Terms of service

What Ingati does

Ingati scans websites you nominate and reports what it finds — security, SEO, content and accessibility issues — on a recurring schedule. It is a diagnostic tool. It reports; it does not change anything on your site.

Your account

You need an account, and you are responsible for what happens under it, including keeping your password to yourself. Tell us promptly if you think someone else has it.

An organisation has at least one main member who can add and remove people. Anyone you add can see everything in that organisation, including reports for every domain in it.

What you may point us at

Only sites you own or are authorised to test.This is the important one. Scanning sends real traffic and performs active checks — the kind of thing that is unremarkable against your own site and unlawful against someone else's.

We do not verify ownership. That is a deliberate choice which puts the responsibility on you: by adding a domain, you confirm you are authorised to have it scanned. If you are not, that is a breach of these terms and potentially of computer-misuse law where the site is hosted.

We may refuse or stop a scan at our discretion, and we block targets that resolve to internal or reserved addresses.

Plans, payment and tax

Plans are billed monthly or yearly in advance through Stripe. Prices on the site exclude VAT/MVA. Norwegian customers are charged 25% MVA. Customers outside Norway must supply a valid VAT number, and the reverse charge applies.

Your plan sets limits — how many domains, how many pages per scan, how much history is kept. We enforce them; we do not bill you for going over them.

You can cancel at any time from your billing settings. Cancelling stops the next renewal and leaves the current period running. We do not refund part-periods, and we do not delete the reports you already paid for — you keep read access to them.

If a payment fails, Stripe retries for several days. Your scans keep running while it does. If it never succeeds, the subscription ends and the account becomes read-only.

We may change prices with 30 days' notice by email, effective at your next renewal.

What we promise, and what we do not

We will make a reasonable effort to keep the service available and the scanner accurate. We do not promise uninterrupted availability, and we do not currently offer a service-level agreement.

A clean report is not a guarantee that your site is secure. No scanner finds everything. A scanner reports what it can detect from outside, and the absence of a finding is not evidence of the absence of a problem. Ingati is not a substitute for a penetration test, a code review, or professional security advice.

The service is provided as it is. To the extent Norwegian law allows, our total liability for any claim is capped at what you paid us in the twelve months before it arose, and we are not liable for indirect or consequential loss. Nothing here limits liability for anything that cannot lawfully be limited.

Your data, and ours

Your scan results are yours. We use them to run the service and would not publish or sell them. We may use aggregate, non-identifying statistics — how often a class of problem appears across all scans, for instance — to improve the scanner and to write about the state of the web.

What we hold and why is set out in the privacy policy.

Processing terms (GDPR Article 28)

When we scan a site for you, the pages we fetch may contain personal data — your staff's names and contact details, for example. For that data you are the controller and we are your processor, and these terms are the agreement Article 28 requires. They apply to every account; you do not need to ask for a separate one.

Subject and duration. We process the content of the sites you nominate, for as long as your account exists and those scans are retained.

Purpose and instructions. Only to produce and show your reports. We act on your documented instructions — using the service is the instruction — and we will tell you if an instruction appears to breach data protection law.

Categories. Whatever personal data your site publishes, typically names, work email addresses and phone numbers.

Confidentiality and security. Access is limited to people who need it and are bound to confidentiality. Security measures are described in the privacy policy.

Sub-processors. Stripe (payments) and Resend (email). We will give notice before adding another, and you may object.

Assistance. We will help you respond to data-subject requests and to your own obligations, so far as is reasonable, and we will tell you without undue delay if we become aware of a breach affecting your data.

Deletion.Scan data is deleted as it ages out of your plan's history, and on request when your account closes.

Ending it

You can stop at any time. We may suspend or close an account that breaches these terms — most importantly the scanning-authorisation rule above — or that does not pay. Where it is reasonable to do so, we will warn you first.

Changes, law and disputes

We may update these terms. For anything material we will give notice by email before it takes effect. Continuing to use the service after that means you accept the change.

Norwegian law governs this agreement, and the Norwegian courts have jurisdiction.

Questions: hei@ingati.com.