LEGAL

Terms of Service

Version 2026-11-10.1 · Effective: 29 October 2026 · Last updated: 10 November 2026

Editorial update, November 2026: the brand name changed from ScanHawk to SwarmHawk, our website moved to swarmhawk.com and the client area to app.swarmhawk.com; no change to the terms.

Provider
The Service
Accounts
Authorised testing only
Acceptable use
Plans, fees and billing
Results and confidentiality
Intellectual property
No warranty
Limitation of liability
Indemnity
Suspension, cancellation and termination
Data protection
Changes
Governing law and disputes
Contact

1. Provider

The SwarmHawk services (the "Service") at swarmhawk.com and app.swarmhawk.com are provided by:

Swarmhawk s.r.o., Company ID (IČO) 29644861, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 449938. Contact: admin@swarmhawk.com.

The Service is intended for businesses and professionals acting in the course of their trade or profession. By creating an account you confirm you are acting for such purposes and are authorised to bind the organisation you represent.

2. The Service

The Service provides automated external security assessments of internet-facing assets: external perimeter and port scanning, automated (AI-assisted) penetration testing, and research into leaked data related to your domains (for example on paste sites and dark-web sources), together with a report and a score. Features, test depth and limits depend on your plan and may change as the Service evolves.

Automated tests are non-exhaustive. They do not replace a manual penetration test, a security audit or certification, and may not find all vulnerabilities.

Pre-screen: for a domain you have added but not yet verified, you can start a passive overview (a "pre-screen"). It is limited to DNS lookups (A, AAAA, MX, TXT and CAA records of the domain; the A and AAAA records of each host the web requests go to, including redirect targets; and, for domains that receive email, the SPF, DMARC and DKIM records of the domain, DKIM only for common selectors, the DMARC record of its registered domain if the domain itself has none, and the TLSA records of up to three of its mail servers), one request for the home page (/) of the domain over HTTPS, or over HTTP only if the HTTPS connection is refused or times out, plus at most two redirects that the domain gives in reply, only within the same registered domain, and the TLS certificate details and TLS protocol version of the first HTTPS connection. If a certificate is not valid, for the web part only the type of certificate error (and the number of redirects followed before it) is recorded, no request is sent over that connection, no other HTTP result is kept and there is no fallback to HTTP; the DNS results are still shown. Where available, the pre-screen may also show possible known vulnerabilities for detected software versions, looked up by product and version only. These web requests (the home page and any redirects) identify themselves as ScanHawk pre-screen requests. Apart from that request and those redirects, and the optional exposed-files check below if you ask for it, the pre-screen does not request any other pages or files on its own initiative; it does not connect to mail servers, scan ports or run any active test. It is informational only; it is not a test or penetration test under these Terms and does not replace domain verification. Optional exposed-files check: when you start a pre-screen you may also ask us to check whether the files /.git/HEAD, /.git/config and /.env of the domain are publicly reachable. You may ask for this only for a domain you are authorised to check, and you confirm this separately for this check. The check sends up to 4 ordinary web requests (GET requests without a query string): one for each of these three addresses and, only if one of them looks exposed, one control request to a random address that does not exist. They use HTTPS or HTTP, whichever the pre-screen's home page request ended on, identify themselves like the other pre-screen web requests and never follow redirects. If a server address of the domain refuses the connection or the connection times out, no request has been sent to it and the same request goes to the domain's next address (at most three addresses). At most the first 4 KiB of each response is looked at to decide the result and is then discarded; the content of these files and the response headers are never stored or shown. For each address you see only whether the file looks publicly reachable, was not detected or could not be checked, with the HTTP status and the time of the check. When you ask for this check, the pre-screen always retrieves the domain afresh. The check is limited to 5 per day per account; each registered domain is checked at most once per 24 hours and three times per 7 days, whoever asks; each server address at most once per 24 hours, and at most three times per 24 hours per network. The check is part of the pre-screen: it does not log in, submit forms, try other paths or ports or attempt to exploit anything, and a domain for which an opt-out has been requested is never checked. Domain owners can ask us not to pre-screen their domain, or raise a complaint about a pre-screen, by writing to admin@swarmhawk.com. We do not verify ownership for this: an email from a person who says they own or control the domain is enough, and we then exclude the registered domain, including its subdomains, from pre-screens.

