Terms of Service

1. Authority to scan (this one matters)

Under the Computer Misuse Act 1990, running security checks against infrastructure you do not own or have permission to test can constitute a criminal offence. Our checks are non-invasive — we do not exploit vulnerabilities, attempt to authenticate, or place any meaningful load on your systems — but some of them do make ordinary outbound connections to the domain you submit, so the responsibility for authorisation sits with you.

You warrant that, for every domain you submit to us:

• you own it or the organisation you represent owns it; or
• you hold explicit authority from its owner to commission security testing, and you are authorised to give us that permission on the owner’s behalf.

You authorise us to carry out the following against domains you submit:

• Public DNS lookups — MX, SPF, DKIM selector and DMARC records, which read public directory data and never contact your servers.
• Retrieval of publicly served web pages and response headers — the same request any visitor’s browser makes.
• Inspection of the SSL/TLS certificate presented on port 443 — a standard handshake, identical to one performed by every browser that visits you.
• Connection checks against common service ports (80, 443, 8080, 21, 22 and 3389) — we open a TCP connection to see whether the port answers, then close it immediately. Nothing is sent, and no credentials are offered.
• Certificate Transparency log searches to identify subdomains — these read a public, third-party certificate register and do not contact your infrastructure at all.
• Checks for publicly readable cloud storage whose names are derived from your domain — a plain unauthenticated request to the storage provider’s public endpoint, exactly as a browser would make.
• Lookups against third-party breach databases for addresses associated with your domain.

We do not attempt to exploit any vulnerability, bypass any control, log in to anything, submit any form, or access any non-public content. We do not perform penetration testing, and nothing we do is designed to affect the availability or integrity of your systems.

You must not submit a domain you are not authorised to submit. You are responsible for any claim arising from a breach of this warranty, and we may suspend or terminate your account immediately if we believe it has been breached.

2. What our services are — and are not

We provide a point-in-time assessment and advisory service. We identify gaps that are visible to us using the methods described above, and we recommend remediation. We do not provide a guarantee that your systems are secure, and no assessment can establish that.

Specifically, we do not warrant that:

• your systems are free of vulnerabilities, malware or unauthorised access;
• you will not suffer a cyber attack, ransomware incident or data breach;
• any insurer will offer, renew or pay out on a policy; or
• any certification body will award you a certification.

A scan reflects what was publicly observable at the time it ran. Your risk profile changes as your infrastructure, staff and the threat landscape change.

3. We are not a certification body or an insurance intermediary

40and4 Security Solutions is an independent technical advisory firm. We are not affiliated with, endorsed by, or acting on behalf of IASME, the NCSC, or any insurer or underwriter.

Our Cyber Insurance Readiness Audit prepares you for assessment by others. Cyber Essentials and Cyber Essentials Plus certification is awarded solely at the discretion of IASME and its accredited certification bodies. Insurance cover, its terms, its price, and the outcome of any claim are determined solely by the insurer or underwriter concerned.

We do not provide regulated financial advice and we are not authorised by the Financial Conduct Authority. Nothing we provide is a recommendation to buy a particular insurance product. We do not provide legal advice.

4. Your responsibilities

• Give us accurate and complete information about your network, systems, policies and staff during discovery. Our findings and recommendations depend on it, and we are not responsible for conclusions drawn from information you gave us that was inaccurate or incomplete.
• Keep your account credentials secure and tell us promptly if you suspect unauthorised access.
• Decide for yourself whether to act on our recommendations, and implement them. We advise; we do not control your systems.
• Use a business email address. Accounts registered with free consumer email providers may be refused.
• Do not attempt to disrupt, overload or circumvent the rate limits on our service, resell scans, or use the service to assess domains for third parties without their authority.

5. Fees and cancellation

The domain exposure scan is free and limited to two scans per business account per rolling 30-day period. The Cyber Insurance Readiness Audit is £200, charged once. Continuous Security and Staff Phishing Training is £150 per month and continues until cancelled with [NOTICE PERIOD] notice.

Prices exclude VAT unless stated. Where you are a consumer or, in some cases, a sole trader contracting away from our business premises, you may have a statutory right to cancel within 14 days under the Consumer Contracts Regulations 2013; where you ask us to begin work within that period you may be charged for work already performed.

6. Intellectual property

All materials we produce or provide — audit frameworks and methodologies, report templates, training decks, PDF guides, phishing simulation templates, and the software behind this website — remain our intellectual property or that of our licensors.

On payment, we grant you a non-exclusive, non-transferable licence to use the deliverables prepared for you internally within your organisation, including sharing them with your broker, insurer or auditor for the purpose they were prepared for. You may not resell them, publish them, or use them to provide services to third parties.

The factual findings about your own infrastructure belong to you. We may use aggregated, anonymised data about scan results to improve our service and produce statistics, in a form that does not identify you.

7. Limitation of liability

Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded.

Subject to that:

• our total aggregate liability arising out of or in connection with a service is limited to the total fees you paid us for that service in the 12 months before the claim arose (so, for a one-off audit, £200);
• we are not liable for losses caused by cyber attacks, ransomware, malware, social engineering, previously unknown (“zero-day”) vulnerabilities, or the acts of third parties;
• we are not liable for an insurer’s decision to decline cover, decline or reduce a claim, or set a particular premium, nor for a certification body’s decision to withhold certification; and
• we are not liable for loss of profit, revenue, business, contracts, goodwill or anticipated savings, or for indirect or consequential loss.

We strongly recommend you hold your own cyber insurance. Our services are not a substitute for it. If you are dealing with us as a consumer, your statutory rights are unaffected.

8. Confidentiality and data

We treat findings about your infrastructure as confidential and will not disclose them except as needed to deliver the service, where you ask us to, or where the law requires. Our handling of personal data is described in our Privacy Policy.

9. Suspension, termination and changes

We may suspend or terminate access for breach of these terms, in particular a breach of the authority warranty in section 1. You may close your account at any time. We may update these terms; material changes will be notified and the version number above will change, and continuing to use the service after that constitutes acceptance.

10. Governing law

These terms and any dispute arising from them are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.