Terms of Service

These Terms govern your access to and use of EightScope’s external attack-surface monitoring platform, website, dashboard, reports and related services. In these Terms, “EightScope”, “we”, “us” and “our” refer to Heuristic Group Pty Ltd (ABN 37 700 907 080), the operator of the Services trading as EightScope, and “Customer”, “you” or “your” refer to the person or organisation that accesses or uses the Services.

By creating an account, purchasing a subscription, running a scan or otherwise using the Services, you agree to these Terms.

If you use the Services for an organisation, you confirm that you have authority to accept these Terms and use the Services for that organisation. In that case, references to “you” include that organisation.

If you do not agree to these Terms, you must not access or use the Services.

The Privacy Policy explains how personal information is handled. The Methodology page explains scan scope, scoring, confidence and technical limitations. Both should be read with these Terms.

Account

An account used to access the Services.

Authorised User

A person permitted by a Customer to use the Customer’s organisation or Account.

Customer Data

Information provided to EightScope by or for the Customer, including account information, verified domains, settings and information generated through use of the Services.

Domain

A root domain submitted to EightScope and any in-scope subdomains or related hostnames assessed as part of an authorised Scan.

Documentation

EightScope’s public methodology, help material, plan descriptions and user guidance.

Finding

A security-related observation produced by a Scan.

Organisation

The customer workspace to which users, domains, scans, subscriptions and results are associated.

Scan

An external assessment initiated manually or through scheduled monitoring.

Scan Results

Findings, scores, discovered assets, evidence, reports, recommendations and related outputs produced by the Services.

Services

The EightScope website, dashboard, scanning platform, monitoring functions, reports and related features.

Subscription

A paid recurring plan for access to specified Services and usage allowances.

Subscription Period

The monthly or annual billing period selected at checkout or shown in the billing portal.

You must be at least 18 years old and legally capable of entering into these Terms.

You must provide accurate account and billing information and keep it reasonably current.

If you create or manage an Organisation, you confirm that you are authorised to act for it.

Organisation owners and administrators may manage users, domains, scans, monitoring and billing. Actions taken by an authorised owner or administrator are treated as actions of the Organisation.

The Customer is responsible for its Authorised Users and for ensuring that they comply with these Terms.

You must promptly remove access for any person who is no longer authorised to use your Organisation.

EightScope provides external attack-surface discovery, security posture checks, findings, scoring, monitoring and reporting for authorised internet-facing assets.

Available features, scan types, limits and reporting options depend on the Customer’s plan, selected scan options, system availability and successful completion of relevant checks.

The Services operate from the public internet. They do not provide access to internal networks, endpoints, cloud accounts or authenticated applications unless expressly stated in a separate written agreement.

EightScope may offer Quick, Standard and Full scans and optional deeper checks. The current scope of each scan type is described in the dashboard and Methodology page.

A feature being visible in the interface does not guarantee that it is included in every plan or available for every Domain.

You may use the Services only for Domains and systems that you own or are expressly authorised to assess.

You are responsible for obtaining and maintaining all permissions required to scan each Domain, hostname, service and related asset.

This responsibility includes obtaining permission from clients, employers, hosting providers or other system owners where required.

DNS verification helps demonstrate control of a Domain, but it does not conclusively prove legal ownership or authorisation. You remain responsible for ensuring that your use is lawful and authorised.

When you add a root Domain, you authorise EightScope to discover and assess in-scope subdomains and internet-facing assets associated with that Domain, subject to the selected scan type and the platform’s safety controls.

Managed service providers and consultants may use the Services for their clients only where they have the client’s authority. They remain responsible for each client engagement and must not misrepresent the meaning or completeness of Scan Results.

EightScope may request evidence of authorisation and may refuse, suspend or stop a Scan where authorisation is unclear.

You must use the Services responsibly and lawfully.

