Terms of service

These terms govern the use of Offensly – offensly.com, dashboard.offensly.com, blog.offensly.com and the services offered there (the “Service”). By running a check, creating an account or ordering a test you agree to them. If you use the Service for an organisation, you confirm that you may bind it, and “you” means that organisation.

1. Who provides the Service

The Service is provided by Lukáš Tejkl, č.p. 104, 517 36 Olešnice, Czech Republic, IČO 21912131, not a VAT payer (“we”, “us”). Contact: contact@offensly.com. Reports of security issues in Offensly itself: security@offensly.com (see Security).

2. What the Service does

The Service has three levels:

1. Basic DNS check on offensly.com, for anyone, without an account, on any domain: it reads only public DNS records related to email security. Up to 3 checks a day.
2. Advanced DNS check in the dashboard, with a free account, only on domains you have verified (see section 5): all our DNS checks. Up to 5 checks a day, in addition to the basic checks.
3. Web penetration testing, paid, only on verified domains or IP addresses and within the scope you confirm: an automated test of your website and its DNS made of non-destructive checks (section 6).

Daily limits are reset at midnight UTC and may be changed; the current ones are shown in the Service. We may change, add or remove individual checks as attacks and best practice evolve.

3. Your account

• You sign in with a Google account. You must be at least 16 years old and give us accurate information.
• Keep access to your Google account secure; you are responsible for what happens in your Offensly account.
• You may delete your account at any time under Account → Delete account.

4. Acceptable use

You must not:

• test, or try to test, any system you do not own or are not explicitly authorised to test;
• use the Service to attack, overload or disrupt anyone, or to find weaknesses in order to exploit them without authorisation;
• get around daily limits, verification, bot checks or payment, for example with automated tools or many accounts;
• interfere with the Service, probe it for vulnerabilities outside our disclosure policy, or resell it without our written consent;
• use the Service in breach of applicable law, including laws against unauthorised access to computer systems.

We may limit, suspend or close access that breaches these terms or puts others at risk, and report clearly unlawful activity to the competent authorities.

5. Verification and permission to test

• You prove control of a target by publishing a token we give you. Advanced checks run only on domains with the token in a DNS TXT record. Penetration tests run only on domains and public IP addresses with the token in a file on the website; on a domain we also test its www host only when the token is in its DNS TXT record too. A target may include a port; you then choose whether we test only that port or also scan the host's other ports. We check the token again before every test; if it is gone, the test does not run. After you start a verification we keep looking for the token for 24 hours and email you the result.
• When you start testing a domain or an IP address you confirm the scope (which hosts and addresses), the kinds of tests and the time window. By doing so you represent and warrant that you own the targets in scope or have the written authorisation of their owner, and that the testing does not breach any agreement that binds you, such as your hosting or cloud provider’s terms.
• We record your confirmation, the verification evidence and the time in a proof of permission secured with a qualified electronic timestamp. It shows who allowed which tests and when; we keep it as described in the privacy policy and may present it to anyone who questions a test.
• You must tell your hosting provider, security team or other third parties where their terms or your arrangements require notice of security testing, and allow our testing addresses through your firewall if you want complete results.
• You will indemnify us against claims of third parties arising from tests you ordered on targets you were not entitled to have tested.

6. How tests are run

• Tests are automated and designed to be non-destructive: they do not deliberately change, delete or exfiltrate your data, do not attempt denial of service, and run only within the confirmed scope and time window.
• Any test generates traffic. It may trigger alerts in your monitoring or firewall, add load and, in rare cases, expose an existing fault in your systems. Keep current backups and run tests at a time that suits you.
• Automated testing finds many problems, but not all of them, and can report false positives. A clean result does not mean your systems are secure. The Service does not replace a manual penetration test, legal or compliance advice.

