Terms of Service

Last updated 2026-10-19

These Terms of Service govern the use of secscan (one.heimdall-security.net), a service of HEIMDALL Security provided by Jan Gebser, trading as NETCORE MEDIA, Ochsenweberstraße 25b, 22419 Hamburg ("we"). By using secscan you accept these terms.

1. Scope

1.1 These terms apply to all use of secscan: guest scans, free and paid accounts, the API, the self-hosted command-line tool (CLI) and the community. Deviating terms of users apply only if we agree to them in writing.

1.2 secscan is offered to consumers and businesses. Where these terms distinguish between them, "consumer" means a natural person acting for purposes outside their trade or profession (§ 13 BGB).

1.3 For services provided through a connected HEIMDALL platform, that platform's terms apply in addition.

2. The service

2.1 secscan analyses files, archives, public GitHub repositories, files at web addresses and websites for malware, leaked secrets, vulnerable dependencies, insecure code and web security issues. Submissions are analysed automatically in isolated environments with antivirus signatures, YARA rules, heuristics, a vulnerability database and, for websites, OWASP ZAP.

2.2 The scope of each plan is shown on the Plans page at the time of use. We may develop the service further, add or change engines and rules, provided the essential functions of a paid plan are maintained for its term.

2.3 The service is a technical aid. It does not replace professional security assessments, penetration tests or legal advice.

3. Accounts

3.1 Registration requires a valid email address; you must be at least 16 years old. You keep your credentials secret, use a strong password and inform us without delay if you suspect misuse. We recommend two-factor authentication.

3.2 An account is personal and may not be shared. Accounts created automatically or under false details may be deleted.

3.3 You may delete your account at any time in your profile.

4. Plans, prices and payment

4.1 Guest use is free and limited to 3 scans per week and 10 MB per file, with a result summary. A free account includes 10 scans per week and 100 MB per file with full reports. There is no entitlement to free use.

4.2 Pro is a paid plan. The price, term and payment details are stated in our offer or order confirmation. A contract for Pro is concluded when we confirm your request in text form (for example by email) and Pro is activated for your account.

4.3 Unless agreed otherwise, Pro is paid in advance for the agreed term. Prices include statutory VAT where it applies.

4.4 If a payment is not made when due, we may switch the account back to the free plan after a reminder; your data is kept.

5. Right of withdrawal for consumers

Consumers who order a paid plan have a statutory right of withdrawal.

6. Acceptable use

6.1 You may only submit content you are entitled to have analysed. You must not use secscan to:

• scan systems, websites or code of third parties without their permission, or attack, overload or probe them;
• distribute, store or test malware for harmful purposes, or develop malware that evades detection;
• submit personal data of others, confidential data you are not allowed to share, or content that is illegal to possess;
• circumvent limits, quotas, the sandbox or other security measures, or access other users' data;
• automate use beyond the API and its documented limits, or resell the service without our consent.

6.2 If there are concrete indications of a violation, we may suspend scans, lock the account or delete content. We take your legitimate interests into account and will normally inform you first, unless this would defeat the purpose.

7. Website scans

7.1 A light scan crawls a public website and checks its responses passively, like a visitor's browser. Only run it against websites you operate or are allowed to test.

7.2 A full scan sends attack payloads (for example to detect SQL injection or cross-site scripting). It is only available for domains whose control you have proven, and you confirm that you are authorised to test them, including any systems behind them. Full scans may create entries (for example in forms or logs) and load the target system; run them preferably against test systems. You are responsible for any consequences on the scanned system.

7.3 We may block targets, stop scans or refuse domains, for example to protect third parties or our infrastructure.

8. Your content

8.1 You keep all rights in the content you submit. You grant us the non-exclusive right to store, copy, unpack and analyse it to the extent necessary to provide the service, including keeping reports for the retention period described in the Privacy Notice.

8.2 Submitted files are deleted after the scan. We do not share your submissions or reports with third parties and do not use them to train systems for others.

9. Scan results

9.1 Results are produced automatically and can be incomplete or wrong: new or targeted malware may not be detected, and harmless code may be reported (false positives). A "clean" verdict does not guarantee that a file or website is safe.

9.2 You are responsible for evaluating results and for decisions based on them. Do not open addresses or files reported as malicious.

10. API and CLI

10.1 Pro users receive API tokens and may use the self-hosted CLI for their own purposes, including in their organisation's pipelines. Tokens are confidential; you are responsible for use made with your tokens. We may revoke tokens that are leaked or misused.

10.2 The CLI is licensed for the term of your Pro plan. It checks the licence online and works offline for up to 7 days after a check. Open-source components and detection data included in it remain subject to their own licences.

10.3 We may limit the request rate to keep the service available for everyone.

11. Community

11.1 The community rules published there apply in addition. You are responsible for your posts. You grant us the non-exclusive, free right to display your posts and images in the community for as long as they are online.

11.2 Do not post live malware, secrets or personal data. Moderators may edit, move, hide or delete posts and restrict accounts that break the rules.

12. Availability

We aim for high availability but cannot guarantee uninterrupted operation. Maintenance, updates and events beyond our control may cause interruptions. Scans may wait in a queue during busy times. Service levels for business customers require a separate agreement.

13. Liability

13.1 We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act and to the extent we have given a guarantee.

13.2 For slight negligence we are liable only for the breach of an essential contractual obligation (an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment you may regularly rely), and limited to the damage that was foreseeable and typical for this type of contract when the contract was concluded.

13.3 Otherwise our liability is excluded. In particular, for free use we are liable only under 13.1. The limitations also apply to our representatives and vicarious agents.

13.4 You are responsible for backing up your own data; scans never change your files or systems except as described for full website scans.

14. Indemnity

If third parties make claims against us because you used secscan contrary to these terms, in particular by scanning systems without authorisation or submitting content you were not entitled to submit, you indemnify us against these claims, including reasonable costs of legal defence, unless you are not responsible for the violation.

15. Term and termination

15.1 Free accounts run for an indefinite period and can be ended by you at any time by deleting the account. We may end free accounts with two weeks' notice, or delete accounts that have been inactive for more than 24 months after a notice by email.

15.2 Pro runs for the agreed term. Unless agreed otherwise it does not renew automatically; the account then continues as a free account.

15.3 The right to terminate for good cause remains unaffected, in particular for serious or repeated violations of section 6 or 7.

16. Changes to these terms

We may change these terms for valid reasons, for example new legal requirements or new features. We will inform registered users by email at least six weeks in advance. If you do not object before the changes take effect, they are deemed accepted; we will point this out in the notice. If you object, either party may terminate the contract when the changes take effect. Changes to the main obligations (scope of a paid plan, price) require your express consent.

17. Final provisions

17.1 German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. For consumers, this choice of law applies only insofar as it does not deprive them of the protection of the mandatory provisions of the law of the country of their habitual residence.

17.2 If you are a merchant, a legal entity under public law or a special fund under public law, the place of jurisdiction is Hamburg.

17.3 Information on consumer dispute resolution is given in the Imprint.

17.4 Should individual provisions be invalid, the validity of the remaining provisions is unaffected.