You must not:

• scan a Domain or system without proper authority
• use the Services to identify targets for unauthorised access, exploitation or attack
• attempt to bypass authentication or access controls
• use findings to compromise, disrupt or damage a system
• perform credential attacks, brute-force attacks or password spraying
• upload or distribute malware or harmful code
• deliberately create excessive traffic or interfere with service availability
• circumvent plan limits, rate limits, usage controls or safety protections
• submit false DNS-verification records or misleading ownership information
• attempt to access another customer’s account, data or Scan Results
• share Account credentials with unauthorised people
• reverse engineer, scrape or systematically extract the Services except where permitted by law
• reproduce or resell platform access except where allowed by the applicable plan or a separate written agreement
• use the Services in breach of any law, court order, contractual obligation or third-party right
• use automated tools against the Services without EightScope’s permission
• impersonate another person or organisation
• remove ownership, copyright or attribution notices from reports or Documentation

Reasonable security research relating to your own authorised assets is not prohibited merely because it identifies a vulnerability. The restriction applies to unauthorised, unlawful, harmful or abusive conduct.

Scans generate network requests to public systems. They may appear in access logs and may trigger firewalls, hosting alerts, intrusion-detection systems, rate limits or security-monitoring tools.

EightScope is designed to use non-destructive external checks. However, no external scanning activity can be guaranteed to have zero operational impact.

Deeper checks, including broad port scanning, may create more traffic and are more likely to trigger alerts.

You are responsible for selecting appropriate scan options, scheduling scans at suitable times and confirming that your hosting, security and service-provider agreements permit the activity.

You must not run a Scan where doing so could create an unreasonable risk to safety-critical, fragile or production systems without appropriate authorisation and controls.

EightScope may throttle, delay, refuse or stop a Scan to protect the Services, the target, third parties or the public.

Scan Results are point-in-time external observations based on the information and network responses available when the Scan runs.

Scan Results may be incomplete, delayed, unavailable or inaccurate.

Possible causes include:

• incomplete public DNS or certificate information
• firewalls, web application firewalls and content delivery networks
• rate limiting or blocked scanner traffic
• temporary outages or timeouts
• assets changing during or after a Scan
• hidden origin infrastructure
• incomplete technology or version detection
• scan-type and asset-selection limits
• unavailable third-party data providers
• encrypted, authenticated or internally visible functionality
• false positives
• false negatives

A passed check means only that the tested condition passed at the time and within the scope of that check.

A hostname being discovered does not mean that every module assessed it.

An asset marked Not assessed, Not probed, Blocked, Error, Skipped or Inconclusive must not be treated as secure.

Scores, grades, severity levels, confidence labels and recommendations are prioritisation tools. They do not constitute a guarantee, certification or complete statement of risk.

EightScope is not a substitute for professional penetration testing, internal vulnerability management, source-code review, legal advice, compliance advice, incident response or risk assessment using the Customer’s business context.

You are responsible for validating important findings before making disruptive changes or relying on them for business decisions.

You are responsible for maintaining the confidentiality and security of your Account credentials.

You must use reasonable steps to prevent unauthorised access, including using a strong unique password and any available multi-factor authentication.

You must notify EightScope promptly if you suspect that an Account, credential or Organisation has been compromised.

You are responsible for activity performed through your Account until you notify EightScope of suspected unauthorised access, except to the extent the activity was caused by EightScope’s own breach of these Terms or applicable law.

EightScope may require password resets, session termination or other reasonable security measures where misuse or compromise is suspected.

As between the parties, the Customer retains its rights in Customer Data and Scan Results relating to its Domains.

The Customer grants EightScope a limited, non-exclusive right to host, process, copy, transmit and analyse Customer Data only as reasonably required to provide, secure, maintain and improve the Services, comply with law and enforce these Terms.

This permission ends when the relevant data is deleted, except where continued retention is required by law, legitimate security records or routine backup processes.

You confirm that you have the right to provide Customer Data to EightScope and allow it to be processed for these purposes.

You may use and share your Scan Results for internal business, security, insurance, procurement, client-service or remediation purposes.

Managed service providers may provide relevant reports to clients they are authorised to represent.

You must not alter a report in a way that materially misrepresents the original result, scan scope, date, limitations or source.

EightScope handles personal information in accordance with its Privacy Policy and applicable privacy law.

You must review the Privacy Policy before using the Services.

Where you provide personal information about another person, you confirm that you are authorised to provide it and have given any notices required by law.

The Privacy Policy, rather than these Terms, contains the detailed description of how personal information is collected, used, disclosed, stored and accessed.

Current plans, prices, billing intervals, included features and usage allowances are displayed before purchase and in the dashboard. See also the public plans page.

