Terms of service

Version 1.0 · Effective 4 November 2026

1. The service

Noctis performs automated security scans of websites that you have added to your account and verified as yours. Depending on your plan this includes a nightly passive scan and, if you enable it, a weekly or monthly active scan ("attack simulation"). You receive reports and email alerts about the issues found.

Noctis is automated vulnerability scanning. It is not a manual penetration test and cannot find every vulnerability. A clean report does not mean a website is secure.

2. Who can use Noctis

The service is meant for businesses and professionals. By creating an account you confirm that you are at least 18 years old and act on behalf of a business, or are authorized to bind the organization you represent.

3. Only websites you are allowed to test

• You may only add websites that you own, or that you are authorized in writing by the owner to have tested.
• You prove control of each website with a DNS record or a verification file, and you keep it in place. We re-check it before every scan and pause scanning if it disappears.
• You are responsible for any permission required by your hosting provider, CDN, firewall vendor or other third party. Websites hosted on platforms such as Shopify, Wix or Squarespace may only receive passive scans, because those platforms do not allow active testing of their systems.
• You may not use Noctis to scan, attack or test systems you are not authorized to test. We will close your account immediately if you do and may report it to the authorities.

4. Active scans

Active scans send real attack input to your website (for example SQL injection and cross-site scripting attempts). They can submit forms, create test records, trigger alerts or slow the site down. Active scans only run after you explicitly enable them per website and confirm your authorization; we record when and from which IP address you did so. We recommend running active scans against a staging copy. You enable active scans at your own risk.

5. Your account

• Keep your login details secret and use a strong, unique password. You are responsible for activity under your account.
• Tell us immediately at info@noctisec.com if you suspect someone else has access.
• Scan results are confidential. We show them only to you and never publish or share them.

6. Plans, prices and payment

• Plans are billed per month in advance. Prices are listed on our website and exclude VAT.
• Payments are processed by Stripe. You can pay by card, iDEAL or SEPA direct debit, and the subscription renews every month automatically until you cancel.
• When you switch plans, the price difference for the rest of the month is settled on your next invoice.
• You can cancel at any time on the billing page. Cancellation takes effect at the end of the paid month; we don't refund partial months.
• We may change prices with at least 30 days' notice by email. If you don't agree, you can cancel before the change takes effect.
• If payment fails, we may pause scanning until it has been received.

7. Acceptable use

You may not try to break into, overload or reverse-engineer Noctis, resell the service without our written permission, or use it for anything unlawful. Found a security issue in Noctis itself? Report it responsibly to info@noctisec.com; we won't take action against good-faith research that respects these terms.

8. Availability

We do our best to keep the service available and scans running on schedule, but we don't guarantee uninterrupted availability. We may carry out maintenance, preferably outside the night scan window, and may postpone scans when needed.

9. Liability

• Our total liability per year is limited to the amount you paid us in the 12 months before the event that caused the damage.
• We are not liable for indirect damage, such as lost profit, lost data, business interruption, or damage caused by an attacker exploiting a vulnerability we did or did not report.
• We are not liable for consequences of active scans that you enabled, other than through our intent or gross negligence.
• These limits don't apply where Dutch law does not allow them, such as in the case of intent or deliberate recklessness by our management.

10. Your responsibility towards third parties

You indemnify us against claims from third parties caused by websites you added without authorization, or by your breach of these terms.

11. Ending the service

You can delete your account at any time from your account page; your data is then deleted as described in our privacy policy. We may suspend or close accounts that breach these terms, with immediate effect for serious breaches such as scanning without authorization.

12. Privacy

How we handle personal data is described in our privacy policy. Where we process personal data on your behalf, a data processing agreement (verwerkersovereenkomst) is available on request.

13. Changes to these terms

We may update these terms. We announce material changes by email at least 30 days in advance. The version on this page applies.

14. Law and disputes

These terms are governed by Dutch law. Disputes are submitted to the competent court in the district of Noord-Holland, the Netherlands.