Terms of Service

CrabScan runs passive security checks against web domains: open-port discovery, HTTP security-header inspection, and TLS configuration analysis. We then summarize the findings using a third-party AI service.

We do not exploit vulnerabilities, send malicious payloads, brute-force authentication, generate volumetric traffic, or perform any activity that would violate computer-misuse laws.

Three usage tiers exist today: a free tier (limited scans), paid subscriptions (Pro, Agency), and one-time Deep Audits. Specific features and limits are described on our pricing page.

Scans of arbitrary domains require an account and one-time domain-ownership verification (DNS TXT record or a file at/.well-known/crabscan-verify.txt — the same model used by Google Search Console). Without an account, you can only run demo scans against a domain we operate ourselves for that purpose. Ordering a Deep Audit also requires an account and a verified domain.

You create an account by signing in with a magic link sent to your email.

You are responsible for keeping access to that email account secure. We cannot recover an account whose email you no longer control.

You may delete your account at any time by contacting us at support@crabscan.ai. We're working on a self-serve delete button.

You agree not to use the Service to:

• Scan a domain repeatedly in a way designed to circumvent our rate limits or our spend caps.
• Probe domains where the operator has indicated, by any reasonable means, that scanning is not welcome.
• Use the Service to compile a database of vulnerabilities for third-party domains, or to facilitate attacks against them.
• Misrepresent your identity, abuse our magic-link system, or interfere with other users.
• Reverse-engineer, scrape, or otherwise extract our reports programmatically without an explicit agreement (e.g. an API plan).

We reserve the right to suspend or terminate accounts that violate these rules, refund prorated subscription fees where appropriate, and refuse service to operators of high-risk infrastructure.

All payments are processed securely by our payment provider, who also acts as the Merchant of Record for the transaction. The provider's identity is displayed in the checkout window and on the receipt. Detailed refund rules for subscriptions and one-time reports are in our Refund Policy.

You retain ownership of the domains you submit and the data we generate about them on your behalf. You grant us the limited right to process that data only as needed to operate the Service (run scans, store reports, deliver them to you, improve our scoring).

The Service itself — the code, scoring rubric, AI prompts, scan pipelines, and design — is owned by us. You may share scan or audit report links freely; you may not republish our reports as your own.

Security is hard. The Service finds some issues, not all. A clean scan does not mean a site is secure — only that we did not find anything in the categories we check, with the evidence we had at scan time. Nothing here is a substitute for a real penetration test, code review, or ongoing security program.

The Service is provided "as is", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law.

To the maximum extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or exemplary damages arising from your use of the Service — including loss of profits, data, goodwill, or business — even if we've been advised of the possibility.

Our total liability for any claim arising from the Service is capped at the amount you paid us in the 12 months before the event giving rise to the claim, or $100 if you haven't paid us anything.

You can stop using the Service and close your account at any time.

We may suspend or terminate your access if you materially breach these terms, if continuing to provide the Service to you exposes us to legal risk, or if we discontinue the Service entirely. We'll give reasonable notice except where speed is necessary to prevent harm.

We may update these terms when the product changes or the legal landscape requires it. For material changes (anything that meaningfully reduces your rights or expands your obligations), we'll email account holders at least 14 days before the change takes effect. Continuing to use the Service after the change means you accept the new terms.

These terms are governed by the laws of Ukraine, without regard to conflict-of-law principles. Disputes arising from the use of the Service will be resolved in the courts of Ukraine, except that you may have additional rights under your local consumer-protection laws which we don't override.

Payment disputes are governed separately by the terms of service of our payment provider, who acts as Merchant of Record for all transactions. The provider's identity and a link to those terms are shown in the checkout window and on the receipt.

Questions about these terms? Reach us at:

• Email: support@crabscan.ai
• Legal name: Individual Entrepreneur Mykhailo Polazhynets
• Tax ID: 3391114511
• Registered office: Torun, 358, Mizhhirya district, 90015, Zakarpattia region, Ukraine