Terms of service.
Commercial use license.

1. VulKill Security, service provider and legal reseller

VulKill Security is the service provider and commercial licensor mark of VulKill. The legal identity of the service provider is explained in the "Data controller and contact" section of the Privacy Policy. The contact address for service, license and support is info@vulkill.com.

When sales are enabled through Paddle, the legal seller and Merchant of Record for these sales is the Paddle entity specified on the payment screen and transaction receipt. VulKill Security product presentation, usage license and technical support; The relevant Paddle organization is responsible for the payment, invoice/tax and return transactions of the sale within the framework of its own conditions.

Customer is the person or represented organization receiving the service on his/her behalf. The person placing an order or initiating a scan on behalf of an organization must have the authority to represent that organization and authorize the relevant tests.

2. Scope and acceptance of the contract

The order terms for the paid service, this ToS and the Commercial EULA, Privacy Policy and Cancellation and Refund Policy apply together. Differences expressly regulated by a signed private contract are valid only for that scope; Mandatory law and the customer's rights to be protected in Paddle sales are reserved.

Before activating paid access or license, the relevant version and order conditions are presented to the user and the necessary express acceptance is obtained. Authorization of the scan target is a separate step from this contract acceptance. Reading the promotional page or requesting information does not constitute a paid subscription or target authorization.

3. Commercial EULA — End User License Agreement

The subject of the license is the right to access the VulKill SaaS service and to use the VulKill software components expressly included in the order. Ownership of the software is not transferred. This section does not change the open source license of the Community edition.

Under the applicable order and terms of use, the customer is granted a non-exclusive and non-transferable license to use for the purchased period, within the specified user and scanning credit limits. Licence; It includes carrying out a legal security review for the customer's own business or for customers who have written testing authority.

• Authorized team members may only use purchased access coverage. Sharing the account, license or access key with unauthorized persons; Reselling, renting or sublicensing service access also requires written consent. Providing the authorized customer with his own scan report does not, by itself, constitute resale of the software license.
• Exceed quotas, licenses, payment or access controls; It is forbidden to copy, distribute or offer the special version of VulKill as a separate commercial service without permission. The limitations on reverse engineering and decoding do not limit applicable law inalienable rights or third-party open source licenses.
• Security testing of the VulKill infrastructure or other customers' accounts is not included in the target authorization granted by this license; written testing authorization and coverage also required.
• The customer's rights to the source code, application, and other inputs remain with the customer. The Customer may use, store and share his/her authorized scanning reports with the relevant rights holder in accordance with the law and confidentiality obligations. Existing rights in the VulKill software, branding and third-party components are retained.
• The license expires at the end of the purchased period or upon termination in accordance with the contract. However, turning off automatic renewal does not automatically remove the right to use the current period retroactively. Service access, data deletion and refund consequences of termination are subject to applicable policies.
• This EULA does not preclude statutory consumer rights, valid open source permissions, retention of required legal evidence, or recourse to judicial/complaint authorities.

4. Authoritative target ownership and testing authority

Target authorization statement: "I declare that I am the owner of the domain name, IP address, application, API, source code or cloud resource that I submit for scanning, or that I have received valid written permission from the relevant rights holder for these tests; and that I authorize VulKill Security to perform tests only within the specified target, method, time and limits."

This declaration is also obtained by associating it with the target and scope when the scanning service is opened. Viewing this page, opening an account, purchasing a package, or accessing a destination online does not alone constitute testing permission.

• Permission; It must specify the target domain and subdomains, IP or cloud resources, application/repo ID, inclusive and exclusive scope, allowed methods, and validity period. For tests performed on behalf of the customer, the customer's written authorization is required.
• To verify target control and authority, VulKill Security may request DNS/HTTP verification or an authorization document showing the scope, with unnecessary personal information masked. Evidence of technical control alone does not provide legal authority to test third-party systems.
• The testing rules of the cloud and hosting provider also apply. Other customers on the shared infrastructure, third-party APIs, and systems without written permission are not included in the scanning scope.
• If authorization cannot be verified, or a redirect outside the agreed scope, access to third-party data or an unexpected impact is detected, the scan will not start or will be stopped. Changes to scope and withdrawal of authorization must be reported without delay.
• The user is responsible for the accuracy of the ownership and permission information provided by the user. This obligation does not relieve VulKill Security from its own scope control, secure service delivery or legal responsibilities.

5. Scanning scope and operation

Scanning jobs are carried out through VulKill servers according to the accepted scope of service. Internet access, the target's firewall, authentication, the provided test account, and the availability of the target may affect the results.

