Terms of Service

Last updated: 2026-07-07 · Version: 1.0

The short version (this box is a summary, not the contract)

We grade how exposed your domain is to email forgery and related attacks, and — on the paid tiers — give you evidence, help you fix it, and/or watch it for you.
We only look at what’s publicly visible about your domain. We’re not a hacker, a penetration test, or a malware scanner, and we never touch anything behind a login.
Security is never absolute. A good grade lowers your risk; it is not a guarantee you won’t be attacked or breached, and we don’t insure you against loss.
Some tiers carry specific money-back guarantees. Those are real — the exact terms are in the Refund & Guarantee Policy, which is part of this agreement.
You must have the right to ask us to assess the domain you submit.
If something goes wrong, the most you can claim back from us is capped, and we’re not liable for losses from an attack or fraud. The full limits are in section 10.

The full terms below are what actually governs the relationship. If the summary and the detail ever seem to disagree, the detail wins.

1. Who we are and what these terms cover

1.1 “Defaults.Exposed”, “we”, “us”, and “our” mean Defaults Exposed FZ-LLC, a UAE free-zone company, registered office and trade licence number: CWEP3805, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates · trade licence no. 47034427 · registration no. 0000004091879 (Ras Al Khaimah Economic Zone Authority). Defaults.Exposed is the trading name of this entity.

1.2 These Terms of Service (the “Terms”) govern your access to and use of the defaults.exposed website (the “Site”) and any scan, report, guide, playbook, monitoring, remediation, certificate, or related service we provide (together, the “Services”).

1.3 By using the Site or purchasing any Service, you agree to these Terms. If you are agreeing on behalf of an organisation, you confirm you are authorised to bind that organisation, and “you” means that organisation.

1.4 The Services are built and sold business-first, for domain owners. We also accept purchases from individuals; if you buy as a consumer, you keep whatever mandatory rights your local law gives you (see §10.6).

1.5 If you do not agree to these Terms, do not use the Services.

2. Definitions

All prices are in USD, per domain.

Free Scan — the no-charge, no-login domain grade available on the Site (Rung 0). Your first scan of a domain is free, and you get 3 fresh re-scans per domain per month; after that we show the cached result and a fresh re-scan is a paid feature.
Fix Guide — the free, email-gated remediation guide (Rung 1).
A-Grade Playbook — a $99 one-off sequenced runbook to take your domain to an A yourself: exact record values, console click-paths, and gotcha warnings, plus 10 verification re-checks, 1 regeneration if your stack changes, and a 90-day 100% upgrade credit against any done-for-you work we quote you for the same domain (Rung 2).
Paid Services — the A-Grade Playbook, as described on the Site at the time of purchase.
Deliverable — any report, guide, playbook, dossier, certificate, verification page, or alert we produce for you.
Assessment — our automated review of the publicly observable configuration of a domain.
You / Customer — the person or organisation using or buying the Services.

Buying for several domains at once: each additional domain in the same purchase gets an extra 5% off, escalating (2nd domain −5% … 10th domain −45%), up to a maximum of 10 domains per purchase — a blended maximum discount of 22.5%. For 11 or more domains, contact us for an agency arrangement.

3. What the Services are — and what they are not

3.1 Scope of an Assessment. Every Assessment examines only the externally observable configuration of a domain — DNS records, email authentication (SPF, DKIM, DMARC), TLS/ certificates, DNSSEC, and website security headers — all readable from the public internet.

3.2 What we do not do. An Assessment is not a penetration test, a vulnerability scan of your systems, a malware or content scan, an audit of anything behind a login, a review of your internal network, or professional information-security, legal, or financial advice. We see only what the public internet reveals. Where a Deliverable says something like “no DKIM found”, it means at the selectors we tested; a record may exist under a configuration we did not probe.

3.3 Point-in-time. An Assessment reflects the domain’s configuration at the moment it ran. Configurations change; a later change can raise or lower the true risk without us knowing.

