Citadel Cyber Terms of Service

Effective date: [EFFECTIVE DATE]
Terms version: [TERMS VERSION, e.g. 2026-10-v1]

These Terms of Service ("Terms") are an agreement between you and Citadel Cyber LLC, a Utah limited liability company, doing business as Citadel Cyber ("Citadel Cyber," "we," "us," or "our"). They cover your use of our website at citadelcyber.dev, our Free Scan, our paid audits and subscriptions, and any reports we deliver (together, the "Services").

By ticking the consent box on our scan form, buying a Service, or otherwise using the Services, you agree to these Terms. If you're accepting them for a company or another organization, you confirm that you have authority to bind it, and "you" means that organization.

1. What we do

Citadel Cyber provides automated, model-assisted security assessments and monitoring for web apps, especially apps built with AI coding tools and backends like Supabase and Firebase. Our Services are not a penetration-test certificate, a compliance attestation (for example, SOC 2 or PCI ASV), or a guarantee of security. Where you need one of those, we may refer you to a certified firm.

2. Services and plans

Annual plans cost 10 times the monthly price, which works out to 2 months free. Each plan's limits (apps, sites, and features) are the ones in the table above or on our pricing page when you buy. We may update features for future purchases. If a change reduces what you've already paid for, it won't apply until your next renewal.

Founding price. Founding price for our first 10 Launch Audits or 60 days after checkout opens, whichever comes first. During that time the Launch Audit costs $119; after it ends, the Launch Audit costs $249. Code Audits don't count toward the 10 and aren't offered at a founding price. The founding price applies only to the audit you buy at that price and isn't locked in for future purchases.

Audit credit toward annual Guard. The full fee you paid for either audit (Launch Audit or Code Audit) is credited toward an annual Guard plan bought within 14 days of report delivery. The credit is for the amount you actually paid, can be used once, and works only on an annual Guard plan (not monthly Guard, Pro, or Agency). When we deliver your report, we email you a single-use code worth the full audit fee you paid. The code works only on an annual Guard plan and expires 14 days after delivery. The checkout link in that email can apply it for you automatically.

Re-tests. Each Launch Audit and Code Audit includes one re-test of the original findings after you've made fixes. You must request it within [RE-TEST WINDOW, e.g. 30 days of report delivery].

Free trials. We don't offer free trials on any plan. The Free Scan is how you can try the Service before buying.

Promotions. Apart from the founding price and the audit credit above, we may sometimes offer other promotions. Each promotion has its own terms, which we'll state when we offer it.

3. Authorization comes first

We only test assets that their owner has authorized. This is the most important rule in these Terms.

3.1 Ownership verification (all Services, including the Free Scan). We won't send any scan traffic to a site until you prove you control its domain in one of these ways:

• DNS TXT record: add a TXT record at _citadel-verify.<your-host> that contains the token we give you; or
• HTML meta tag: add <meta name="citadel-verify" content="<token>"> to the <head> of the root page of the exact hostname being verified. A tag anywhere else on the page doesn't count.

Verification tokens are single-use, tied to one host and one email address, and expire after 72 hours. A verified host stays verified for 30 days for the same email address. Subdomains on shared hosting (for example *.lovable.app, *.vercel.app, or *.netlify.app) can only be verified on that exact subdomain.

3.2 Passive by default. The Free Scan and the default stage of every paid Service are passive. That means we only make requests a normal browser visitor could make, at low volume. Examples are reading security headers, TLS settings, cookies, public DNS and email-authentication records, the JavaScript your site serves, and a small, fixed list of well-known public paths (for example robots.txt, /.well-known/security.txt, and common accidental exposures like /.env and /.git/HEAD). We check these paths only after you've verified ownership, make one request per path, and record only whether the file exists and a redacted match pattern. We never store its contents. Each Free Scan is capped at a small number of requests. We identify our scanner with its own User-Agent and publish opt-out instructions at citadelcyber.dev/scanner.

3.3 Active testing only with a signed Scope Authorization. Anything beyond passive observation requires a Security Assessment Authorization & Scope Agreement ("Scope Authorization") signed by you and by us. That includes authenticated testing with test accounts, reading data through your APIs (for example, checking whether Row-Level Security actually works), source code review, and rate-limited active vulnerability scanning. The Scope Authorization lists the in-scope assets, the testing window, the permitted methods, and emergency contacts. If it conflicts with these Terms about how an engagement is tested, the Scope Authorization controls. No signed Scope Authorization means no active testing, without exception. Paying for a Service doesn't replace the Scope Authorization, and neither does ticking an authorization box at checkout.

