Scanning terms

1. You must be authorised

You may submit a target only if you own or control it, or have explicit authorisation from a person or entity with authority to permit the testing Tottle performs. That authorisation must also permit you to engage a third party such as Tottle to perform the testing on your behalf. You are responsible for ensuring the audit complies with the rules of any hosting, cloud or network provider involved — a provider's shared infrastructure is generally not yours to authorise even when your own resources run on it. You represent and warrant that this authorisation exists before each audit begins and remains valid for its duration, and you confirm it separately for every target you submit. Scanning without authorisation may be unlawful where you or the target are located.

2. No warranty, no guarantee

Results are provided as is, with no warranty of any kind. A clean result is not proof that a system is secure, and Tottle does not guarantee that findings are complete, accurate or current. Findings may include false positives, and real exposures may be missed. You remain solely responsible for securing your systems and for any decision you make based on a report.

3. What is (and isn't) tested

Audits cover the publicly reachable, unauthenticated surface over TCP on IPv4: 1,181 ports per IP, TLS, HTTP responses and DNS. They do not cover IPv6, UDP, all 65,535 ports, authenticated application paths, internal infrastructure, or origins behind a CDN. Detection only — nothing is exploited, no credentials are guessed, and no request is made that intentionally changes state on the target.

4. What we record

We store the target you submit, the findings, timestamps, your account identity and the IP you connect from — used to operate the service, keep your audit history, and deter and investigate abuse. Where a credential-shaped string is detected we record only the kind (for example "AWS access key ID"), never the value; raw response bodies are not retained. Discovery uses public certificate-transparency and DNS sources, so the domain you submit is disclosed to those third parties.

5. Who is agreeing

You must be at least 18 and legally able to enter into these Terms. If you use Tottle on behalf of an organisation, you represent that you have authority to bind it to these Terms and to authorise the testing you submit.

6. Fair use, suspension and records

Audits are rate-limited and attributed to your account. We may refuse, suspend or terminate an audit or account where we reasonably believe a target is unauthorised, an audit risks harming a third party, the service is being abused, or a provider or target objects. We record each audit — target, time, account and source address — and may preserve or disclose those records where reasonably necessary to investigate abuse, respond to valid legal process, or protect Tottle or others.

7. No warranty of legality; your responsibility

Accepting these Terms does not make any particular scan lawful, and Tottle gives no assurance that a given audit is permitted in your jurisdiction, the target's, or under a provider's rules. Determining that is your responsibility. To the fullest extent permitted by law, you are responsible for claims arising from targets you submit without sufficient authorisation.