Terms of Service

Effective October 23, 2026

1. About these terms

1.1 These terms are an agreement between you and Colin Finley, doing business as Frontage Security (“Frontage,” “we” or “us”) for the use of Frontage, an external attack surface monitoring service. You accept them by checking the box provided when you request an account, and again when you start a subscription. We record which version you accepted, when and from which IP address.

1.2 Frontage is a service for businesses and other organizations, not for personal or household use. If you accept these terms on behalf of an organization, you confirm that you have authority to bind it, and “you” and “Customer” mean that organization.

1.3 These terms incorporate the Privacy Policy, the Responsible disclosure policy and each Authorization Form you sign. If they conflict, this order applies: a signed agreement that expressly overrides these terms; then an Authorization Form, for the Targets and conditions it covers; then these terms.

2. Definitions

• Target: a domain, hostname or IP address that you ask us to assess.
• Authorization Form: our written authorization to scan, signed (including electronically) by a person with authority over the Targets it lists, setting out the Targets, any exclusions, the permitted techniques, the start date and the emergency contacts.
• Verified Target: a Target listed in an accepted Authorization Form whose control by you has been confirmed under section 5.
• Passive Checks: checks that read only public information, such as DNS records and public certificate transparency logs, and send no traffic to the Target’s own systems.
• Active Scanning: checks that connect to a Target, described in section 7.
• Candidate Asset: a hostname we discover through Passive Checks, such as a subdomain found in certificate logs, that is not yet a Verified Target.
• Findings: the results, evidence, reports and recommendations we produce about your Targets.
• Customer Data: information you give us and Findings about your Targets.

3. The service

3.1 A subscription covers one organization and up to 10 domains, with their subdomains, for the checks described in our documentation: Passive Checks of email authentication, DNS configuration, subdomain takeover risk and certificate logs, and Active Scanning of Verified Targets. It includes scheduled reassessment, a record of what changed, alerts you configure, and reports.

3.2 The free domain check is a single Passive Check of a domain you enter. It is available once you have requested an account, before approval. Use it only for a domain you own, manage or have permission to assess. Its results are shown at a private link and are deleted after 30 days. We limit how often it can be used and may change or withdraw it at any time.

3.3 Frontage is an automated monitoring service. It is not a penetration test, a PCI DSS approved scanning vendor (ASV) scan, an audit, a certification or legal or compliance advice.

4. Authorization to scan

4.1 Authorization. You authorize Frontage, its personnel and its service providers to access, probe and test each Target listed in an accepted Authorization Form, using the methods described in section 7 and the Authorization Form, for as long as your subscription continues. You represent and warrant that:

• (a) you own each Target, or have obtained and will maintain written authorization from its owner sufficient to grant the permission in this section;
• (b) the person who accepts these terms, and each person who signs an Authorization Form, has authority to bind you and to grant that permission;
• (c) testing each Target as described will not breach any agreement between you and a third party, including any hosting, cloud, content delivery or managed service provider; and
• (d) you will tell us in writing within two business days if any of this stops being true for any Target, for example because a domain lapses, an IP address is returned to a provider or a managed client leaves you.

4.2 This permission is given for the purposes of the Computer Fraud and Abuse Act (18 U.S.C. § 1030), Chapter 76 of Title 18 of the Pennsylvania Consolidated Statutes, the UK Computer Misuse Act 1990 and any similar law in any jurisdiction.

4.3 If you manage systems for other organizations (for example as an IT provider), you must hold written authority from each of them for each Target and give us a copy on request.

4.4 We may refuse any Target, remove it from scope, or stop testing it at any time, including if we doubt the authorization, if testing appears to be causing harm or if anyone claiming to own the system asks us to stop.

5. Verification and scope

5.1 Verification. We will not perform Active Scanning of a Target until it is listed in an accepted Authorization Form and you have shown that you control it, by a method we tell you, such as confirming a link we email to an address at the domain, signing up with an email address at the domain, publishing a DNS TXT record we give you, placing a file we give you on the website or providing a signed authorization from the owner of the system or the infrastructure it runs on. A person who confirms a link we email states that they are authorized to approve security scanning of the domain and its subdomains. We may review a new Target before Active Scanning of it starts, and we may refuse to start Active Scanning of a Target that has been verified only by email.

