Terms of Service

These Terms are an agreement between you and HackGrade ("we", "us"). They apply when you use HackGrade's website, free scan, account area, reports and paid plans (together, the "Service"). By creating an account, buying a plan or running a scan you accept these Terms, our Privacy Policy, our Refund & Cancellation Policy and, before any deep scan, our Scan Authorization Agreement.

1. What HackGrade does

HackGrade checks the security of websites and explains what it finds in plain language, with a grade from A to F and step-by-step fixes.

• Free scan. A short, passive check of a public website. It reads only what any visitor's browser can see and sends a small number of ordinary requests.
• Deep scan. A longer and more thorough test, available only for a site whose ownership you have proved (by DNS record, file or meta tag) and for which you have accepted the Scan Authorization Agreement. It runs from our published IP address, at a limited speed, and never includes denial-of-service or load testing.
• Plans. Paid plans add deep scans, scheduled monitoring, more sites, authenticated scans with a test account you provide, checks of cart and checkout logic, card-skimming detection, PDF reports and, for agencies, white-label reports. The current features and prices are shown on our pricing page.

2. Your account

You must be at least 18 and able to enter into a binding contract. If you use HackGrade for a company or for clients, you confirm that you may accept these Terms on their behalf. Give us accurate information, keep your password secret and tell us at once at support@hackgrade.com if you think someone else has used your account. You are responsible for what happens in your account.

3. Acceptable use: scan only what you may scan

This is the most important rule of the Service.

• You may verify and deep-scan only websites that you own or that you are authorized in writing by the owner to test. You must keep that authorization for as long as you scan the site, and show it to us if we ask.
• Ownership verification, plan limits and the scope of a scan are security controls. Do not try to bypass, trick or share them, and do not verify a domain for someone who has not authorized you.
• Do not use HackGrade, its reports or its findings against anyone else's systems, to plan or support an attack, to extort, to embarrass or to sell vulnerabilities.
• Do not attack, overload, scrape or reverse-engineer HackGrade itself (see our Security & Disclosure Policy for how to report problems safely), and do not resell the Service except under an agency plan.
• Free scans may be run on public websites, but not to harass a site owner or to run large numbers of scans automatically.

Testing a computer system without permission can be a crime, for example under Israel's Computers Law 1995, the US Computer Fraud and Abuse Act and the UK Computer Misuse Act 1990. If we reasonably believe a scan is not authorized, we will stop it, may suspend the account and may share the relevant records with the site owner, the hosting provider or the authorities.

4. Agencies and people acting for clients

If you add a client's site, you confirm that the client has authorized you in writing to have that site tested by a service such as HackGrade, for the scope described in the Scan Authorization Agreement. You are responsible for your clients' instructions, for what you tell them and for keeping their reports confidential. White-label reports may carry your brand, but you may not present HackGrade's results as a manual penetration test or a certification.

5. Reports and results

Reports describe what our automated tests observed at one point in time. They may contain false positives, and they will not find every weakness. A good grade is not a guarantee, a certificate or an audit opinion. You decide whether and how to apply our recommended fixes; make a backup and test changes before applying them to a live site. You own your scan results and reports and may share them as you wish. We may use anonymous, aggregated statistics (for example, how common a weakness is) to improve the Service, but we never publish results that identify your site without your permission.

6. Plans, billing and renewals

• Prices are shown in US dollars on the pricing page before you pay. Taxes are added where the law requires.
• Payments are processed by our payment providers, Grow (Meshulam) and Paddle. When Paddle sells to you as reseller ("merchant of record"), Paddle's buyer terms also apply to the payment and Paddle issues the invoice. We never see or store your full card number.
• Subscriptions renew automatically each month or year until you cancel. We email you at least 7 days before every renewal with the price, the date and a link to cancel.
• If we change a price, we will tell you at least 30 days before it applies to you; the new price applies from your next renewal, and you may cancel before then.
• If a payment fails, we may pause paid features until it is fixed.

7. Cancellation and refunds

The full Refund & Cancellation Policy below is part of these Terms (it is also published at /refunds). Before any purchase you must tick a box accepting these Terms and that policy; without it there is no purchase.

7.1 Cancel any time

• Cancel in one click in Account settings → Plan → Cancel subscription, or write to support@hackgrade.com from your account email. You don't need to give a reason.
• Cancelling stops the next billing. Your plan stays active until the end of the period you already paid for and does not renew; then your account moves to the free plan. Your sites and history are kept unless you delete them.
• We confirm every cancellation on screen and by email, with its date and time.
• Before every renewal we email you at least 7 days ahead with the price, the renewal date and a link to cancel.

7.2 Refunds: the rule

• One refund per customer, ever. A "customer" is the person or business that buys: every HackGrade account, email address and payment method used by or for the same person or business counts as one customer.
• That refund is possible only within 30 days of purchase and only if no full report has ever been opened on your account.
• Once any full report has been opened, there are no refunds at all, for the one-time report and for subscriptions alike.
• A refund ends access: your plan returns to the free plan and the reports bought with it can no longer be opened.
• The free check is always free and does not count as opening a full report.
• Your statutory consumer rights still apply. Where the law gives you more (see Sections 7.5 and 7.6), the law applies.

