LEGAL

Terms of Service

Last updated: November 8, 2026

These Terms of Service (the "Terms") govern your use of the misconfig.ai hosted platform at app.misconfig.ai and its API (the "Service"), operated by GK Data LLC ("misconfig.ai", "we", "us"). By creating an account or using the Service you agree to these Terms. If you use the Service on behalf of an organization, you represent that you have authority to bind it, and "you" includes that organization.

1. What the Service does

The Service discovers internet-facing hosts for a domain you enter, probes them with non-destructive HTTP requests to detect misconfigurations and exposures, validates each candidate finding by replaying the request, and keeps a history of what changed over time. It is a monitoring tool, not a penetration test, and it does not attempt to exploit, modify, or disrupt any system.

2. Authorization to scan

You may only submit targets you own, operate, or are explicitly authorized to assess, for example under a written engagement or a published vulnerability-disclosure or bug-bounty policy whose scope covers the target and permits automated testing. Each time you start a scan you confirm this authorization, and we record that confirmation with the job.

You are solely responsible for ensuring you have that authorization and for complying with the laws that apply to you and to the systems you scan, including computer-misuse, anti-hacking and data-protection laws. We may refuse, pause, or cancel any scan, and may suspend or terminate your account, if we believe a target is out of scope, if the target's operator asks us to stop, or if scanning it would violate law or these Terms. Certain domains, including government, military, educational and our own infrastructure, are refused by default.

3. Accounts

You must provide a working email address and keep your sign-in methods (passkeys, linked GitHub or Google accounts, magic links) and API keys confidential. You are responsible for everything done through your account and API keys. Tell us at security@misconfig.ai promptly if you believe a credential has been compromised. During a private beta we may limit who can create an account.

4. Acceptable use

You agree not to:

• scan systems you are not authorized to assess, or misrepresent your authorization;
• use the Service to attack, overload, or gain unauthorized access to any system, or as a step in doing so;
• attempt to bypass scan limits, allowances, rate limits, target blocklists, or the validation and safety controls of the Service;
• resell or provide the Service to third parties as your own without our written agreement;
• reverse engineer the Service except where the law permits it notwithstanding this clause;
• use findings to harm the organization they concern, including extortion or unauthorized disclosure.

5. Your data and our use of it

You keep all rights to the targets you submit and to the findings, evidence and exports produced for your workspace ("Your Data"). You grant us the limited right to process Your Data to provide, secure, and improve the Service. Findings and evidence are private to your workspace. Asset metadata (host names, liveness, and technology fingerprints) for a domain may appear on a public discovery page when that feature is enabled; it never includes findings or evidence. We do not sell Your Data. Details are in the Privacy Policy.

6. Plans, payment and allowances

The Free plan is free. Paid plans and top-ups are billed through Stripe at the prices shown in the Service at the time of purchase. Subscriptions renew monthly until cancelled; cancelling stops future charges and your plan reverts to Free at the end of the paid period. Top-ups are one-time purchases that add scan allowance for the period shown when you buy them and are non-refundable once any part of them has been used. Host allowances, history retention and recheck limits are those of your plan at the time of each scan. We may change prices with at least 30 days' notice; changes apply from your next renewal. Taxes may be added where required.

7. Availability and changes

We aim to keep the Service available but do not guarantee uninterrupted operation. Scans depend on third-party networks, on the targets themselves, and on the infrastructure of our hosting provider. We may change, add, or retire features, and may change these Terms; material changes will be announced in the Service or by email at least 14 days before they take effect. Continued use after that date means you accept the change.

8. Intellectual property

The Service, its software, design and content are owned by GK Data LLC and its licensors. Third-party open-source components, including the ProjectDiscovery scanning tools and the nuclei-templates and misconfig-mapper check libraries, remain under their own licenses. Feedback you give us may be used without obligation to you.

9. Disclaimers

The Service is provided "as is" and "as available". Automated checks can miss exposures and can report findings that turn out to be harmless. A finding marked "fixed" means our check no longer reproduces, not that the underlying system is secure. To the fullest extent permitted by law we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. The Service is not legal, compliance, or security advice.

10. Limitation of liability

To the fullest extent permitted by law, GK Data LLC will not be liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, arising from or related to the Service. Our total liability for all claims in any twelve-month period is limited to the amount you paid us for the Service in that period, or 100 US dollars if you paid nothing. Some jurisdictions do not allow these limits, in which case they apply to the extent permitted.

11. Indemnity

You will defend and indemnify GK Data LLC against claims, damages and reasonable costs arising from your breach of Section 2 (Authorization to scan) or Section 4 (Acceptable use), or from Your Data.

12. Termination

You may stop using the Service and delete your account at any time by contacting support@misconfig.ai. We may suspend or terminate access for breach of these Terms, for legal reasons, or after 12 months of inactivity on a Free account, with notice where practicable. On termination your right to use the Service ends; Sections 5 and 8 to 14 survive.

13. Governing law

These Terms are governed by the laws of the State of Minnesota, United States, without regard to conflict-of-law rules. Disputes will be brought in the state or federal courts located in Minnesota, and both parties consent to their jurisdiction, except that either party may seek injunctive relief in any competent court.

14. Contact

GK Data LLC, operating misconfig.ai. General questions: support@misconfig.ai. Security reports and abuse, including requests from a domain owner to stop scans of their systems: security@misconfig.ai.