Unless stated otherwise at checkout, prices are shown in Australian dollars. Applicable taxes and the total amount charged will be shown through the checkout process.

Payments are processed through the payment provider made available by EightScope. EightScope does not require customers to provide payment-card details directly to the application where payment is handled by that provider.

Paid plans may use monthly scan credits. Different scan types and optional add-ons may consume different numbers of credits.

The applicable credit cost is shown in the interface before a manual Scan begins.

Included monthly scan credits and free-scan allowances reset on the first day of each calendar month in Coordinated Universal Time, as reflected by the current platform implementation.

Unused included monthly credits do not accumulate into later monthly periods unless EightScope expressly states otherwise.

Promotional or bonus credits may have separate conditions and expiry dates.

Credits are not money, are not transferable between Organisations and cannot be exchanged for cash.

A Scan may reserve credits when it starts. Credits are generally restored where the platform cancels or fails the Scan before producing a billable result.

A Scan that completes but produces limited, blocked, skipped or inconclusive checks may still consume credits because scanning work was performed.

Scheduled monitoring scans do not consume the Customer’s manual monthly scan credits under the current product configuration. EightScope will give reasonable notice before materially changing this treatment for an existing paid Subscription.

Paid Subscriptions are billed monthly or annually, depending on the option selected at checkout.

A paid Subscription renews automatically at the end of each Subscription Period unless it is cancelled before the renewal date.

By purchasing a Subscription, you authorise the payment provider to charge the applicable recurring fees using the payment method associated with the billing account.

Organisation owners and administrators can manage billing through the dashboard or payment-provider portal.

Cancellation or a move to the Free plan takes effect at the end of the current paid Subscription Period unless Australian law requires an earlier remedy.

The Customer normally retains the current paid plan’s features and credits until the effective cancellation or downgrade date.

A downgrade to another paid plan normally takes effect at the next renewal date. The dashboard or checkout flow will display the effective timing before confirmation.

The treatment of upgrades, billing adjustments and any prorated charges will be shown before the Customer confirms the change.

Deleting an Account cancels any active paid Stripe subscription for that organisation so future renewals stop. Deletion does not automatically create a refund for charges already processed for the current Subscription Period, except where Australian Consumer Law requires otherwise.

The Customer is responsible for cancelling before renewal where it does not want the Subscription to continue and prefers to keep the account open on the Free plan.

EightScope may send renewal, billing or cancellation notices, but failure to receive a reminder does not by itself cancel an otherwise valid renewal.

Nothing in these Terms excludes, restricts or modifies any consumer guarantee, right or remedy that cannot lawfully be excluded, including rights that may apply under the Australian Consumer Law.

Where the Australian Consumer Law applies, services come with guarantees that may include that they will be provided with due care and skill, be reasonably fit for a disclosed purpose and be supplied within a reasonable time where no time is agreed.

Refunds, credits, resupply or other remedies will be provided where required by applicable law.

Except where required by law or expressly stated at checkout, EightScope is not required to provide a refund merely because the Customer changes its mind, does not use the Services, uses fewer credits than available or cancels after a renewal charge has been processed.

To request review of a billing problem or claimed service failure, contact support with the Organisation, charge date and relevant details.

This section takes priority over any other clause that would otherwise limit a right that cannot lawfully be excluded.

EightScope may provide Free plans, trials, beta features, previews, promotional access or bonus credits.

These offerings may have additional limits and may be modified or withdrawn on reasonable notice.

Beta and preview features may be incomplete, experimental or changed before general release.

EightScope will not use this clause to remove rights that cannot legally be excluded or to retrospectively charge for a free feature without the Customer’s agreement.

Promotional access has no cash value and may be subject to an expiry date or eligibility requirements disclosed when it is offered.

The Services may rely on or interact with third-party services, including payment processors, cloud infrastructure, DNS providers, certificate-transparency sources, security-data providers and email-delivery services.

Third-party services may have their own terms, privacy practices, rate limits and availability.

EightScope does not control every third-party service and cannot guarantee its continued availability or accuracy.

Where a third-party integration is unavailable, a related check may be marked unavailable, skipped, incomplete or not assessed rather than passed.

To the extent permitted by law, EightScope is not responsible for a failure caused solely by a third-party service outside EightScope’s reasonable control. This does not remove any responsibility that cannot lawfully be excluded.