5.2 Scope is enforced. Each Verified Target is recorded with the date from which testing is authorized and a reference to the Authorization Form. Our system refuses Active Scanning of anything outside a current scope, and records what was authorized and what was run.

5.3 Discovered assets. Candidate Assets receive Passive Checks only. They are shown to you to confirm, and are actively scanned only once added to an Authorization Form and verified.

5.4 We may ask you to verify a Target again at any time, and may suspend Active Scanning of a Target that cannot be verified again. A verification by email or by sign-in address lasts one year: we ask you to confirm it again before it ends, and Active Scanning of the Target stops if it is not confirmed.

6. Systems hosted by third parties

6.1 Targets hosted by others, including cloud providers, content delivery networks, shared hosting providers and software-as-a-service vendors, may be subject to those providers’ acceptable use and security testing policies, and a single IP address may serve systems that belong to others. You are responsible for confirming that testing is permitted by each provider and for obtaining any approval it requires.

6.2 Unless you give us written authorization from the owner of the infrastructure, we may limit any Target that resolves to shared or third-party infrastructure (for example, a subdomain that points to a hosted store or marketing platform) to Passive Checks and non-intrusive checks: DNS, certificate and encryption details and web response headers.

6.3 Results from shared infrastructure can be misleading. For example, some content delivery networks answer on ports that are not really open on your systems. We say so in a Finding where we can tell.

7. How scanning behaves

7.1 Active Scanning consists of: a TCP connection scan of the 1,000 most commonly used ports at Nmap’s normal timing, with identification of the service and software version on each open port; examination of encryption protocols and certificates; web requests (GET only) for response headers, for a short, fixed list of paths that should never be public, such as /.git/config and /.env, and, on WordPress sites, for a small number of public files that state software versions (the site’s feed and readme file, its theme’s style sheet and the readme files of up to 10 plugins the site’s own pages reference); and negotiation of SSH and mail server encryption settings.

7.2 We do not attempt to sign in, guess passwords, exploit weaknesses, change anything on the systems assessed or test for denial of service, and we do not do so unless you agree otherwise in a separate signed statement of work. Our web requests identify themselves with a User-Agent beginning Frontage/1.0 (Frontage Security. See our scanning traffic for how to recognize our scans.

7.3 Scans run on the schedule agreed with you. You may ask us to pause scanning, or to stop scanning a Target, at any time, and we will do so promptly.

7.4 Operational risk. Scanning sends traffic to Targets and, despite our use of normal timing and non-destructive techniques, may cause service degradation or interruption, increased log volume, security alerts or automatic blocking. You are responsible for choosing when scans run, telling your internet, hosting and security monitoring providers about them, maintaining backups and the ability to recover and telling us immediately if you see adverse effects.

8. Your responsibilities

You must give us accurate information, keep the people and contacts on your Authorization Forms current, keep your account credentials confidential and tell us promptly if you suspect they have been used without your authority. We recommend enabling two-factor authentication. You are responsible for activity under your accounts, for how you act on Findings and for testing any change before you make it, because some changes, such as enforcing an email authentication policy, can affect legitimate services if made without care.

9. Acceptable use

You must not, and must not allow anyone else to:

• submit a Target you are not authorized to have tested or try to get around verification, scope enforcement or rate limits;
• use the service or any Finding to attack, disrupt, extort or gain unauthorized access to any system or person;
• resell, sublicense or white-label the service or Findings without a separate written partner agreement with us;
• submit systems that control physical processes, medical devices or critical infrastructure (such as industrial control systems) without a separate written agreement with us;
• use the service in breach of sanctions or export laws (see section 20);
• test the security of Frontage itself, except as our Responsible disclosure policy allows; or
• use the service in any way that is unlawful or that harms us or others.

10. Suspension and termination

10.1 We may suspend Active Scanning, or your access, immediately if we reasonably suspect a Target is not authorized, if we receive a complaint from the owner of a system, a provider or an authority, if you breach section 4 or section 9, if your use risks harm to anyone or if a payment you owe is not made.

10.2 Where the law allows, we may share your identity, the Authorization Form and our records of the testing with the owner of a system who complains about it, or with an authority, to show that the testing was authorized.

