Terms of use

These terms are the agreement between Noroxi LLC (“Noroxi”) and you, the person using the services on noroxi.com and its subdomains. Free tools used without an account, the API and the MCP endpoint are included.

The services covered: security scanning tools, WP Lens, port scanning, site monitoring, the CVE database and alerts, the account panel and reports, the agency panel and the agency client portal.

Work we carry out by hand, such as penetration testing and consulting services, is provided under a separate contract. Where that contract and these terms conflict, the contract applies.

By using the service you accept these terms. When you tick the consent box while signing up by email, we record the date and time of your acceptance. How we process personal data is described in the Privacy notice.

There are three account types. The type is set once, by the door you sign up through:

• Personal account: you scan, monitor and report on your own sites.
• Agency account: you manage your clients’ sites; every site belongs to a client.
• Agency client: you see the sites the agency has opened to you in your own portal. This account is free.

A personal account can be converted to an agency account; there is no conversion back. A team owner’s plan covers the team’s members.

You are responsible for giving accurate account details, for keeping your password and API keys safe, and for what is done through your account.

Authorised targets only

Use the tools only on domains, IP addresses and systems that you own or have the owner’s written permission to test. If you are on shared hosting or a cloud service, following your provider’s scanning rules is also up to you.

Deep scans and port scans send requests straight to the target. Before these scans you must confirm that you are authorised. We record the confirmation: the target, the scan type, the date and time, and your account or a hash of your IP address. For a scan started with an API key or over MCP, using the key stands in for this confirmation.

We may ask for proof of your authorisation. Until we receive it we may stop the scan and suspend the account.

Targets we do not scan

Government domains (state, military, municipal and similar) are not scanned by any tool. For an IP address scan the owner of the address is checked first; an address that appears to belong to a government body, or whose owner cannot be read, is not scanned. Trying to get around these blocks is a breach of the terms.

Allowances and caps

Each plan’s scan allowance and limits are listed on the pricing page. On top of those, daily caps apply regardless of plan: the number of active scans against one target, and across the whole site, is limited per day. Do not try to exceed an allowance or cap by using several accounts, keys or IP addresses.

What you must not do

• Use the service to scan a target you are not authorised to test, or to access someone else’s system without permission.
• Make the service part of an attack, a denial of service or any unlawful activity.
• Try to bypass the service’s security measures, quotas or access controls.
• Use another person’s account, API key or share link without permission.

We keep a record of tool use; what the record holds is listed in the privacy notice. If you find a vulnerability in our own systems, report it under the rules on the responsible disclosure page.

If the rules are broken

Where use does not follow these rules we may refuse a scan, suspend the account or close it. Fees already paid are not refunded in that case. You are responsible for claims and losses that third parties bring against Noroxi because of a scan you were not authorised to run.

If you use an agency account, getting the client’s authorisation to scan each client site you add is your responsibility. You decide which permissions the client users you invite to the portal receive.

A client user sees only the sites the agency has opened to them. Reports you prepare carry your brand and include a “Produced with Noroxi” line. The contract, fees and commitments between you and your client are between the two of you; Noroxi is not a party to that relationship.

Plans, prices and each plan’s limits are listed on the pricing page. Prices are in US dollars (USD). If a price changes, the period you have paid for is not affected; the new price applies from the next period.

Paying with crypto

A crypto payment covers a single period and does not renew; there is no recurring charge. The plan activates once the payment provider’s confirmation reaches us. On-chain payments cannot be reversed; for an underpaid or mistaken payment, open a support request from your account.

Payments are not refunded, and there is no refund for a partial period. Consumer rights that applicable law does not allow you to waive are unaffected.

This rule also covers time you did not use, a move to a lower plan, plan limits you did not fill, and an account closed for breaching these terms.

Agency accounts can start one 14-day trial of Agency 40. The trial asks for no card or payment and does not turn into a paid plan by itself; when it ends the account returns to the free plan.

During the trial, deep scans are off and the monthly client report is not sent; both open with a purchased plan. The number of trials that can run at the same time is limited; while the limit is full, no new trial starts.

When your paid period or trial ends, the account returns to the free plan. None of your records are deleted.

Records above the new plan’s limit (sites, monitors, scheduled scans) stay in your account but do not run: starting from the oldest added, as many records as the limit allows remain active. A plan limit stops new additions; it does not delete existing records. When you move to a higher plan, paused records run again.

Scans are automated and look at the part of your site that is visible from outside. That means:

• A scan does not find every vulnerability; a “no signs found” result does not mean the site is secure.
• False alarms happen; verify a finding before you act on it.
• Version evidence is not exploitability: running a software version that has a recorded vulnerability does not show that the vulnerability can be exploited on your site.
• Grades, scores and reports are not a penetration test, an audit opinion, a compliance document or a certificate. The standards mapping in a report is a guide.

CVE records and other data come from third-party sources and can be late, incomplete or wrong. Decisions you take based on the results are yours.

The open data dump is published under this licence: Fields derived by Noroxi — tags, action_score, exploit_maturity, primary_vendor/product, has_patch_ref, cve_related, *_facet, bounty_scope, wp_component (slug ↔ CVE, role, unpatched) — are CC BY 4.0. Attribution is enough.

Source fields are subject to each source’s own terms; read the source list on the data page before commercial use.

The API endpoints need an API key. The MCP endpoint also works without a key for a limited number of calls; port scans and account tools need a key. The key is yours alone; do not give it to anyone else, and if you think it has leaked, revoke it in your account and create a new one. The daily request allowance depends on your plan.

Scans started over the API or MCP fall under the same “authorised targets only” rule and the same caps. Responses do not include links to exploit code. We may change the endpoints, their formats and their allowances.

The site’s software, design, text and the Noroxi name belong to Noroxi. The open data dump is distributed under the licence above, and our WordPress plugin Noroxi Connector under its own open-source licence; apart from these, copying or reselling the service needs our written permission.

Content you add to your account (domains, findings, notes, evidence files, your logo) is yours. We process it only to provide the service to you. You may share the reports you produce with your clients and your team.

We may add features to the service, change them or remove them. If plan limits change, your existing records are not deleted; records left above the new limit follow the rule in “When a plan ends, and records above the limit”.

When we update these terms, the date and version number at the top of the page change. Continuing to use the service after a change means you accept the new terms.

The service is provided “as is”. We do not guarantee that it will run without interruption or error, that it will find every vulnerability, or that it is fit for a particular purpose.

To the extent the applicable law allows, Noroxi is not liable for indirect losses such as lost profit, lost data or business interruption. Noroxi’s total liability under these terms is limited to the fees you paid to Noroxi in the twelve months before the event that gave rise to the claim.

Liability that the law does not allow to be limited (for example for intentional wrongdoing) is outside this limit.

You can stop using the service at any time. To have your account deleted, write to kvkk@noroxi.com; deleting an account is not something you can do yourself in the panel.

We may suspend or close an account that breaches these terms. Which records remain after an account is deleted is set out in the privacy notice: the tool usage record stays even when the account is deleted, and you can ask separately for it to be erased.

These terms are governed by the law of the State of Wyoming, USA, where Noroxi is incorporated, and the courts of Wyoming have jurisdiction over disputes. If you are a consumer, the rights that your country of residence does not allow you to waive, and your right to bring a case there, are unaffected.

If one provision of these terms is found invalid, the others remain in force. Where language versions differ, the Turkish text prevails.

For questions about these terms, write to us through the contact page. For matters about your account or a payment, open a support request from your account. For personal data: kvkk@noroxi.com.