DRAFT — NOT LEGAL ADVICE. This is a starting template for the founder/buyer to have a licensed lawyer review and adapt to their operating entity and jurisdiction before launch. Nothing in this file, or in Solacess's other legal/ documents, constitutes legal advice. Notes for the reviewing lawyer are kept in the source file, not on this page.

Terms of Service (DRAFT)

Last updated: [DATE] · Effective for: Solacess ("we", "us", "our"), a service that scans web applications you own or are authorized to test.

1. What Solacess is

Solacess is an automated and semi-automated security-testing tool for web applications. It runs a series of checks against a target application — including passive checks (reading what a browser already downloads) and active checks (attempting logins, API calls, and payment-flow tests using credentials and test data you or your authorized users provide) — and produces a report of findings.

Solacess is a testing tool, not a guarantee. A scan reflects the checks run at the time of the scan only. A clean report does not mean your application has no vulnerabilities — it means Solacess's checks did not find the specific issues they test for, on that date, against that configuration. New vulnerabilities can exist immediately after a scan, whether from new code, new dependencies, or check categories Solacess does not (yet) cover. Solacess does not warrant, and expressly disclaims, that use of the service will result in your application being secure, compliant with any law or standard, or free of vulnerabilities.

2. Authorized testing only — the core rule

You may only use Solacess to scan applications that you own, or that you are explicitly authorized in writing to test by the owner. By starting a scan, you represent and warrant that:

a. you own the target application and its infrastructure, or you have documented, affirmative authorization from the owner to run security tests against it; b. any test accounts, API keys, or credentials you provide to Solacess were created for testing purposes and do not belong to real end users of the target application; c. you will not use Solacess to test, probe, or attempt to access any application, system, or account you do not own or are not authorized to test — including a competitor's product, a third party's SaaS instance, or any system reached only incidentally through the target application (e.g. a downstream API, a linked third-party service, or another tenant's data discovered mid-scan).

Solacess enforces a domain-ownership verification step (a DNS TXT record or a file token you place on the target domain) before any active check runs against that domain. This is a technical control, not a substitute for your legal authorization to test the application — you remain responsible for having the right to test it.

We may suspend or terminate your account, without refund, if we have reason to believe you used Solacess against a system you were not authorized to test. We may also be required to report such use to the affected party or to law enforcement.

3. Your account and test data

You are responsible for the accuracy and scope of the test accounts and credentials you

provide. Solacess uses only the test data you supply and does not access real end-user data.

Test credentials you provide are stored encrypted and are deleted after each scan

completes (see Privacy Policy). You should use dedicated test/staging accounts wherever possible, not accounts with access to real customer data, and you should rotate or revoke any credentials you shared with Solacess once your engagement ends.

Stripe-related checks run in Stripe test mode only. Solacess will refuse to run payment

checks against a live-mode Stripe key. You are responsible for confirming you have provided a test-mode key.

4. Findings, "verified" vs. "suspected," and fix guidance

Each finding in a Solacess report is labeled verified (Solacess's check actually

exploited or reproduced the issue) or suspected (indicators point to a likely issue, but it was not conclusively reproduced). Treat "suspected" findings as leads requiring your own confirmation, not confirmed vulnerabilities.

Fix guidance in a report is template-based and generic to the finding type. It is not

custom security consulting, is not reviewed by a human security engineer for your specific application, and should be evaluated by you (or your developer) before being applied, especially to production systems.

Solacess is not a law firm, accounting firm, or compliance auditor. A report is not a SOC 2,

ISO 27001, PCI-DSS, GDPR, or other compliance attestation, and must not be represented as one to your customers, investors, or auditors.

5. Plans, billing, and refunds

Plans: Quick Scan (free), Deep Scan ($79, one-time), Monitor ($49/month), Agency ($199/month) and Due Diligence ($399 per app, one-time). Monthly plans renew each month until cancelled, and cancelling stops future scheduled scans at the end of the paid period. [PLACEHOLDER — refund policy and proration rules, to be set by the operator and reviewed by a lawyer for the jurisdictions sold into.]

6. Acceptable use

Use of Solacess is also governed by our Acceptable Use Policy, which is incorporated into these Terms by reference.

7. Disclaimers and limitation of liability

[PLACEHOLDER — standard SaaS disclaimer/limitation-of-liability language belongs here; must be drafted or reviewed by a lawyer for your jurisdiction. At minimum it should reiterate: the service is provided "as is," findings are not a guarantee of security, and liability for any claim is capped — see open questions below for the cap amount and carve-outs.]

8. Indemnification

[PLACEHOLDER — you likely want the customer to indemnify you if they misuse the service to scan a system they weren't authorized to test (tying back to Section 2), since that exposure is the single biggest legal risk of this product. Have a lawyer draft this clause.]

9. Governing law and disputes

[PLACEHOLDER — governing law and dispute venue depend on the operating entity's jurisdiction, which the operator has not yet chosen.]

10. Changes to these Terms

We may update these Terms from time to time. We will post changes on this page and update the date at the top. For a material change we will email account owners at least 14 days before it takes effect; continuing to use Solacess after that date means you accept the change.