7. Prices and payment

• DNS checks are free and available worldwide.
• Paid tests are available to businesses and consumers worldwide.
• A one-off test is one full test for $100, paid when you order it.
• Continuous testing of a target costs $180 a year, paid in advance. It includes 12 tests: a full test right away, then a retest of the same scope every month, compared with the earlier results. If the scope changes substantially (for example, new hosts are added), the next test is a full test that sets a new baseline; it is one of the 12 tests.
• If you start continuous testing of the same target within 30 days of a one-off test, we take $80 off the first year.
• Prices are in US dollars and include any tax; the checkout may show them in your local currency. Continuous testing renews automatically for another year at the price then in force, charged to the same payment method, until you cancel it. Link emails you before each renewal.
• Paid tests are sold through Link, the merchant of record service of Stripe. Link is the seller of record for the payment: it takes the payment, charges any sales tax, VAT or GST due in your country and pays it to the tax authority, and sends you the receipt and invoice. The checkout shows Link’s payment terms. We provide the tests and remain responsible for them under these terms. Your card statement shows LINK.COM* followed by our name.
• A one-off test that does not run – because verification is missing, the target is unreachable or our servers fail – is not charged, or the charge is refunded. In continuous testing, money is not refunded for a test that does not run. If it did not run because of us, that month is free: we extend your year by one month, so you still get all 12 tests. If it did not run because verification is missing or the target is unreachable, you can fix it until the next scheduled test. The missed test runs as soon as verification passes again, and the schedule does not move: fixed the day before the next test, both run on consecutive days. If it is not fixed by the next scheduled test, the missed test is forfeited.
• You can cancel continuous testing at any time in the dashboard. Testing continues until the end of the year you paid for and is not renewed; the rest of the year is not refunded, except under section 8. You can also cancel in your Link account. Receipts and invoices come from Link by email and are in the billing portal.
• We may change prices for the future; we tell you in advance, and changes never apply to a test already ordered.

8. Consumers in the EU: right of withdrawal

If you are a consumer, you may withdraw from a contract for a paid test or for continuous testing within 14 days of ordering without giving a reason, by writing to contact@offensly.com. When ordering, you ask us to start testing right away and acknowledge that once a one-off test has been fully performed you lose the right of withdrawal for it. If you withdraw after testing has started, you pay a proportionate part of the price: for continuous testing, $100 for the first, full test and $15 for each further test already performed, and we refund the rest. Disputes with consumers may also be resolved out of court through the Czech Trade Inspection Authority (Česká obchodní inspekce, www.coi.cz).

9. Your data and results

Your check and test results belong to you; you may use them freely. You give us the right to process them to provide the Service, as described in the privacy policy. We may use aggregated, anonymised statistics (never data identifying you or your domains) to improve the Service.

10. Availability

We aim to keep the Service available but do not guarantee uninterrupted operation. We may interrupt it for maintenance, security reasons or events beyond our control. Scheduled tests that cannot run are not charged.

11. Liability

• The Service is provided as it is, within the limits described in section 6.
• We are not liable for indirect or consequential damage, lost profits or lost data, nor for damage caused by testing targets you were not entitled to have tested.
• Our total liability for any claims related to the Service is limited to the amount you paid us in the 12 months before the claim arose.
• These limits do not apply to damage caused intentionally or through gross negligence, to harm to a person’s life or health, or where the law does not allow liability to be limited, including mandatory consumer protection.

12. Ending the contract

You may stop using the Service and delete your account at any time. We may end the contract for a free account with 30 days’ notice, and immediately for a serious breach of these terms. Paid tests already run remain payable; prepaid tests that we cancel without your fault are refunded.

13. Changes to these terms

We may change these terms for good reason, such as new features, legal requirements or security. We tell account holders about material changes at least 30 days in advance by email or in the dashboard. If you do not agree, you may delete your account before the change takes effect; continued use means you accept the new terms.

14. Law and disputes

These terms are governed by the law of the Czech Republic, in particular the Civil Code (Act No. 89/2012 Coll.). Consumers keep the protection of the mandatory laws of the country where they live. Disputes are decided by the competent courts of the Czech Republic, unless mandatory law gives a consumer the right to sue in their own country. If any provision is invalid, the rest of the terms remain in force.