Terms of Service

1. Who we are

Bastion is operated by Instant City Solutions LLC, a Florida limited liability company based in Miami, Florida. In these terms, "we", "us" and "our" mean Instant City Solutions LLC, and "you" means the person or organization using the service at bastionscan.com.

By creating an account or using Bastion, you agree to these terms. If you are agreeing on behalf of a company, you confirm you have authority to bind it.

2. What the service does

Bastion performs passive external security checks against internet-facing domains you have verified with us. It inspects HTTP response headers, completes TLS handshakes and examines certificates, queries public DNS and certificate transparency logs, and tests whether common TCP ports accept a connection. It reports findings with severity ratings and remediation guidance, and monitors those domains over time for changes.

Bastion does not attempt exploitation, fuzzing, password guessing, or any test designed to alter, disrupt, or gain access to a system.

3. Your account

You must provide an accurate email address and keep your password confidential. You are responsible for everything that happens under your account, including actions taken by team members you invite. Tell us promptly at support@bastionscan.com if you believe it has been compromised. You must be at least 18 years old.

4. Authorization to scan

This section is the most important one in these terms. Scanning infrastructure you do not control may be unlawful in your jurisdiction, and we take the boundary seriously.

• You may only scan domains that you own or are expressly authorized in writing to test. Before any domain becomes scannable, you must prove control of it by publishing a DNS TXT record we generate for you.
• We re-check that record periodically. If it stops resolving, the domain is automatically demoted and scanning stops.
• You represent and warrant that, for every domain you verify, you hold the necessary authority and permissions to have it tested — including from any hosting provider, CDN, or third party whose systems are involved.
• You must not attempt to bypass or interfere with domain verification, and you must not verify a domain on behalf of someone who has not authorized the testing.
• You are solely responsible for the consequences of scanning any domain you verify.

Lookalike-domain monitoring is an exception in one direction only: those candidate domains are observed using public DNS and certificate transparency data, and are never scanned.

If we believe a domain is being scanned without authorization, we may suspend scanning, remove the domain, or terminate the account immediately and without notice. Report suspected misuse to security@bastionscan.com.

5. Acceptable use

You agree not to:

• Use the service to scan, probe, or gather information about systems you are not authorized to test.
• Resell, white-label, or provide the service to third parties without our written agreement.
• Attempt to circumvent plan limits, rate limits, or access controls, or to access another customer's data.
• Use the service to violate any applicable law, or to plan or support an attack on any system.
• Interfere with the operation of the service, including by automated means beyond documented API usage.

6. Plans, billing and trials

• Plans are billed in advance through Stripe, either monthly or annually depending on the term you choose. We do not receive or store your full card details.
• Every plan includes a free trial period. If you do not cancel before the trial ends, the plan begins billing automatically at the listed price for your chosen term.
• Trials are granted once per domain. If a domain has already been trialled by another account, a new account verifying it will not receive a second trial.
• You can cancel at any time from the billing portal. Cancellation takes effect at the end of the current billing period — the current month or year — and you keep access until then. Annual terms are not refunded on a pro-rata basis when cancelled mid-term.
• Fees already paid are non-refundable except where required by law, though we will consider reasonable requests sent to support@bastionscan.com.
• We may change pricing with at least 30 days' notice to the email on your account. Continuing to use a paid plan after the change takes effect means you accept the new price.
• Plan limits — domains, scans per month, scan frequency and team seats — are enforced by the service. Exceeding a limit does not incur an overage charge; the action is simply declined until you upgrade or the period resets.

7. Your data and findings

You retain ownership of the domains you register and the scan results generated for your account. We use your data to operate and improve the service as described in our Privacy Policy. We do not sell your scan results, and we do not disclose findings about your infrastructure to third parties except as described in that policy or as required by law.

8. No guarantee of security

Bastion reports what it can observe from the outside at a point in time. A clean report does not mean a system is secure, and a posture score is a summary rather than an assurance. The service does not detect application-level vulnerabilities, misconfigured internal systems, compromised credentials, or anything not visible externally.

Findings and alerts are informational. You are responsible for deciding what to act on and for testing any change before applying it. Bastion is not a substitute for a penetration test, a security audit, or professional advice, and neither its reports nor its compliance evidence pack by itself establishes compliance with any standard or regulation.

9. Availability and alerting

We aim to keep the service available but do not promise uninterrupted operation. We may modify, suspend, or discontinue features, and we perform maintenance that can cause downtime. Scheduled scans, monitoring checks and alert delivery may be delayed, skipped, or fail — for example if a mail provider rejects a message or a webhook endpoint is unavailable. You should not rely on Bastion alerts as your sole control for any critical event.

10. Disclaimers and limitation of liability

The service is provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement.

To the fullest extent permitted by law, Instant City Solutions LLC will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill. Our total aggregate liability arising out of or relating to the service will not exceed the greater of one hundred US dollars ($100) or the amount you paid us in the twelve months before the event giving rise to the claim.

11. Indemnification

You will indemnify and hold harmless Instant City Solutions LLC and its members, officers and employees from any claim, loss, liability, or expense (including reasonable legal fees) arising from your use of the service, your breach of these terms, or — in particular — any scan you initiate against a domain you were not authorized to test.

12. Suspension and termination

You may close your account at any time. We may suspend or terminate your access if you breach these terms, if your payment fails and is not cured, or if we reasonably believe your use creates legal risk or harms others. On termination, your right to use the service ends; data handling after termination is described in the Privacy Policy.

13. Changes to these terms

We may update these terms. If a change is material, we will notify the email on your account at least 14 days before it takes effect. Continuing to use the service after that means you accept the updated terms.

14. Governing law

These terms are governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. The state and federal courts located in Miami-Dade County, Florida have exclusive jurisdiction over any dispute, and you consent to their personal jurisdiction and venue.

15. General

If any provision is held unenforceable, the rest remains in effect. Our failure to enforce a provision is not a waiver of it. You may not assign these terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. These terms, together with the Privacy Policy, are the entire agreement between us regarding the service.

16. Contact

Instant City Solutions LLC
Miami, Florida, United States
support@bastionscan.com