Simple, honest pricing.

FAQ

How is “AI scan” different from a free scan?

A free scan runs our passive engine (subdomain enumeration, HTTP probing, web crawling, nuclei signature templates) and gives you severity counts. An AI scan adds: a security-engineer LLM that reasons over the crawl + signature output to surface non-obvious issues (chained risks, business-logic gaps, design flaws), then a second AI reviewer that probes each finding to confirm or refute it. Pro+ shows you the AI’s findings, the evidence behind each, and a deployable remediation.

Can I scan a domain I don’t own?

No. Every target must be verified via DNS TXT record, HTML file upload, or HTML meta tag before any active scan runs. This is required by our Terms of Service and by U.S. + EU computer-crime laws.

Are scans destructive?

Never. Our engine only reads. Nuclei is configured without intrusive templates. The AI never auto-submits exploits — it generates remediation suggestions only. You can also whitelist our scanner IPs at your WAF so the scan looks like normal traffic.

What’s a target?

One hostname (e.g. app.example.com). A separate subdomain counts as a separate target. Free + Pro give you 1 target; Pro Max scales to 10. Need more? Email [email protected] — enterprise tiers start at 50 targets.

Can I cancel anytime?

Yes. Monthly cancels at the end of the current month. Annual cancels at the end of the current year (no pro-rating, but see our 14-day refund policy). No paperwork, no “retention specialist” phone calls.

Do you offer annual discounts?

Yes — 30% off when you pay annually. Toggle the billing period at the top of this page to see the rates.

How fast is a scan?

Free passive scan: 1–3 minutes for most sites. Pro AI scan: 3–10 minutes total (discovery + scanning + AI analysis + validation). Daily auto-rescans run overnight and don’t affect your monthly quota.

Where is my data stored?

EU-resident infrastructure by default (Hetzner Falkenstein). Sub-processors (Stripe, Resend, Alias Robotics) may process data in their own regions — see our Privacy Policy for the full list and EU↔US transfer mechanisms.

Do you have an enterprise tier?

Yes — custom pricing for 50+ targets, SSO/SAML, custom SLAs, dedicated support, and DPA. Email [email protected] with your use case.

What if the AI is wrong?

Every finding goes through a second-pass validator that probes the live target and judges whether the evidence actually supports the finding. Refuted findings are dropped before you ever see them. Even so, AI outputs aren’t infallible — always verify before acting on critical remediations.