3.4 Security is probabilistic. Improving your grade reduces the likelihood and ease of certain attacks. It does not guarantee you will not be spoofed, phished, defrauded, or breached, and a high grade is not a warranty of security. We do not provide, and nothing in the Services is, insurance against financial loss. Figures we cite about industry losses — including any example such as a company wiring a large sum to a criminal after an email was forged — are illustrations of the kind of harm domain misconfiguration is associated with. They describe why the problem matters; they are not a promise that using the Services will prevent that outcome for you, and they are not a representation about your specific risk or likely loss.

4. Evidence, signatures and “verifiable” Deliverables

4.1 Where we produce sealed Deliverables, the evidence bundle is canonicalised, hashed (SHA-256), signed (Ed25519, with the public key published on the verify page), and independently timestamped by a third-party RFC 3161 timestamp authority plus OpenTimestamps (Bitcoin-anchored) as a second independent anchor. Each sealed Deliverable has a public verification page at /verify/<id> that anyone can use, without an account. These let a third party confirm that the specific document we issued has not been altered since we issued it, and what the domain’s observed state was at that time. The A-Grade Playbook is advice, not evidence, and is not sealed or signed.

4.2 This verifiability is a statement about document integrity and observed configuration only. It is not a legal opinion, an accreditation, an insurance certificate, or a representation about matters we did not observe. Any description of a Deliverable as “forensic”, “evidence-grade”, or similar refers to the integrity and provenance of the recorded observations, nothing more.

4.3 If a timestamp authority is temporarily unreachable when we seal a Deliverable, the seal records that fact, delivery still happens, and the proof upgrades automatically when the anchor completes.

4.4 We keep verification pages available on a reasonable-efforts basis but do not guarantee indefinite availability of any specific verification URL.

5. Your obligations and authorisations

5.1 Right to assess. You warrant that, for any domain you submit for a Paid Service or a Fix Guide, you own it, control it, or are authorised by the owner to request an Assessment and any remediation. You must not submit a domain you have no right to.

5.2 Access for service tiers. For any done-for-you service, timely delivery depends on you granting the access we reasonably need and responding to reasonable requests. We qualify what access is needed at purchase. We never ask for, or accept, your passwords or account credentials — access is either delegated (for example, pointing your domain’s nameservers at a zone we operate) or guided (we tell you exactly what to change and you make the change). Delay or refusal on your side may pause the work and may affect guarantee eligibility (see the Refund & Guarantee Policy).

5.3 Accuracy. You are responsible for the accuracy of the domain, email address, and other details you give us.

5.4 Acceptable use. The Free Scan reads only public configuration, so running it against a domain you do not own is generally fine — the same way anyone can look up a public DNS record. What you must not do is use the Services to break any law, to launch or facilitate an attack, to probe domains at a scale or frequency that burdens the Site or amounts to automated harvesting, or to resell or scrape the Services without our written permission. The warranty in §5.1 (right to assess) applies to Paid Services and Fix Guides, where we act on or hold evidence about the domain for you.

6. Purchases, pricing, taxes and payment

6.1 Prices are shown on the Site at the point of purchase and may change, but a change never affects an order already placed or a fixed-price period we have expressly promised you.

6.2 Payment is handled by our payment provider, identified at checkout. By purchasing, you also accept that provider’s terms (presented at checkout). We do not store your full card details.

6.3 Currency and taxes. Prices are in USD and exclude any applicable VAT/GST, which is shown at checkout for your country. You are responsible for any other taxes, duties, or charges that apply to you, except those we are legally required to collect.

6.4 Failed payment. If a payment fails, we may retry. We never penalise a chargeback: disputing a charge with your card issuer will not cost you a fee from us or affect Deliverables you have already paid for.

7. Guarantees and refunds

The guarantee terms for current services are set out in full in the Refund & Guarantee Policy, which forms part of these Terms. Where that Policy grants you a stronger right than this section, the Policy applies. Approved refunds are processed to your original payment method within 14 days of approval.

Digital Deliverables are delivered instantly after you expressly request immediate delivery and acknowledge that this waives any change-of-mind window; that acknowledgement is recorded and timestamped at checkout. Where your local law gives you a mandatory withdrawal right anyway (for example, a 14-day right in the EU/UK), we honour it. Nothing here removes a right the law gives you.