10.3 You may cancel your subscription at any time (see section 11) and ask us to close your account. We may end these terms on 30 days’ notice, or immediately for a material breach. Sections that by their nature are meant to survive the end of these terms, including sections 4, 12, 14, 17, 18, 19 and 21, survive.

11. Fees, renewal and cancellation

11.1 Price. Monitoring costs US$99 a month, charged in advance: the first payment is taken at checkout and covers your first month, and the same amount is charged each month after that until you cancel. There is no setup fee. Prices exclude sales and similar taxes, which are added where they apply. Payments are processed by Stripe.

11.2 Automatic renewal. Your subscription renews automatically each month, and you will be charged US$99 a month plus any applicable tax, until you cancel. Before checkout we show you these terms and ask you to agree to them, and we send a confirmation by email.

11.3 How to cancel. You can cancel at any time, online, from the Subscription page of your account, which opens Stripe’s secure billing page. Cancellation takes effect at the end of the month you have already paid for, and monitoring continues until then.

11.4 Refunds. If, within 30 days of your first payment, no Target can be verified under section 5 and no Active Scanning has run, we will refund that first payment in full. We do not refund partial months.

11.5 Failed payments. If a payment fails, scheduled monitoring and reports pause until it succeeds. After a subscription ends, your results remain available to you, read-only, for 30 days.

11.6 Price changes. We will give you at least 30 days’ notice by email of any change to the price, which will apply from your next renewal after the notice period. You may cancel before it takes effect.

12. Confidentiality

12.1 Findings describe how your systems could be attacked. We treat Customer Data as your confidential information: we use it only to provide the service, restrict access to the people who need it to do so, keep it separate from other customers’ data and require our service providers to protect it.

12.2 We report Findings only to you and to the people you designate. We do not publish Findings, use them in a case study or share them in a way that identifies you, without your written consent. We do not tell your vendors, regulators or law enforcement about Findings unless you agree or the law requires it, in which case we will tell you first where the law allows.

12.3 If a scan shows signs of an active compromise, an exposed database or leaked credentials, we aim to tell your emergency contact within one business day.

12.4 You will keep confidential any non-public information about our service, including its methods and any pricing terms agreed only with you. These obligations continue after these terms end; for Findings, without a time limit.

13. Ownership

13.1 You own Customer Data, including the Findings about your Targets. You grant us the rights we need to process it to provide the service.

13.2 We own the service, its software, methods, wording and design. You may use reports we produce for you for your own internal purposes, including sharing them with your IT providers, advisors, insurers and auditors.

13.3 We may compile aggregated, de-identified statistics (for example, how common a misconfiguration is across all customers) that never identify you, a person or a Target, and use them to improve the service and in general publications.

13.4 We do not use Customer Data or Findings to train artificial intelligence models.

14. Retention and deletion

• During your subscription, we keep your scan history and Findings, so that changes over time can be shown.
• After your subscription ends, your results are available read-only for 30 days, and we delete Customer Data within 90 days of the end of the subscription, or sooner if you ask.
• Free domain check results are deleted after 30 days.
• Backups are replaced on a 14-day cycle, so deleted data can remain in a backup until then.
• Authorization records (Authorization Forms, scope records and the audit log of what was authorized and run) are kept for seven years after the last scan, because they are the evidence that testing was authorized.
• Billing records are kept for as long as tax law requires.

Where a check finds an exposed file that may contain secrets, we do not store the file’s contents. A Finding records only that the file was readable, with at most a short excerpt in which secret values are redacted.

15. Third-party data

Some information in the service comes from public sources, such as public DNS, certificate transparency logs (searched through crt.sh, a service operated by Sectigo) and public vulnerability databases (the U.S. National Vulnerability Database, the CISA Known Exploited Vulnerabilities catalog, FIRST’s Exploit Prediction Scoring System and the OSV database). We look up only software names and versions in those databases, never anything that identifies you. Third-party data is provided for your internal security purposes only, without warranty, and may change or become unavailable if a source changes. You must not resell, republish or redistribute it.

16. Security and incident notification

We protect Customer Data with the measures described in our Privacy Policy. If we confirm a breach of security that leads to unauthorized access to, or loss or disclosure of, your Customer Data, we will notify you without undue delay, and within 72 hours of confirming it, and give you the information we have to help you meet your own obligations.

