Terms of Service
Last updated 9 October 2026
These are the terms on which CavScope is provided. They are written to describe what the service actually does and what we actually commit to, in plain language, so that nothing here is a surprise later.
This page states our current terms factually. It has not been reviewed by counsel, and it is not a substitute for a signed agreement. An Enterprise or Partner engagement with its own contract is governed by that contract where the two differ. If you need a contractual answer that this page does not give — an indemnity, a service level, a data processing agreement — ask us and we will route it to the right person rather than answer it here.
1. Who we are and what you are agreeing to
CavScope is operated by After Today, LLC, a Pennsylvania limited liability company doing business as 28 Foot Systems, in Hanover, Pennsylvania ("we", "us"). By creating an account, registering a website, running a scan, or paying for a plan, you ("you", "your organization") agree to these terms. If you are acting for an organization, you confirm you are allowed to bind it.
2. What CavScope is
CavScope is a website assurance service. It assesses a website you register from the outside, the way an anonymous visitor or a crawler meets it: HTTPS and response headers, cookies, redirects, public DNS and email-authentication records, exposed files, privacy and legal signals on the page, accessibility, and AI readiness. It keeps the results in a risk register and a control register, scores a posture, and writes a plain-English report called a SITREP.
The scanner identifies itself as CavScope-Scanner/1.0. It does not sign in, does not submit forms, and does not try to reach anything a visitor could not reach. It renders no JavaScript unless the browser engine has been enabled for your organization, and it never attempts to exploit a weakness it reports.
3. You may only scan what you are authorized to scan
You may register and scan a website only if you own it, or you have the owner's permission to assess it. A Partner may register a client's website only with that client's authorization. We may refuse, pause or delete a scan target at any time if we believe it is not yours to assess, and we may suspend an account that registers one.
Checks that send data to a site, where they exist, are switched off for every organization and require an authorization held on file before they can run. Asking us to run them is a statement that you hold that authorization.
4. Accounts, roles and your team
An account belongs to a person, identified by an email address, and sits inside an organization with a role. Access is enforced in the database with row-level security: a signed-in user sees their own organization's websites, scans, findings and reports and nothing else. You are responsible for who you invite, for the roles you give them, and for keeping sign-in links and passwords to yourself. Tell us promptly if you believe an account has been used without permission.
5. Plans, payment and cancellation
- Plans. The plans and prices offered publicly are shown on the pricing section of the home page and are read from the same database the service runs on. Enterprise pricing is set during a discovery conversation, not published.
- Billing. Subscriptions are billed monthly, in advance, through Stripe. Card details are entered on Stripe's pages and never reach us.
- Partner client organizations. A Partner plan includes a stated number of active client organizations. Additional organizations are priced as shown on the pricing section. Past the included number the service refuses to create another rather than billing one you did not agree to.
- Cancellation. You may cancel at any time through Stripe. You keep what you paid for until the end of the current billing period; the downgrade takes effect when the subscription ends. Nothing is deleted on downgrade, and websites over the trial limit are not disabled, though scheduled scanning of them may stop.
- Price changes. We may change prices for future billing periods and will tell you before a change reaches your account.
- Refunds. Fees already billed are not refunded except where the law requires it or we have agreed otherwise in writing.
6. What a SITREP is, and what it is not
A SITREP is a technical assessment of what the engine observed on a date. It is not a compliance certification, an audit opinion, a legal opinion, or legal advice. In particular:
- A framework reference on a finding is a citation that says where a finding belongs. It never says CavScope tests the whole framework. We do not provide a SOC 2 opinion; that is a licensed CPA firm's examination.
- A clean result is evidence that the listed checks passed on that date. It is not a statement that the site is secure, accessible or compliant.
- The laws listed under a jurisdiction are chosen by one place, where the organization or site states it is. They are not a determination of which laws apply to you. Privacy law in particular can reach a business through where its customers live.
- Every report states what the scan did not check. Read that section as part of the report.
You remain solely responsible for your own website and for your legal and regulatory obligations. Decisions you take on the strength of a SITREP are yours.
7. Acceptable use
You agree not to:
- Scan, or attempt to scan, a website you are not authorized to assess.
- Use CavScope to assess clients' websites commercially, white-label reports or remove CavScope branding outside a plan that includes those rights.
- Try to reach another organization's data, bypass row-level security, or probe the service's own infrastructure.
- Share an API key, or use one to run the service on behalf of someone who is not a member of the organization it belongs to.
- Resell, copy or scrape the service, the rule catalogue or the report format for a competing product.
8. Your data
What we collect, who processes it and why is on the Privacy page, which forms part of these terms. In short: you own your organization's data; we hold the rights needed to store and process it to provide the service; findings for a scan are sent to a language model only to write the narrative section of a SITREP, and we will turn that off for your organization on request. Ask and we will delete your organization's data.
9. Availability, changes and support
We work to keep CavScope available and the engine honest, and we will tell you when something it reports turns out to be wrong. We do not promise uninterrupted availability or a response time unless an Enterprise agreement says so. We may change, add or retire features, rules and checks; a rule's wording is read into every report, so we treat it as customer copy and change it carefully. Support is reached from the Support tab inside the workspace and the console, and by email at the address below.
10. Warranties and limitation of liability
CavScope is provided as is. We do not warrant that it will find every weakness on a website, that a finding is free of error, or that a clean result means a site is secure. To the fullest extent the law allows, we are not liable for indirect, incidental, consequential or punitive damages, or for lost profits, revenue or data, arising from the service or from reliance on a report. Our total liability to you for all claims arising out of the service in any twelve-month period is limited to the fees you paid us for the service in that period.
This section and the next one are the ones that most need counsel. We have written them to say what we mean. Until they have been reviewed, read them as our stated position, not as a tested clause.
11. Suspension and termination
We may suspend or close an account that breaks these terms, registers a site it is not authorized to scan, or abuses the service, and we will say why unless the law prevents us. You may close your account at any time by cancelling your subscription and asking us to delete your organization's data. Sections 6, 8, 10 and 12 survive termination.
12. Governing law
These terms are governed by the laws of the Commonwealth of Pennsylvania, without regard to its conflict-of-law rules. Where a signed agreement names a different law or venue, that agreement controls.
13. Changes to these terms
We will change this page when the service changes or when counsel reviews it. The date at the top moves when we do. A change that reduces what you receive, or increases what you pay, is told to account holders by email before it takes effect. Continuing to use CavScope after a change means you accept it.
14. Contact
- Questions about these terms, billing or your account: support@mail.cavscope.28footsystems.com
- Security vulnerability reports: security@mail.cavscope.28footsystems.com — see our disclosure policy