7.3 Opening a full report

• A paid full report opens only after you tick this box and press View full report: "I want immediate access to my full report and agree that opening it ends my refund eligibility, per the Refund & Cancellation Policy and Terms of Service."
• By ticking it you expressly ask us to supply the full report immediately, and you acknowledge that once you open it the report has been delivered: you lose your 14-day statutory right of withdrawal for it (where applicable) and you are no longer eligible for a refund. Otherwise refunds are limited to one per customer, within 30 days of purchase, and only if no full report has ever been opened (Section 7.2).
• We ask once per report. Right after you confirm, we email you a confirmation with the order or report number, the date and time, and the policy version.
• The full report and its PDF show a small line "Prepared for <your email> · Order #<number>" on every page, also on white-label reports.

7.4 Accepting at checkout

• Before you pay (or join the waitlist for a paid plan) you must tick: "I accept the Terms of Service and the Refund Policy: one refund per customer, within 30 days, and only if no full report has been opened." Without that box there is no purchase.
• We record that acceptance (see Section 7.9).

7.5 Consumers in Israel

Under the Consumer Protection Law 1981 you may cancel a distance purchase within 14 days of the purchase or of receiving the written confirmation, whichever is later. For a continuing service such as a subscription, you may cancel at any time; we stop charging you no later than 3 business days after your notice. HackGrade does not charge the cancellation fee that the law would allow. A link to cancel is available on our home page.

7.6 Consumers in the EU and the UK

You have a 14-day right to withdraw from a distance contract, starting on the day you buy.

• Full reports (digital content): we supply a full report only when you expressly ask for immediate access by ticking the box in Section 7.3. By doing so you acknowledge that you lose your right of withdrawal for that report. Until you open a full report you can withdraw and get a full refund.
• Subscriptions (a service): if you withdraw within 14 days, we refund what you paid minus a proportionate amount for the service you used, where the law requires it, even if this goes beyond Section 7.2.
• To withdraw, use the cancel button in Account settings or write to us; we confirm receipt by email.

7.7 How refunds are paid

Refunds go back to the original payment method within 14 days of our approval. If you paid through Paddle, the refund is processed by Paddle as the seller. Your bank may take a few more days to show it.

7.8 When we cancel

If we close your account without fault on your part, or stop offering a paid feature you rely on, we refund the unused part of any prepaid period. If we close an account because of a serious breach of our Terms, such as scanning sites without authorization, the refund rules above apply only as far as the law requires.

7.9 Records we keep

To handle refund requests and payment disputes, we keep: your checkout acceptance (account, plan, date and time, IP address, browser, and the Terms and Refund Policy versions and wording); each full-report confirmation (the same details plus the confirmation email's ID); and the date and time of every full-report view and PDF download. We keep these records for at least 18 months, even if you delete your account, and then delete them.

8. Availability and changes

We work to keep HackGrade available and secure but do not promise uninterrupted service. We may change or improve features. If a change materially reduces a paid feature you rely on, you may cancel and receive a pro-rata refund for the unused period.

9. No guarantee that your site cannot be hacked

We provide the Service with reasonable skill and care, but no security service can make a website "unhackable". We do not guarantee that the Service will find every vulnerability, that our fixes suit your particular setup, or that your site will not be attacked or breached. To the extent the law allows, the Service is provided "as is", without other warranties.

10. Limitation of liability

• Nothing in these Terms limits liability that cannot be limited by law, such as liability for fraud, for death or personal injury caused by negligence, or your mandatory rights as a consumer.
• Subject to that, neither party is liable to the other for indirect or consequential loss, lost profits, lost revenue or lost data.
• Subject to that, our total liability for all claims relating to the Service in any 12-month period is limited to the greater of (a) the amounts you paid us in the 12 months before the event giving rise to the claim and (b) USD 100.
• We are not responsible for damage caused by your failure to keep authorization, by changes you make to your site, or by third parties who attack your site.

11. Your responsibility to us

If someone else makes a claim against us because you scanned a site without authorization, broke the law or broke Section 3 of these Terms, you will cover our reasonable costs and losses from that claim. This does not apply to the extent that the claim was caused by our own breach or negligence. If you are a consumer, this section applies only as far as consumer law allows.

12. Suspension and termination

You may close your account at any time in your account settings; we then delete your data as described in the Privacy Policy. We may suspend or close an account, after notice where reasonable, if you seriously or repeatedly break these Terms, if a scan appears to be unauthorized, if we are required to by law or to protect others. If we close your account without fault on your part, we will refund the unused part of any prepaid period.

13. Changes to these Terms

We may update these Terms. We will give at least 30 days' notice by email or in the app of any change that materially affects you, except changes required by law or for security. If you do not agree, you may cancel before the change takes effect. The version and date of each text you accept are recorded.

14. Law and courts

These Terms are governed by the laws of the State of Israel, without regard to conflict-of-law rules. The competent courts in Tel Aviv-Jaffa have exclusive jurisdiction. If you are a consumer living outside Israel, you also keep the protection of the mandatory laws of your country and may bring proceedings where the law of your country allows.

15. General

If a provision is found unenforceable, the rest remains in effect. We may transfer this agreement to a successor of our business, and we will notify you. Translations are provided for convenience; if a translation conflicts with the English text, the English text prevails, unless the law of your country says otherwise.

16. Contact

HackGrade · support@hackgrade.com