Terms of Service

Version 2026-10-10-r2. Effective 10 October 2026.

These Terms of Service (“Terms”) are a binding agreement between you (“you”, “Customer”) and Support IT Ventures, Mumbai, Maharashtra, India (“Kavach”, “we”, “us”), the operator of the Kavach service at https://kavachscan.com (the “Service”). By creating an account, submitting a website for scanning, using the API, CLI or GitHub Action, or otherwise using the Service, you accept these Terms. If you use the Service on behalf of an organisation, you represent that you are authorised to bind that organisation, and “you” includes it.

1. Definitions

• Scan — an automated, read-only observation of publicly reachable configuration of a website or domain (for example HTTP response headers, TLS certificates, DNS records and the origins of externally loaded scripts).
• Public Scan — a conservative scan available without proving ownership of the target. Verified Scan — an expanded scan available only after you prove ownership of the domain through the verification methods we provide.
• Results — grades, scores, findings, evidence manifests, reports, badges, Trust Passports and remediation guidance produced by the Service.
• Plan — the Free plan or a paid subscription plan published at https://kavachscan.com.

2. The Service

Kavach provides automated technical observations about publicly reachable website configuration, plain-language explanations, generic remediation guidance, downloadable reports, badges, an optional public Trust Passport page, scheduled re-scans with alerts, and related developer tooling (API, CLI, GitHub Action). The Service only ever makes ordinary read-only network requests to targets: it does not attempt logins, submit payloads, exploit anything or generate load.

3. What the Service is not

The Service is not a security guarantee, a penetration test, a vulnerability assessment of your application logic, malware detection, a web application firewall, or a certification. It does not test authenticated areas, server-side code or business logic. A high grade means the observed controls were present at the time of the scan; it does not mean a website is secure or free of vulnerabilities. A low grade does not mean a website has been compromised. References to OWASP, PCI DSS, GDPR, the Digital Personal Data Protection Act 2023 (“DPDP”) or any other framework are readiness indicators for selected technical controls only. Kavach is not a PCI SSC Approved Scanning Vendor and its reports do not satisfy PCI DSS Requirement 11.3.2 or any ASV scan obligation. Kavach does not declare any organisation compliant with any law or standard and does not provide legal, regulatory or professional advice.

4. Eligibility and accounts

You must be at least 18 years old and able to form a binding contract. An account is identified by an email address and an API key. You are responsible for keeping your API key confidential and for all activity under your account; notify us at legal@kavachscan.com immediately if you believe it has been compromised. We record the version of these Terms you accepted and when.

5. Authorisation to scan

You may submit a website or domain for scanning, monitoring, reporting or publication only if you own it or have the express authorisation of its owner to test it. Each time you submit a target you represent and warrant that this is true. Unauthorised testing of computer resources may be an offence under the Information Technology Act, 2000 (including sections 43 and 66) and equivalent laws elsewhere; you alone are responsible for ensuring you have authority. You must also comply with our Acceptable Use Policy, which forms part of these Terms.

6. Scan classes, verification and publication

Public Scans are limited to conservative, widely published configuration checks. Verified Scans, monitoring, Trust Passports, Payment Page Guardian and related features require domain ownership verification (DNS record or well-known file). Scan results for a domain are private to the verified owner; a Trust Passport becomes public only when the verified owner explicitly publishes it, and may be unpublished at any time. We may remove or unpublish any Passport or badge that is inaccurate, stale, misleading or obtained in breach of these Terms. Badges and Passports describe controls verified at a stated time under a stated policy version and nothing more.

7. Plans, fees, taxes and renewal

• Fees and plan limits are as published at https://kavachscan.com and may be stated in INR (India) or USD (international). Fees are exclusive of applicable taxes (including GST), which will be added where required.
• Paid plans are billed in advance per billing period and renew automatically until cancelled. Payments are processed by our payment provider (Razorpay for India; Stripe internationally); we never store card, UPI or bank details.
• You may cancel at any time from the dashboard; cancellation takes effect at the end of the current billing period. Refunds are governed by the Refund & Cancellation Policy.
• If a payment fails or is disputed, we may suspend paid features until it is resolved and revert the account to the Free plan.
• We may change fees with at least 30 days’ notice; changes apply from your next renewal.

8. API, CLI and GitHub Action

Programmatic use is subject to the same authorisation and acceptable-use obligations, to the rate limits we publish or apply, and to your Plan’s limits. You may integrate Results into your own internal tooling and reports. You may not resell or republish Results as a competing service, or use the Service to build a dataset of third-party websites, without a written agreement with us.