EightScope aims to make the Services reasonably available but does not promise uninterrupted, error-free or continuous operation.

Availability may be affected by maintenance, upgrades, security work, outages, internet conditions, third-party providers, malicious activity or events outside reasonable control.

EightScope may perform scheduled or emergency maintenance.

Where reasonably practical, EightScope will provide notice of planned changes expected to cause material interruption.

No contractual service-level agreement for uptime percentages or guaranteed support response times applies unless it is contained in a separate written agreement signed by EightScope.

Published best-effort support targets (including Business plan response aims) are described in the Trust Centre. Those targets are operational goals, not an SLA.

EightScope may improve, modify or discontinue parts of the Services as the product, technology, security requirements and law change.

For a material change that is reasonably likely to reduce a paid Customer’s core contracted functionality during its current Subscription Period, EightScope will provide reasonable notice where practicable.

Where a material adverse change is not required for legal, security or operational emergency reasons, a paid Customer may cancel before the change takes effect.

Price changes will not apply retrospectively. A change to recurring Subscription pricing will apply no earlier than the next renewal after reasonable notice, unless the Customer expressly agrees otherwise.

EightScope may update these Terms.

Material changes will be notified through the website, dashboard or account email before they take effect, where reasonably practicable.

Changes required urgently to comply with law, respond to abuse or address a serious security issue may take effect sooner.

Continued use after updated Terms take effect constitutes acceptance of the updated Terms. If you do not agree, you must stop using the Services and cancel any future renewal.

An update does not remove rights or remedies that arose before the update.

The Customer may stop using the Services at any time and may cancel a paid Subscription in accordance with section 13.

EightScope may suspend an Account, Organisation, Domain or Scan where reasonably necessary to:

• prevent unauthorised or unlawful scanning
• protect a target or third party from likely harm
• respond to suspected account compromise
• investigate a serious breach of these Terms
• address non-payment
• comply with law, court order or regulatory requirement
• protect the security, integrity or availability of the Services
• respond to conduct that creates unreasonable operational or legal risk

Where the issue can reasonably be corrected and immediate suspension is not necessary, EightScope will attempt to provide notice and a reasonable opportunity to remedy it.

EightScope may terminate these Terms for a material breach that is not remedied within a reasonable period after notice.

Immediate termination may occur for deliberate unauthorised scanning, unlawful activity, fraud, serious security abuse or conduct likely to cause material harm.

EightScope may discontinue the entire Services by giving reasonable notice. Paid Customers will receive any remedy required by law and, where appropriate, a proportionate refund for prepaid service that will not be supplied.

When an Account or Subscription ends, access to some Customer Data, reports, history and paid features may stop.

Customers should download any reports or records they require before termination.

EightScope may retain or delete Customer Data in accordance with the Privacy Policy, applicable law, legitimate security and fraud-prevention requirements and routine backup processes.

Termination does not require EightScope to retain Customer Data indefinitely.

Any request to access or delete personal information will be handled under the Privacy Policy and applicable law.

EightScope and its licensors retain all rights in the Services, software, scanning methods, user interface, Documentation, report templates, branding and underlying technology.

Subject to these Terms and the applicable plan, EightScope grants the Customer a limited, non-exclusive, non-transferable and revocable right to access and use the Services during the term of the Account or Subscription.

This licence does not transfer ownership of the Services to the Customer.

The Customer retains its rights in Customer Data and in the factual Scan Results relating to its authorised assets.

EightScope may use general feedback and suggestions provided by the Customer without restriction, provided it does not identify the Customer or disclose its confidential information.

EightScope may use aggregated and de-identified information to operate, secure, analyse and improve the Services, provided that the information does not reasonably identify the Customer, its users or its specific Domains.

EightScope and related names, logos and marks may not be used without written permission except for truthful attribution of an unaltered report.

Each party may receive non-public information from the other that a reasonable person would understand to be confidential.

Confidential information may include non-public Scan Results, security evidence, credentials, business information, technical material and pricing agreed outside public plans.

The receiving party must:

• use confidential information only for performing or receiving the Services
• protect it using reasonable care
• disclose it only to personnel and service providers who need it and are subject to appropriate obligations
• not disclose it to another person without permission, except where legally required

Confidential information does not include information that is public through no breach, was already lawfully known, is independently developed or is lawfully received from another source without confidentiality restrictions.