3. Accounts

You must provide accurate information, keep your password confidential and tell us promptly at admin@swarmhawk.com about any unauthorised use of your account.
You are responsible for all activity under your account, including tests started from it.
Accounts are personal to the registered user; do not share login credentials.

4. Authorised testing only

Security testing of systems without the owner's permission may be unlawful (including under Sections 230–232 of the Czech Criminal Code and equivalent laws elsewhere). Therefore:

You may only add and test domains and systems that you own or that you are expressly authorised in writing by their owner to test.
Before any test can start you must prove control of the domain by publishing a DNS TXT record we provide. Verification is re-checked periodically; tests are blocked if it lapses. A pre-screen (section 2) is not a test for this purpose and is available for a domain that is not yet verified, see the pre-screen item below.
DNS verification does not by itself prove authorisation. Where infrastructure is operated by third parties (hosting, cloud, CDN, SaaS providers), you are responsible for complying with their testing policies and for obtaining any permission they require.
Each time you start a test you confirm that the above is true. Tests may generate traffic, load or alerts on the target systems; you accept this and should inform relevant parties (e.g. your hosting provider or SOC) where appropriate.
A pre-screen (section 2) is available only for a domain you have added to your account and not yet verified, once your email address is verified and at least 24 hours have passed since you registered and verified it. It runs only when you start it and confirm that you are authorised to check the domain. The optional exposed-files check (section 2) runs only if you also ask for it and confirm separately that you are authorised to check the domain for it; it is part of the pre-screen. Pre-screens are limited in number per account, per network and per domain. They are not available for certain government, military, financial and similar domains, for example names under .gov, .mil, .int, .bank or .insurance, government domains under country domains (such as gov.uk) and some national authority, police, health service and registry domains, special-use and shared-hosting names, IP addresses, our own domains, and domains for which an opt-out has been requested (an opt-out covers the registered domain and its subdomains, see section 2); the list may change.
We may refuse, pause or stop any test, and may report clearly abusive use to the affected party or authorities.

5. Acceptable use

You must not, and must not allow anyone else to:

test, or attempt to test, any system you are not authorised to test, or circumvent domain verification;
use pre-screens for domains you do not own and are not authorised to check, or to collect information about other organisations' systems;
use the Service or its results to attack, exploit, extort or harm anyone, or for any unlawful purpose;
attempt to access other customers' data, reports or accounts, or probe, scan or attack the Service itself (report vulnerabilities in the Service to admin@swarmhawk.com instead — we welcome responsible disclosure);
overload the Service, evade rate limits or quotas, or use automated means to create accounts;
resell or provide the Service to third parties without our written consent;
use leaked-data findings to access accounts or systems; such findings are provided only so you can remediate exposure.

6. Plans, fees and billing

PRO: USD 299 per month, with the test types and limits described on our pricing page at the time of purchase.
Enterprise: custom scope, limits and pricing agreed in an order form or separate agreement, which prevails over these Terms where they conflict.
One-time test package: the first one-time test costs USD 150, each additional one-time test USD 100; does not apply to subscriptions. Ordered by writing to admin@swarmhawk.com. Each credit is valid for 365 days from the day it is granted to your account; if it is not used by then, it expires.
Payment and invoicing are arranged individually with us by writing to admin@swarmhawk.com; there is currently no automatic online billing and no automatic renewal. Each further period is arranged with us.
Swarmhawk s.r.o. is not registered as a VAT payer; our prices therefore do not include VAT.
Automated penetration tests use credits. Credits are granted to your account by us according to your plan or a separate agreement, and are shown in the client area.
If the testing platform clearly rejects a test you started, the credit used for it is returned to your account automatically. If the outcome of a start is unclear, we check it with the testing platform and return the credit if the test did not run; you can also ask us for a refund of that credit.
Apart from the automatic credit return described above, or where required by law or agreed otherwise, fees already paid are not refunded, including for unused credits.
We may change prices with at least 30 days' notice before your next period; you may cancel before the change takes effect.
We may suspend the Service if payment is overdue after a reminder.