8. Service availability

8.1 The Free Scan includes 3 fresh re-scans per domain per month; beyond that we serve the cached result, and fresh re-scans are available through the paid tiers.

8.2 We aim for high availability of the Site and automated Services but do not guarantee uninterrupted, error-free operation, and we may perform maintenance.

9. Intellectual property and licence

9.1 We and our licensors own the Site, the assessment engine, our methodology, and the templates and design of the Deliverables.

9.2 When you buy a Deliverable, we grant you a perpetual, non-exclusive licence to use and share that Deliverable for your own business purposes, including showing a certificate or verification page to your own customers, partners, or auditors. You may not misrepresent what a Deliverable says or strip its verification/attribution.

9.3 We may use aggregated, anonymised, non-identifying data from Assessments to publish census-style statistics and improve the Services. We do not publish an individual domain’s grade tied to its owner without consent.

10. Disclaimers and limitation of liability

10.1 To the fullest extent permitted by law, the Services and Deliverables are provided “as is” and “as available”, and we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement.

10.2 We do not warrant that following a Deliverable or achieving any grade will prevent any attack, fraud, breach, or loss.

10.3 To the fullest extent permitted by law, we are not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, lost data, or business interruption — including, for the avoidance of doubt, losses from fraud, spoofing, or cyber-attack, whether or not we assessed or monitored the domain.

10.4 Our total aggregate liability arising out of or relating to the Services, on any basis, is limited to the total fees you paid us in the 12 months before the claim, and never less than the price of the purchase giving rise to the claim.

10.5 Nothing in these Terms excludes or limits liability that cannot lawfully be excluded (for example, for fraud or death/personal injury caused by our negligence, where applicable).

10.6 Consumers. If you buy as a consumer (not for a business), the exclusions and cap in this section apply only to the extent the law of your country of residence allows. Some countries give consumers rights that cannot be signed away — those rights are unaffected, and nothing here is intended to remove them. This matters because we sell across borders: a customer in the EU, UK, or elsewhere may have mandatory protections that override the general limits above.

11. Indemnity

You will indemnify us against claims, losses, and reasonable costs arising from your breach of these Terms — in particular, your submitting a domain you had no right to assess, or your misuse of a Deliverable.

12. Data protection

We handle personal data as described in the Privacy Policy, which forms part of these Terms. In short: we collect the email and domain you give us, plus limited technical metadata, to deliver the Services; marketing email is sent only with your opt-in, and every email carries an unsubscribe link.

13. Term, suspension and termination

13.1 These Terms apply while you use the Services. Subscriptions continue until cancelled.

13.2 We may suspend or terminate your access if you materially breach these Terms (for example, unauthorised assessment of third parties, non-payment, or abuse of the Site).

13.3 On termination, licences granted for Deliverables you have already paid for survive; outstanding fees remain due; and the clauses that by their nature should survive (IP, disclaimers, liability, indemnity, governing law) continue. If you leave a service tier where we operate your DNS zone, we export your zone, guide the re-delegation back to you, and keep a 30-day grace window.

14. Changes to these Terms

We may update these Terms. If a change is material, we will give reasonable notice (for example, a notice on the Site or by email). Continued use after a change takes effect means you accept it. A change never retroactively alters an order already placed.

15. Governing law and disputes

15.1 These Terms are governed by the laws of the United Arab Emirates as applied in the Emirate of Ras Al Khaimah.

15.2 The parties will try to resolve any dispute in good faith first. Failing that, disputes go to the courts of that jurisdiction. If you buy as a consumer and your local law gives you a mandatory right to bring or defend a claim in your own courts, that right is unaffected.

16. General

16.1 If any provision is unenforceable, the rest stays in force. 16.2 Our not enforcing a right is not a waiver of it. 16.3 These Terms, with the policies they incorporate, are the entire agreement between us on their subject matter. 16.4 You may not assign these Terms without our consent; we may assign them to a successor of our business.

17. Contact

Questions about these Terms: [email protected] · Defaults Exposed FZ-LLC, CWEP3805, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates · trade licence no. 47034427 · registration no. 0000004091879 (Ras Al Khaimah Economic Zone Authority).