A party legally required to disclose confidential information will, where lawful and reasonably practicable, notify the other party before disclosure.

Nothing in these Terms excludes or limits liability or rights that cannot lawfully be excluded or limited.

Where a guarantee under the Australian Consumer Law applies and liability may lawfully be limited, EightScope’s liability is limited, at EightScope’s option, to supplying the affected services again or paying the reasonable cost of having the affected services supplied again.

This limitation does not apply where that form of limitation is not permitted by law.

To the maximum extent permitted by law, neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, goodwill or business opportunity, except where such loss cannot lawfully be excluded.

The exclusions in this section do not apply to fraud, wilful misconduct, death or personal injury caused by negligence where liability cannot be excluded, payment obligations, infringement of the other party’s intellectual-property rights, breach of confidentiality, or liability that applicable law does not permit to be limited.

EightScope is not responsible for a security incident merely because the Services did not identify or predict it. This does not exclude responsibility for a failure by EightScope to meet an obligation that cannot lawfully be excluded.

The Customer indemnifies EightScope against a third-party claim, loss or reasonable external legal cost arising directly from:

• the Customer knowingly scanning a system without authorisation
• unlawful or malicious use of the Services
• Customer Data that infringes a third party’s rights
• the Customer’s deliberate misuse of Scan Results to compromise or harm another system
• a material breach of section 5 or section 6

The indemnity does not apply to the extent the claim was caused or increased by EightScope’s breach, negligence, wilful misconduct or failure to take reasonable steps to reduce the loss.

EightScope must give the Customer reasonable notice of an indemnified claim, permit the Customer to participate in its defence and take reasonable steps to mitigate loss.

The Customer must not settle a claim in a way that admits wrongdoing by EightScope or imposes an obligation on EightScope without EightScope’s written consent, which must not be unreasonably withheld.

A party that believes a dispute has arisen should first provide written notice describing the issue and the outcome sought.

The parties will attempt in good faith to resolve the dispute through direct discussion.

If the dispute is not resolved within 30 days, either party may propose mediation through an agreed Australian mediator.

Nothing in this section prevents either party from seeking urgent injunctive relief, exercising a statutory right, making a complaint to a regulator or consumer-protection body, or commencing proceedings where delay could cause material harm.

Consumers retain any right to pursue remedies through an applicable tribunal, court or consumer-protection process.

These Terms are governed by the applicable laws of Australia. Any mandatory rights to bring a claim in a competent court, tribunal or consumer-protection forum are preserved.

Entire agreement

These Terms, the applicable plan information and any separate written agreement between the parties form the agreement concerning the Services.

A separate signed agreement prevails to the extent of an express inconsistency.

Order of priority

1. a separately signed agreement
2. applicable order form or checkout terms
3. these Terms
4. Documentation

The Privacy Policy governs personal-information handling. The Methodology page explains technical scan scope but does not override these Terms.

Assignment

The Customer must not assign these Terms without EightScope’s written consent, which must not be unreasonably withheld.

EightScope may assign these Terms as part of a corporate restructure, financing, merger or sale of all or substantially all of the relevant business, provided the assignment does not materially reduce the Customer’s rights.

Force majeure

Neither party is responsible for delay caused by events outside its reasonable control, except that this does not excuse payment obligations already due.

Severability

If a provision is invalid or unenforceable, it will be read down to the minimum extent necessary. If it cannot be read down, it will be severed and the remaining provisions continue.

Waiver

A failure or delay in enforcing a right is not a waiver of that right.

No partnership or agency

These Terms do not create a partnership, employment relationship, joint venture or agency relationship between the parties.

Notices

EightScope may send notices to the email associated with the Account, through the dashboard or by publishing a prominent notice where appropriate.

The Customer may send legal or contractual notices to the support email stated in the Contact section.

Survival

Provisions concerning accrued payment obligations, intellectual property, confidentiality, liability, indemnities, dispute resolution and governing law continue after termination where their nature requires it.

Legal entity

Heuristic Group Pty Ltd
ABN 37 700 907 080

Support and legal enquiries

support@eightscope.au

Please do not send passwords, private keys, API tokens or other security credentials by email.