3.4 Things we never do. We never perform denial-of-service testing, phishing or social engineering of your staff, physical testing, or destructive actions. We never access or copy real user data beyond the minimum needed to prove a finding. Wherever we can, we use test accounts with no real user data.

3.5 Stopping on critical findings. During paid testing, if we find a critical issue or any sign of a past compromise, we'll pause and notify your emergency contact right away.

3.6 Health data. We don't currently accept apps that handle health data, including protected health information (PHI). Our intake form asks whether your app stores or processes health data, and if you answer yes, we decline with this message: "We don't currently accept apps that handle health data." If your app handles health data, please don't submit it. If we learn that a submitted app handles health data, we'll stop work and decline the engagement, and any audit fee is refunded under Section 8.4 if work hasn't started.

3.7 Recurring authorization (Guard, Pro, and Agency). For subscriptions, your authorization covers the assets listed in your Scope Authorization (including its recurring-authorization addendum) for as long as the subscription runs. You can revoke it in writing at any time, and we'll stop scanning within [1 BUSINESS DAY, PENDING KAINOA]. Every new asset must be verified before we scan it, and scheduled scans run only while the asset's verification is less than 30 days old and your signed scope covers recurring scans.

3.8 Agencies. Each client site an Agency submits must be verified on its own. The Agency must also sign a statement that it has written permission from that client to have the site tested, keep that permission on file, and show it to us within [5 BUSINESS DAYS, PENDING KAINOA] if we ask.

4. Your warranties

Each time you submit a site, sign a Scope Authorization, or buy a Service, you confirm that:

1. you own each submitted domain, app, repository, and environment, or you're legally authorized to permit security testing of it;
2. you have any permission needed from third parties, such as your hosting provider, platform, or (for Agency plans) each end client whose site you submit, and you'll show us written proof if we ask;
3. the person who completes verification or signs for you has authority to do so;
4. the information you give us, including scope, contacts, and whether your app handles health data or card data, is accurate and complete; and
5. you'll tell us right away if your authority over any in-scope asset changes or ends, and stop submitting that asset.

If any of these statements turns out to be false, we may stop work immediately, and you're responsible for any resulting claims as described in Section 10.

5. Acceptable use and abuse

You agree not to:

• submit, or try to get us to scan, any site, app, or system you don't own or aren't authorized to test;
• get around ownership verification, rate limits, CAPTCHAs, denylists, or other abuse controls, including by using multiple emails, IP addresses, or accounts;
• use the Services or reports to attack, extort, harass, or embarrass anyone, or to publish someone else's vulnerabilities;
• use the Services to scan government systems, healthcare portals, banks, or major platforms that you don't control;
• resell, white-label, or redistribute reports or Services, except as your Agency plan allows for your own authorized clients;
• reverse-engineer, overload, or interfere with the Services; or
• use the Services in violation of any law, including computer misuse laws such as the U.S. Computer Fraud and Abuse Act.

We may refuse, rate-limit, pause, or cancel any scan or account at our discretion. Examples include patterns that suggest scanning of unrelated sites and repeated failed verifications, which can trigger an automatic block. We keep an audit log of scan activity so we can investigate abuse and resolve disputes. We may share relevant records with an affected site owner or with law enforcement where the law allows or requires it.

Site owners who didn't ask for a scan: see citadelcyber.dev/scanner to block our scanner or opt out, or contact hello@citadelcyber.dev.

6. No guarantee

Security testing reflects a single point in time and is limited by scope and method. We don't guarantee that we'll find every vulnerability, that your app is secure, or that it won't be breached. Free Scan results are a passive teaser. They can't confirm issues that need authorized testing, and those are labeled "Likely" until a paid audit confirms them. Findings may include false positives. We have a person review critical and high findings in paid reports before delivery. Applying fixes and protecting your systems are your responsibility. Fix prompts for AI coding tools are suggestions, so review them before you use them.

7. Confidentiality of reports

Your reports, findings, and any data we come across while testing are your confidential information. We use them only to deliver the Services to you. We send reports only to the verified or contracted contact. Free Scan report links are unguessable and expire after 30 days. We don't publish your findings or use your name as a case study without your written permission. We may use anonymized, aggregated statistics that can't identify you or your site.

You may share your report however you like. If you share it, you're responsible for that disclosure. Agency customers may share white-label reports with their own authorized clients.

We may disclose confidential information if the law requires us to. Where the law allows, we'll tell you first. How we store and delete data is covered in our Privacy Policy and in your Scope Authorization.

