Acceptable Use Policy

This Acceptable Use Policy applies to PreflightX, operated by ContentHub s.r.o. at https://preflightx.io, and forms part of our Terms of Service.

Use PreflightX only for lawful, authorized defensive security testing and remediation. Public accessibility does not mean you have permission to test a system.

1. Permitted use

You may use the Service to test systems you own or are explicitly authorized to test, within the scope of that authorization. Permitted uses include identifying security misconfigurations, reviewing findings, verifying remediation, and using AI-ready repair prompts for legitimate remediation.

Before submitting a target, confirm that your authorization covers the target and requested testing. Respect the system owner's rules, third-party infrastructure restrictions and applicable laws. Stop testing if authorization expires or is withdrawn.

2. Prohibited activity

You must not use the Service to:

• scan, probe or test third-party systems without explicit authorization;
• obtain unauthorized access, exploit vulnerabilities, or bypass authentication or access controls;
• steal, collect for misuse or disclose without authorization credentials, tokens, secrets or personal information;
• deliver malware, perform destructive testing, cause denial of service or resource exhaustion, or intentionally disrupt systems;
• commit cybercrime or use findings to compromise third-party systems;
• circumvent rate limits, the lifetime Free verification limits, subscription or access controls, or suspensions;
• create or use multiple accounts to evade limits or restrictions;
• access PreflightX infrastructure or security controls without authorization;
• use automated access that harms the Service, degrades availability or evades its safeguards; or
• submit malware or malicious payloads against PreflightX.

You must not help others carry out these activities through the Service.

3. Responsible use of findings

Use findings, technical evidence and repair prompts only for lawful, authorized defensive or remediation purposes. Treat exposed credentials, personal information and other sensitive findings as confidential. Share them only with people authorized to receive them, using appropriate safeguards.

Do not use findings for exploitation, extortion or unauthorized disclosure. Review and test suggested changes before deploying them; automated findings or repair prompts do not replace your judgment or responsibility.

4. Enforcement

We may investigate suspected misuse, restrict scans, suspend or terminate access, and preserve relevant records where required or otherwise lawful and necessary. We may cooperate with valid legal requests and report suspected criminal activity where required or appropriate under applicable law.

The action taken may depend on the severity, impact and urgency of the issue. Where lawful and practicable, we will provide information about restrictions and how to contact us for review. We may act immediately to address security threats, ongoing abuse or legal requirements.

5. Reporting Unauthorized Scanning

If you believe your application or system was scanned through PreflightX without authorization, contact hello@preflightx.io with the subject "Unauthorized Scan Report" and include the affected domain and any relevant details. We may investigate the activity, restrict the associated account or scanning access, preserve relevant records where legally permitted, and take other appropriate action.

6. Reporting concerns and changes

Report suspected misuse or questions about permitted activity to hello@preflightx.io. Include enough information for us to understand the issue, but do not email live secrets or unnecessary personal information. Contacting us does not itself authorize testing of PreflightX or another system.

We may update this policy as threats, the Service or legal requirements change. We will revise the date above and give any additional notice required by law.