Acceptable Use Policy

Part of the Terms of Service. Effective 10 October 2026.

Kavach exists to help website owners secure their own sites. It only ever makes ordinary, read-only requests. This policy sets the rules that keep it that way.

1. Authorisation

You may scan, monitor, report on, guard or publish a Trust Passport for a website or domain only if you own it or hold the express authorisation of its owner. Agencies and consultants must hold that authorisation from each client before adding the client’s domains. Keep evidence of authorisation; we may ask for it.

2. Prohibited conduct

You must not, and must not help anyone else to:

• scan, monitor or publish results for any website you are not authorised to test;
• use any Result to attack, extort, defame, harass, discredit or gain advantage over a third party, or publish a third party’s grade, findings or evidence without their consent;
• attempt to make the Service reach internal, private, loopback, link-local or cloud-metadata addresses, non-web ports, or any system other than the public website you submitted;
• circumvent, probe or overload rate limits, ownership verification, safety guards, billing or plan limits, or interfere with the Service’s operation or other users;
• submit targets on behalf of, or share an account or API key with, anyone not bound by these rules; or create accounts by automated means;
• scrape, resell, republish or white-label Results except as your Plan permits;
• publish a Trust Passport, badge or report for a domain you have not verified, or represent a Result as a certification, audit or guarantee;
• use the Service in violation of the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, or any other applicable law.

3. Operators of scanned sites

Every request Kavach makes carries the User-Agent KavachScanner with a link to this policy and the contact abuse@kavachscan.com. If you operate a website and do not wish it to be scanned by anonymous users, email us and we will block Public Scans of your domain; verified owners always retain control of their own domains.

4. Enforcement

We may refuse or throttle scans, remove Passports or badges, suspend or terminate accounts, and preserve and disclose relevant records to law-enforcement or affected parties where we reasonably believe this policy has been breached or the law requires it. Report abuse to abuse@kavachscan.com.