Terms of Service

Version 2026-10-11 · Last updated October 11, 2026

These Terms of Service ("Terms") are an agreement between you and prayersec, a sole proprietorship based in Utah ("prayersec", "we", "us"). They govern your use of the prayersec website at prayersec.com, the application at app.prayersec.com, and the related services (together, the "Service"). By creating an account or using the Service you agree to these Terms. If you use the Service for an organization, you confirm that you have authority to bind that organization, and "you" includes it.

1. The Service

prayersec helps you understand the attack surface of websites you are responsible for. Depending on your plan, the Service can:

• verify that you control a domain;
• look for servers that answer for your domain outside your content delivery network or web application firewall ("origin discovery");
• send the same set of test requests through your firewall and directly to those servers and compare the results ("differential scans");
• download the JavaScript your sites serve and identify the API endpoints it calls, using automated analysis including AI models ("JavaScript mapping");
• inventory the hostnames and IP addresses of your domains, the services they expose, and their web and email security settings ("attack surface inventory");
• repeat these scans on a schedule you choose.

2. Only scan what you are authorized to test

This is the most important part of these Terms. You may only add, and the Service will only scan, domains and hosts that you own or that you have written authorization to test. Before scanning, you must prove control of a domain (for example with a DNS record or a file on the site), or we must have recorded an authorization for it.

By adding a domain you confirm that you have the right to have it scanned as described in these Terms, including any hosts beneath it, and that doing so does not breach any agreement with your hosting provider, content delivery network, firewall vendor or anyone else. You must keep that authorization in place for as long as the domain is in your account, and remove the domain if it ends.

You must not use the Service, or anything it produces, to:

• scan, probe or test systems you are not authorized to test;
• gain or attempt to gain unauthorized access to any system or data, or exploit a vulnerability;
• disrupt, overload or degrade any system or network;
• evade, defeat or misrepresent yourself to security controls belonging to others;
• break any law, including computer misuse, privacy and export laws.

We may refuse, pause or remove any domain, and suspend any account, if we believe a scan is unauthorized or harmful.

3. What our scans do

Scans send real network traffic to your systems. They identify themselves with a prayersec user agent and consist of ordinary web requests, including requests for sensitive paths (such as configuration files) and harmless test strings designed to show whether an attack would be blocked. They do not attempt to change data on purpose, but any request to a live system carries some risk, and scans may trigger alerts, rate limits or blocking by your firewall or provider. You are responsible for telling anyone who needs to know, and for allowlisting our scanner where appropriate. We do not scan private or internal network addresses.

4. Credentials you give us

You may give us cookies, tokens or API keys so the Service can map a site as a signed-in user. Only provide credentials you are authorized to use for this purpose, ideally for a test account with the least access necessary. We encrypt them at rest, never display them back to you, and send them only to the host you choose and hosts within the same verified domain that it redirects to. While signed in, the Service avoids following links that look like they would log out or delete data, but it cannot guarantee that no request has an effect. Remove credentials when you no longer need them.

5. Your data and how we use it

Your results. You own the scan results, endpoint maps and reports produced for your domains ("Results"). We use them to provide the Service to you.

Collected JavaScript and model training. To provide JavaScript mapping, the Service downloads the JavaScript your sites make available. You grant us a worldwide, non-exclusive, royalty-free license to store, copy, analyze and process that JavaScript, and the outputs our models produce from it (such as the endpoints extracted from it), in order to provide, maintain and improve the Service, including to train and evaluate machine-learning models. When we build training data:

• we do not keep JavaScript collected while signed in with credentials you provided;
• we do not keep scripts embedded directly in your pages (inline scripts);
• we do not keep files in which we detect credentials such as API keys, tokens or private keys;
• we leave your domain names and page addresses out of the training data itself.

When you remove a domain, we delete the record of where its JavaScript came from, and delete stored files that no remaining domain uses. Models that have already been trained are not changed by a later deletion. Our models currently run on infrastructure we operate rather than a third-party AI service; if that changes we will update these Terms.

Account and usage information. We collect your email address, account settings, the domains you add, and technical information such as IP addresses and request logs, which we use to run, secure and improve the Service and to prevent abuse. We do not sell your personal information.

6. Results are not guarantees

The Service uses automated techniques, including AI models, that can be wrong. It may miss endpoints, servers or vulnerabilities, and it may report things that are not there. Results marked as not verified in the source should be treated as leads. The Service is not a substitute for a professional security assessment, and a scan that finds nothing does not mean your systems are secure.

7. Plans, billing and cancellation

The free plan has limits that we describe on our pricing page and may change. Paid plans are subscriptions that renew automatically each billing period at the price shown when you subscribe, until you cancel. Payments are processed by Stripe; we do not receive or store your full card details.

• You can cancel at any time from Manage billing. Cancellation takes effect at the end of the current billing period, and you keep access until then.
• Except where required by law, payments are non-refundable, including for partly used periods.
• If a payment fails, we may downgrade your account to the free plan after Stripe's retries. Your domains and results are kept, but features and data beyond the free plan become unavailable until you subscribe again.
• We may change prices or plan limits. We will give you at least 30 days' notice of a price increase for your subscription, and it applies from your next renewal.
• Prices do not include taxes unless stated; you are responsible for any taxes that apply.

8. Your account

You must be at least 18 years old and give accurate information. Keep your password secure; you are responsible for activity in your account. Do not share an account between people, resell the Service, or try to get around plan limits, rate limits or security features.

9. Third-party services

The Service relies on third parties, including Stripe for payments, public data sources such as certificate transparency logs and DNS, and Shodan, to which we send the IP addresses your domains resolve to in order to look up services Shodan has already observed on them. We do not port-scan your servers ourselves. Third parties' own terms apply to their services, and we are not responsible for them.

10. Security

We use reasonable technical and organizational measures to protect your data, such as encryption of stored credentials and restricted access. No system is perfectly secure, and we cannot guarantee that your data will never be accessed without authorization. If you believe you have found a security issue in prayersec, please tell us at support@prayersec.com.

11. Suspension and termination

You may stop using the Service and delete your domains at any time. We may suspend or end your access, with or without notice, if you break these Terms, if your use creates risk or legal exposure for us or others, or if we stop offering the Service. Sections 5 (license to collected JavaScript), 6 and 12 to 15 survive termination.

12. Disclaimer

The Service and all results are provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement, to the fullest extent permitted by law.

13. Limitation of liability

To the fullest extent permitted by law, prayersec will not be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or business, arising from or related to the Service, even if advised of the possibility. Our total liability for all claims relating to the Service is limited to the greater of the amount you paid us in the 12 months before the claim arose and 100 US dollars.

14. Indemnity

You will defend and indemnify prayersec against claims, losses and costs (including reasonable legal fees) arising from domains or credentials you add, scans of systems you were not authorized to test, your breach of these Terms, or your violation of law or the rights of others.

15. Governing law

These Terms are governed by the laws of the State of Utah, without regard to its conflict-of-laws rules. Any dispute will be heard exclusively in the state or federal courts located in Salt Lake County, Utah, and you consent to their jurisdiction.

16. Changes to these Terms

We may update these Terms. If a change is material, we will tell you by email or in the Service before it takes effect, and may ask you to accept the new version. If you keep using the Service after a change takes effect, you accept the updated Terms.

17. General

These Terms are the entire agreement between you and us about the Service. If any part is unenforceable, the rest remains in effect. Our failure to enforce a provision is not a waiver. You may not transfer these Terms without our consent; we may transfer them as part of a reorganization or sale of the Service.

18. Contact

Questions about these Terms, legal notices and support requests: support@prayersec.com.