7. Results and confidentiality

Reports and findings for your domains are confidential to you. We do not share them with other customers.
Reports may contain sensitive information about your systems. Store and share them carefully. We redact credentials and similar secrets from reports where we detect them, but cannot guarantee complete redaction.
We may use aggregated and anonymised data (which does not identify you or your domains) to operate, secure and improve the Service.

8. Intellectual property

We (and our licensors) own the Service, its software and content. Subject to these Terms and payment of fees, we grant you a non-exclusive, non-transferable right to use the Service and to use reports internally for securing your own systems. You own your data and the systems you test.

9. No warranty

The Service is provided "as is" and "as available". To the extent permitted by law we exclude all implied warranties, including fitness for a particular purpose. We do not guarantee that the Service will be uninterrupted, error-free, or that it will detect every vulnerability or leak, nor that findings are free of false positives. Pre-screen results in particular may be incomplete or wrong: detected technologies and versions can be inaccurate or hidden, and possible known vulnerabilities, where shown, relate only to a detected version and are matched by version number only, so they may already be fixed (for example by your vendor's backported patches) and are not verified. Where a possible vulnerability is flagged as recently known to be exploited, that flag comes from our early-warning list, is matched by version number only, may be incomplete or out of date and is not proof that the vulnerability is, or is not, exploitable on the domain. If the vulnerability lookup is pending or unavailable, this is shown and does not mean that there are no known vulnerabilities. A record or setting shown as missing, not detected, not found or "no" is not proof that it is absent; DKIM in particular is checked only for common selectors. DNSSEC is shown as "not assessed"; for DANE only whether TLSA records exist is shown, they are not validated. Results of the optional exposed-files check may also be incomplete or wrong. It looks only at the three addresses named in section 2 and only at the start of each response. "Not detected", "could not check" or "could not be checked reliably" is not proof that a file is absent or that the site is safe, and a file shown as publicly reachable is not verified further. We never show the content of these files.

10. Limitation of liability

To the extent permitted by law, we are not liable for indirect or consequential loss, loss of profit, revenue, data or goodwill, or for any outage, slowdown or other effect of tests on target systems that you authorised.
Our total liability arising out of or in connection with the Service in any 12-month period is limited to the fees you paid us for the Service in that period (or, for free use, EUR 100).
Nothing in these Terms limits liability that cannot be limited by law, including for damage caused intentionally or by gross negligence, or for harm to life or health.

11. Indemnity

You will indemnify us against third-party claims, fines and reasonable costs arising from tests you start without proper authorisation or from your breach of sections 4 or 5.

12. Suspension, cancellation and termination

You may cancel your subscription or close your account at any time by writing to admin@swarmhawk.com; we handle such requests within 30 days. Cancellation takes effect at the end of the current billing period.
We may suspend or terminate your account immediately if you breach sections 4 or 5, if required by law, or to protect the Service or third parties; otherwise with 30 days' notice.
After closure we delete or anonymise your data as described in the Privacy Policy. On request to admin@swarmhawk.com before closure, we will provide a copy of your reports within 30 days.
Sections 4, 5, 7 and 9–15 survive termination.

13. Data protection

Our processing of personal data is described in the Privacy Policy. Where we process personal data on your behalf within the tested systems or leaked-data findings, we do so as your processor under a data processing agreement, which customers can request by writing to admin@swarmhawk.com.

14. Changes

We may update these Terms. Material changes will be announced by email or in the client area at least 30 days in advance; you will be asked to accept the new version in the client area before you continue using it. If you disagree, you may cancel before the change takes effect.

15. Governing law and disputes

These Terms are governed by the laws of the Czech Republic, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The courts of Prague, Czech Republic, have exclusive jurisdiction, unless mandatory law provides otherwise.