9. Intellectual property

The Service, including its scanner logic, rule catalogue, policy, software, text, design and trade marks (including “Kavach”), is owned by Support IT Ventures or its licensors and is protected by copyright and other laws. We grant you a limited, non-exclusive, non-transferable licence to use the Service and your Results for your own business purposes during your use of the Service. You retain all rights in your domains, websites and content. You grant us a licence to process the information needed to provide the Service, and to use aggregated, de-identified statistics (which never identify a specific site) for research and improvement.

10. Your responsibilities

You are solely responsible for every decision or action you take, or do not take, in reliance on the Service, including configuration changes, deployments, purchases, disclosures to clients or regulators and communications to third parties, and for any consequence of them. Remediation snippets are generic examples that must be reviewed and tested before use in production. You are responsible for maintaining backups of your own systems.

11. Third-party services

The Service relies on third parties, including hosting, DNS resolvers, Certificate Transparency logs, payment and email providers. We are not responsible for their availability or conduct. Links to third-party sites are provided for convenience only.

12. No warranty

To the maximum extent permitted by applicable law, the Service and all Results are provided “as is” and “as available”, without warranties or conditions of any kind, whether express, implied or statutory, including any warranty of accuracy, completeness, merchantability, fitness for a particular purpose, non-infringement, or uninterrupted or error-free operation. Results reflect a moment in time, depend on how the target responded to our requests, and may contain false positives or false negatives.

13. Limitation of liability

To the maximum extent permitted by applicable law: (a) Support IT Ventures, its proprietors, personnel, affiliates and suppliers shall not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, business, data, goodwill or anticipated savings, or for the cost of substitute services, arising out of or in connection with the Service or any Results, however caused and under any theory of liability (including negligence), even if advised of the possibility of such damages; (b) our total aggregate liability for all claims arising out of or relating to the Service in any twelve-month period shall not exceed the fees you actually paid to us for the Service in the twelve months preceding the event giving rise to the claim, or INR 1,000 if you paid nothing; (c) you agree that the Service is not intended as the sole basis for any security, compliance or business decision. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for fraud, or any non-excludable right you may have as a consumer under the Consumer Protection Act, 2019 or equivalent law.

14. Indemnity

You will defend, indemnify and hold harmless Support IT Ventures and its proprietors, personnel and affiliates from and against any claim, demand, loss, liability, damage, penalty, cost or expense (including reasonable legal fees) arising out of or relating to: (a) your use of the Service; (b) any scan, monitoring, report or publication relating to a website you did not own or were not authorised to test; (c) your breach of these Terms or the Acceptable Use Policy; (d) any content or domain you submit; or (e) your violation of any law or the rights of any third party.

15. Suspension and termination

We may suspend or terminate your access, refuse or throttle any scan, or remove any Passport or badge, immediately and without liability, if we reasonably believe you have breached these Terms or the Acceptable Use Policy, if required by law, to protect the Service or third parties, or if your account is inactive for more than 12 months (Free plan). You may close your account at any time from the dashboard or by emailing legal@kavachscan.com; we delete your data as described in the Privacy Policy. Sections 3, 9, 10 and 12–18 survive termination.

16. Privacy and data

Our processing of personal data is described in the Privacy Policy. We do not retain the contents of exposed secret-bearing files discovered during scans; we record only that such a file was observed, its size and a hash.

17. Changes to the Service or Terms

We may modify the Service (including the checks, scoring policy and plan limits) at any time. We may update these Terms; the version in force is shown above. For material changes we will give notice through the Service or by email at least 15 days before they take effect. Continued use after that date constitutes acceptance.

18. Governing law, jurisdiction and disputes

These Terms are governed by the laws of India. Subject to any non-excludable consumer rights in your country of residence, the courts at Mumbai, Maharashtra, India shall have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service. Before starting proceedings, the parties will attempt in good faith to resolve the dispute by written negotiation for at least 30 days.

19. General

These Terms, the Acceptable Use Policy, the Privacy Policy and the Refund & Cancellation Policy are the entire agreement between you and us about the Service. If any provision is held unenforceable, the remainder stays in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them to a successor of the business. Notices to us: legal@kavachscan.com. Notices to you: the email on your account.

Contact: Support IT Ventures, Mumbai, Maharashtra, India · legal@kavachscan.com