Load tests, destructive operations, password attempts and similar active methods that may cause service interruption are not considered part of a standard scanning permission. For these, the method, boundary and test environment must also be clearly agreed upon.

Active testing can affect the target system. An appropriate testing window, backups and, where needed, a test environment should be agreed. Scanning may be stopped if an unexpected impact, security risk or activity outside the authorized scope is detected; the conditions for resuming will then be reassessed.

6. Safe use and accountability

• Do not use the service for unauthorized access to someone else's system, data extraction, denial of service or spreading malware.
• Do not attempt to bypass access controls, usage limits, or segregation of customer data.
• Protect your account and testing credentials; Only use test accounts with the necessary authorization. Do not include passwords and API keys in general contact emails.
• Do not submit personal data that is unlawful, that you are not authorized to share, or that is unnecessary for review. Use test data and masked recording whenever possible.
• If you notice unauthorized use or security issues with your account, report it to info@vulkill.com; Do not share secrets or full exploit data upon initial notification.

7. Findings, reports and limits

A report covers only the version reviewed, targets, time, accesses, and methods. Automated checks may produce false positives or missed findings; The findings need to be evaluated in the context of their impact and removal.

It is not guaranteed that every vulnerability will be found, that a system is completely secure, or that a single scan provides regulatory compliance or certification. Reports are to support development and risk management decisions.

Proper testing and authorization is required before making changes or fixes to the production system. Re-scanning, manual review and support are only offered if included in the agreed scope of service.

8. Data, reports and licenses

The customer's existing rights over the input provided are preserved. VulKill is authorized for the processing necessary to carry out the agreed examination and present its results; This does not constitute a transfer of ownership of the inputs.

The processing of personal data is explained on the Privacy page. In scanning data processed on behalf of the customer, the parties' data controller/data processor roles, access and deletion conditions are determined separately before the service begins.

For source code entries, the zero permanent source code retention commitment in the Privacy Policy applies. This does not eliminate transient processing during scan time; does not allow source code to be kept in logs, backups, reports or training datasets. Source code acceptance is not opened without verifying the relevant sanitization and exclusion controls.

Private scan reports and client findings are not publicly released simply because the service has been requested. Disclosure of a finding requires separate authorization and evaluation.

Access to SaaS does not grant rights or an open source license to the source code of the specific version. Community edition and third party components are subject to their own published licenses.

9. Sales and subscription via Paddle

When the Paddle payment system is activated, the Paddle organization specified on the payment screen and receipt for sales made through Paddle carries out the collection, transaction taxes, invoicing and payment/refund processes as the registered merchant (Merchant of Record). VulKill provides security scanning service, coverage and technical support of the product.

In these transactions, the Paddle Buyer Conditions and Return Policy apply in addition to this text and the VulKill Cancellation and Refund Policy. Mandatory consumer rights or the conditions of Paddle that provide greater protection to the customer cannot be narrowed down by the texts VulKill.

Going live of the Paddle sale is dependent on the completion of account and product approvals and payment integration. The purchase request on the current site does not initiate these transactions and does not attract payment.

10. Fees, cancellation and refund

Monthly prices Starter $10, Pro $20, Max $59; Corporate package for 5 people is $200 USD in total. The total amounts with a 10% discount for annual payment are $108, $216, $637.20 and $2,160 USD respectively and are paid in one lump sum. Package scope, usage limits, taxes and renewal conditions are announced before payment.

Cancellation and refund for Paddle sales are governed by the Paddle Buyer Conditions and Returns Policy and applicable legislation. Application methods are explained in the Cancellation and Refund Policy. Information or a purchase request alone does not constitute a fee.

11. Stopping and limiting access

In case of lack of authorization, scope violation, unlawful use, security risk or the need to protect the infrastructure, the relevant work or access may be limited. To the extent possible and legally appropriate, the justification and steps required for further action will be provided.

Such a transaction does not eliminate the consumer's rights to defective service, withdrawal, refund or other mandatory rights. The customer may withdraw his/her testing authorization and request that the relevant scan be stopped.

12. Legal rights and updates

Liability is assessed within the circumstances of the incident, the obligations of the parties and the applicable law. These conditions do not exclude liabilities or consumer rights that cannot be limited by law.

Updates are published on this page with their dates. The essential terms of the existing paid service cannot be changed retroactively by merely changing the page text; Necessary notification and approval processes are applied.

In case of disputes, legal remedies, including application to the consumer arbitration committee, consumer court and other competent authorities, are reserved. For questions and notifications, you can use the address info@vulkill.com.