance degradation, service interruptions, log or alert activity, account lockouts, or other unintended effects.

You are responsible for maintaining current backups, scheduling testing appropriately, notifying internal teams and providers as needed, and monitoring your systems during testing. To the extent permitted by law, ExposureSignal is not responsible for effects on your systems that result from testing you authorized.

Certain plans include software that you install on your endpoints or network (an "Agent"). Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to install and use Agents solely on devices you own or control and solely to use the Service during your subscription.

Agents may collect system, configuration, software inventory, and network information needed to provide the Service. You are responsible for providing any notices to, and obtaining any consents from, your personnel that are required by law or your policies. You must uninstall Agents when your subscription ends.

You agree not to, and not to allow anyone else to:

• scan, probe, or test any Asset you are not authorized to test;
• use the Service to attack, disrupt, gain unauthorized access to, or exploit any system, or to develop or distribute malware;
• use the Service for denial-of-service testing, load testing, or traffic volumes beyond your plan, unless we have agreed in writing;
• reverse engineer, decompile, or attempt to extract source code from the Service or Agents, except where applicable law expressly permits;
• circumvent usage limits, authentication, domain verification, or other security controls of the Service;
• resell, sublicense, or provide the Service to third parties, unless you are an authorized partner under a separate written agreement;
• use the Service to build a competing product or to benchmark it for publication; or
• use the Service in violation of any applicable law or regulation.

We may investigate suspected violations and may suspend or terminate access, and cooperate with law enforcement, where we reasonably believe the Service is being misused.

We may offer a free trial for a limited period. Trials include only the features described for the trial plan, are provided as-is, and end automatically at the end of the trial period. You will not be charged when a trial ends unless you choose a paid plan.

Paid plans are billed monthly in advance using the payment method you provide, and renew automatically until cancelled. Fees, included scans, AI usage credits, and other limits are described at the time of purchase and on our pricing page. Unless stated otherwise, usage allowances reset each billing period and do not carry over.

Fees are exclusive of taxes, which you are responsible for paying. Except where required by law or expressly stated otherwise, fees are non-refundable. You may cancel at any time, and cancellation takes effect at the end of the current billing period. We may change prices with at least 30 days’ notice, effective at your next renewal. We may suspend the Service if payment is overdue.

As between you and ExposureSignal, you retain all rights in the information you submit to the Service and the results generated about your Assets, including findings and reports ("Customer Data"). You grant us a limited right to host, process, and use Customer Data to provide, secure, support, and improve the Service.

We treat Customer Data, including vulnerability findings, as confidential and use reasonable administrative, technical, and physical safeguards to protect it. We will not sell Customer Data or disclose it to third parties except to service providers who help us operate the Service under confidentiality obligations, or where required by law.

We may use aggregated, de-identified information that does not identify you, your users, or your Assets to operate and improve the Service and to produce threat and industry insights.

The Service may use artificial intelligence to summarize findings, prioritize risks, answer questions, or suggest remediation steps. AI-generated output may be incomplete or inaccurate, and you are responsible for reviewing it before relying on it or acting on it. We do not use Customer Data to train third-party general-purpose AI models.

ExposureSignal and its licensors own all rights in the Service, Agents, documentation, and related technology, including all improvements. Except for the limited rights expressly granted in these Terms, no rights are granted to you.

If you provide suggestions or feedback, you grant us a perpetual, royalty-free right to use it without restriction or obligation to you.

The Service may rely on or integrate with third-party services, such as hosting providers, payment processors, threat intelligence sources, and AI model providers. Your use of third-party services you choose to connect is governed by their terms, and we are not responsible for them.

No security assessment can identify every vulnerability or prevent every incident. The Service is a tool to help you understand and reduce risk; it does not guarantee that your systems are secure, compliant with any law or framework, or free from vulnerabilities. You remain responsible for your security program, remediation decisions, and compliance obligations. The Service does not replace professional legal, compliance, or incident-response advice.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," AND EXPOSURESIGNAL DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ACCURACY. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT IT WILL DETECT ALL VULNERABILITIES OR THREATS.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL EXPOSURESIGNAL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, OR BUSINESS INTERRUPTION, OR FOR DAMAGES ARISING FROM A SECURITY INCIDENT OR BREACH OF YOUR SYSTEMS, ARISING OUT OF OR RELATED TO THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXPOSURESIGNAL’S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID TO EXPOSURESIGNAL FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US$100).

You will defend, indemnify, and hold harmless ExposureSignal and its affiliates, officers, employees, and agents from and against any claims, damages, losses, liabilities, and expenses (including reasonable attorneys’ fees) arising from (a) testing of any Asset you were not authorized to test, (b) your Customer Data, (c) your violation of these Terms or applicable law, or (d) your use of the Service in breach of any third-party agreement.

These Terms apply for as long as you use the Service. You may stop using the Service and close your account at any time. We may suspend or terminate your access immediately if you breach these Terms, if we reasonably believe testing is unauthorized or harmful, if required by law, or if payment is overdue.

Upon termination, your right to use the Service and Agents ends. You may request an export of your reports for 30 days after termination, after which we may delete Customer Data in accordance with our retention practices. Sections that by their nature should survive termination will survive, including authorization, fees owed, data, intellectual property, disclaimers, limitation of liability, and indemnification.

You may not use, export, or re-export the Service or Agents in violation of U.S. or other applicable export control and sanctions laws, or on behalf of any person or in any country subject to such restrictions.

We may update these Terms from time to time. If we make material changes, we will notify you by email or through the Service before they take effect. Your continued use of the Service after the effective date of updated Terms constitutes acceptance of them.

These Terms are governed by the laws of the State of New York and applicable U.S. federal law, without regard to conflict-of-laws rules. Any dispute arising out of or related to these Terms or the Service will be brought exclusively in the state or federal courts located in the State of New York, and each party consents to the personal jurisdiction of those courts. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

These Terms, together with any order form and the Privacy Policy, are the entire agreement between you and ExposureSignal regarding the Service. If any provision is found unenforceable, the remaining provisions remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. Neither party is liable for delays caused by events beyond its reasonable control.