Terms of Service

Brutor is operated by the company identified below (the “Operator”, “we”, “us”). Our registered name and address:

Operator

Brutor performs external, black-box security testing of websites you submit — assessing them from the public internet, the way an attacker would. We never request or require access to your source code, repositories, servers, or internal systems.

A free scan provides only a limited, high-level summary — the number of issues found and their severity. Full reports — including detailed findings, evidence, severity detail, remediation guidance, continuous monitoring, and alerts — require a paid subscription.

You must create an account to use the Service, be at least 18 years old, and provide accurate information that you keep up to date. You are responsible for keeping your credentials secure and for all activity that occurs under your account — including by your team, contractors, or anyone who obtains your credentials, whether or not authorized by you.

You may only submit domains that you own or are explicitly authorized to test. By submitting a domain, you represent and warrant that you have the legal right and all necessary permissions to have it scanned, and that your use complies with all applicable laws — including those governing computer misuse, unauthorized access, data protection, and export control. You are solely responsible for obtaining such authorization.

You agree not to:

• scan or test any domain or system you do not own or are not authorized to test;
• use the Service in violation of any law or the rights of any third party;
• disrupt, overload, circumvent, or probe the Service or its limits, or interfere with its operation;
• copy, decompile, reverse engineer, or create derivative works of the Service’s software;
• use bots, scrapers, or automated means to extract data from the Service;
• resell, sublicense, or expose the Service except as expressly permitted by your plan;
• use the Service to build or assist a competing product;
• upload malware or harass our staff.

We may suspend or terminate access immediately, and report unlawful activity to the authorities, if we reasonably believe these terms have been breached.

Paid plans are billed through our payment provider on a recurring basis (monthly or annually) until cancelled. Prices are shown on our pricing page. Applicable taxes (including Swiss VAT where relevant) may be added.

Subscriptions renew automatically at the end of each billing period. You can cancel at any time from your account; cancellation takes effect at the end of the current period. Except where required by law, payments are non-refundable; annual plans may be refunded pro-rata for unused full months at our discretion. We may change prices, with notice as required by law.

Brutor relies on automated probing, heuristics, and third-party vulnerability data to assess sites from the outside. Security issues are complex and evolving, and no automated tool can detect every vulnerability or misconfiguration. You acknowledge that results may include false positives and false negatives, and may be incomplete, outdated, or inaccurate.

To the fullest extent permitted by law, we make no warranty that the Service will identify, report, or mitigate any particular vulnerability or risk, and we disclaim liability for incidents that are not detected, reported, or prevented by the Service. You are solely responsible for reviewing and validating results, for maintaining your own independent security program (including manual review by qualified professionals where appropriate), and for deciding whether and how to act on any information the Service provides. The Service is provided “as is” and “as available”, without warranties of any kind.

Scans interact with the target from the public internet and generate network requests. We design our scans to be non-intrusive and to avoid altering data, but automated testing can consume bandwidth, trigger rate-limiting, firewall blocks, alerts, or log noise, or cause transient errors on the target or interconnected systems.

You are responsible for selecting and authorizing targets where these effects are acceptable, and for any internal change-management or notification this requires. To the fullest extent permitted by law, we are not liable for downtime, degradation, data loss, financial or reputational harm, or third-party claims arising from scanning activity initiated at your request or under your configuration.

Reports, plain-English explanations, and remediation suggestions may be generated in whole or in part by artificial-intelligence systems. Such content is probabilistic and may be incorrect, incomplete, outdated, or inappropriate for your environment, and may fail to address an issue or introduce new ones.

All AI-generated content is provided as a non-binding suggestion only. You are solely responsible for reviewing and testing it before acting, and we never apply changes to your systems. To the fullest extent permitted by law, we are not liable for any loss arising from your reliance on AI-generated content.

We treat the domains you submit and the results we generate as confidential, apply appropriate safeguards (see our Privacy Policy), and do not sell your data.

We do not use your scan data to train, fine-tune, or otherwise update the weights of foundation models or large language models. Any AI providers we use operate under their own terms. We may use aggregated, anonymized, or de-identified information to operate and improve the Service.

We do not guarantee that the Service will be uninterrupted, timely, or error-free. We may modify, suspend, or discontinue all or part of the Service, and may need to perform maintenance, with or without notice. To the fullest extent permitted by law, we are not liable for any loss arising from unavailability, modification, or discontinuance of the Service.

To the maximum extent permitted by Swiss law, the Operator shall not be liable for any indirect, incidental, special, or consequential damages, or for loss of profits, data, or goodwill. Our aggregate liability arising from or relating to the Service shall not exceed the amount you paid to us in the twelve (12) months preceding the event giving rise to the claim. Nothing in these Terms excludes liability that cannot be excluded under applicable mandatory law.

You agree to indemnify and hold the Operator harmless from any claim or demand (including reasonable legal fees) arising out of your use of the Service, your submitted domains, or your breach of these Terms — including, in particular, scanning any domain without proper authorization.

The Service, including its software, reports, and brand, is owned by the Operator and protected by law. Findings and reports generated for your domains are provided for your internal use and for sharing with the relevant domain owners. We reserve all rights not expressly granted.

Our handling of personal data is described in our Privacy Policy.

You may stop using the Service at any time. We may suspend or terminate access for breach of these Terms, suspected abuse, or non-payment, and may take appropriate legal action. Provisions that by their nature should survive termination (including Sections 06–13 and 16) survive.

We may update these Terms from time to time. Material changes will be notified through the Service or by email. Continued use after changes take effect constitutes acceptance.

These Terms are governed by the laws of Switzerland, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is the Operator’s registered seat in Switzerland, subject to any mandatory consumer-protection venue. If you are a consumer resident in the EU, you also enjoy the mandatory protections of the law of your country of residence.

These Terms (together with the Privacy Policy and any plan terms) constitute the entire agreement between you and the Operator. If any provision is held unenforceable, the remaining provisions stay in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them in connection with a reorganization or sale of the business. Neither party is liable for delays or failures caused by events beyond its reasonable control (force majeure). You consent to receive communications, notices, and records electronically.

Questions about these Terms? Reach us via our contact page.