17. Warranty and disclaimers

17.1 We warrant that the service will perform materially as described in these terms. If it does not, and you tell us within 30 days, we will re-perform the affected checks or, if we cannot, refund the fees you prepaid for the affected period. That is your only remedy for a breach of this warranty.

17.2 Except as expressly stated in section 17.1, the service, Findings, reports and third-party data are provided “as is” and “as available.” To the fullest extent the law allows, we disclaim all implied warranties, under any theory, including merchantability, fitness for a particular purpose, title and non-infringement. You acknowledge that no security assessment can identify all vulnerabilities or all assets; that Findings reflect conditions at the time of testing only; that Findings may include false positives and may omit real vulnerabilities; that results depend on what can be reached through firewalls and other protections; and that the service does not guarantee that your systems are secure or will not be compromised.

18. Limitation of liability

18.1 To the fullest extent the law allows, neither party is liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, business interruption or the costs of responding to a security incident, however caused.

18.2 To the fullest extent the law allows, each party’s total liability arising out of or relating to these terms or the service is limited to the greater of the fees you paid us in the twelve months before the event giving rise to the claim, or one hundred US dollars. For a breach of section 12 (confidentiality), the limit is twice that amount.

18.3 Sections 18.1 and 18.2 do not limit your obligation to pay fees, your obligations under section 19.1, or either party’s liability for fraud, gross negligence, recklessness or willful misconduct, or any liability that cannot be limited by law.

19. Indemnification

19.1 By you. You will defend Frontage and its officers, personnel and service providers against any claim, investigation or proceeding brought by a third party (including the owner or operator of a Target, a hosting or network provider or a governmental authority) arising from (a) your submission of a Target that you did not own or were not authorized to have tested, (b) any inaccuracy in your representations under section 4 or (c) your breach of section 9, and you will pay all damages, fines, settlements and reasonable attorneys’ fees resulting from it. This obligation is not subject to the limits in section 18.

19.2 By us. We will defend you against any third-party claim that the service, as we provide it, infringes that party’s intellectual property rights, or that arises from Active Scanning that we carried out, through our own error, against a system outside the scope you authorized, and we will pay the damages and costs finally awarded or agreed in settlement.

19.3 The party seeking defense must tell the other promptly, let it control the defense and settlement (no settlement may impose an obligation on the defended party without its consent) and cooperate reasonably.

20. Sanctions, export controls and where we serve

You may not use the service if you are located, organized or ordinarily resident in a country or region subject to comprehensive U.S. sanctions, or if you are on, or owned or controlled by anyone on, a U.S. government restricted-party list. We do not currently offer the service to organizations in the United Kingdom, the European Economic Area or Switzerland.

21. Governing law and disputes

21.1 These terms are governed by the law of the Commonwealth of Pennsylvania, United States, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

21.2 Before starting any proceeding, a party must send the other a written description of the dispute, and both will try in good faith to resolve it for 30 days. Either party may seek urgent injunctive relief at any time.

21.3 Any proceeding must be brought exclusively in the Court of Common Pleas of Bucks County, Pennsylvania, or the United States District Court for the Eastern District of Pennsylvania, and each party consents to those courts’ jurisdiction.

21.4 Each party waives any right to a jury trial, and agrees that any proceeding will be brought only in its individual capacity and not as a plaintiff or class member in any class, collective or representative action, to the fullest extent the law allows.

22. Changes

22.1 We may change the service, giving notice where reasonably practicable. We will not materially reduce the core checks of a paid subscription during a month you have already paid for.

22.2 We may update these terms. We will give account holders at least 30 days’ notice by email of a material change. For a paid subscription, the change applies from your next renewal after the notice period, and you may cancel before then. The effective date above shows the current version.

23. General

We may send notices to the email address on your account; you may send notices to contact@frontagesecurity.com. Neither party may assign these terms without the other’s consent, except to a successor to its business. Neither party is liable for a failure caused by events beyond its reasonable control, including outages of networks, cloud or data providers. If any provision is held unenforceable, the rest remain in effect. These terms, with the documents in section 1.3, are the entire agreement on their subject. Failure to enforce a provision is not a waiver. The parties are independent contractors, and these terms create no rights for anyone else. Acceptance and signatures may be electronic.

24. Contact

Questions about these terms can be sent to contact@frontagesecurity.com.

Colin Finley, doing business as Frontage Security · contact@frontagesecurity.com