8. Payments, refunds, and cancellation

8.1 Merchant of record. Payments are processed by Lemon Squeezy, which acts as the merchant of record. Lemon Squeezy charges your payment method, calculates and collects any sales tax or VAT, and issues your receipts and invoices. Its own terms and privacy policy also apply to your purchase. We never see or store your full card details. Prices are in USD. [IF LEMON SQUEEZY REJECTS ONE-TIME AUDITS, THEY MOVE TO STRIPE. UPDATE 8.1, 8.4, AND THE PRIVACY PROCESSOR LIST THEN.]

8.2 Subscriptions. Guard, Pro, and Agency renew automatically at the end of each monthly or annual billing period until you cancel. You can cancel at any time through your Lemon Squeezy customer portal or by contacting us. Cancellation stops the next renewal, and your plan stays active until the end of the period you've already paid for. [CONFIRM: ARE SUBSCRIPTION FEES REFUNDABLE FOR PARTIAL PERIODS? The source files don't say. The draft assumes no prorated refunds.] If a payment fails, we may pause monitoring until the payment succeeds.

8.3 Plan limits. There are no overage charges. If you go over your plan's limits (for example, more apps or sites than the plan includes), we'll ask you to move up to the tier that fits. We may pause scans of anything over the limit until you upgrade.

8.4 Audit refund policy. For the Launch Audit and Code Audit:

• Audits are fully refundable before work starts.
• Audits are not refundable once the report is delivered.
• One free re-test is included.

"Work starts" at the start of the agreed testing window or our first active test, whichever comes first. [PENDING KAINOA: WHAT REFUND APPLIES IF YOU CANCEL AFTER WORK STARTS BUT BEFORE THE REPORT IS DELIVERED.]

To request a refund, contact billing@citadelcyber.dev. Approved refunds are issued through Lemon Squeezy to your original payment method.

8.5 Price changes. We may change prices for new purchases. For subscriptions, we'll give you at least [NOTICE PERIOD, e.g. 30 days] notice before a new price applies to your next renewal.

9. Limitation of liability

To the fullest extent the law allows:

• Cap. Our total liability for all claims relating to the Services is limited to the fees you paid us for the Service the claim relates to. For subscriptions, that means the fees you paid in the [LIABILITY LOOKBACK PERIOD, e.g. 12 months] before the claim. For the Free Scan, our liability is limited to [FREE SCAN CAP, e.g. US$100].
• No indirect damages. We aren't liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill. That includes losses from a breach or vulnerability we didn't find.
• As-is. Except as these Terms expressly say otherwise, the Services are provided "as is" and "as available," without warranties of merchantability, fitness for a particular purpose, or non-infringement.

Some places don't allow some of these limits, so they may not all apply to you.

10. Indemnity

You'll defend and indemnify us against third-party claims arising from (a) testing you requested of assets you weren't authorized to submit, (b) a breach of your warranties in Section 4 or the acceptable-use rules in Section 5, or (c) your use of our reports or recommendations.

11. Intellectual property

We own the Services, our scanner, our findings library, our report templates, and our methods. Once you've paid in full, you may use your report and its fix guidance for your own internal purposes, and Agency customers may also share it with their authorized clients. You keep all rights to your apps, code, and data.

12. Termination

You can stop using the Services at any time. We may suspend or end your access if you break these Terms, if we can't verify your authorization, or if continuing would create legal or safety risk. Sections 4 through 7 and 9 through 14 survive termination.

13. Governing law and disputes

These Terms are governed by the laws of the State of Utah, without regard to its conflict-of-laws rules. Disputes will be resolved in the state or federal courts located in [COUNTY], Utah [OR: BY ARBITRATION]. [ATTORNEY TO CONFIRM UTAH LAW AND THE DISPUTE FORUM.]

14. Changes to these Terms

We may update these Terms. The version and effective date at the top show which version is current. For material changes, we'll give at least [NOTICE PERIOD] notice by email or on our site. A change doesn't apply to an engagement already covered by a signed Scope Authorization unless you agree. Continuing to use the Services after a change takes effect means you accept it.

15. General

These Terms, any signed Scope Authorization, and our Privacy Policy make up the entire agreement between us. If any part of these Terms is unenforceable, the rest still applies. You may not transfer these Terms without our consent. Not enforcing a provision isn't a waiver of it.

16. Contact

Citadel Cyber LLC, a Utah limited liability company
1141 W 650 N, Provo, UT 84601
Email: hello@citadelcyber.dev (billing questions: billing@citadelcyber.dev)
Security, abuse, and scanner opt-out: security@citadelcyber.dev · citadelcyber.dev/scanner