Terms and Conditions

AuditMerlin runs technical security audits of websites. Every check is mapped to a public standard such as the OWASP Secure Headers Project or Mozilla web security guidelines. The result is a technical posture report. It is not a compliance certification, a penetration test, or a guarantee that a site cannot be attacked. We may add, change, or remove checks and features over time.

• Audits are non-invasive: we only make ordinary public requests (standard GET requests and a TLS handshake) to the site you submit. We never exploit, fuzz, brute-force, or attempt to log in.
• You may only scan sites you own or are authorized to audit. You are responsible for having that authority.

• Login uses one-time magic links sent to your email address. There is no password; keep access to your mailbox secure, and you are responsible for activity under your account.
• You must provide accurate information and have authority to bind your company if you sign up on its behalf.

• AuditMerlin offers a Free plan (one site) and a Pro plan (up to 25 sites, fixes, and Cloudflare integration), billed monthly through Stripe, our payment provider.
• The Pro plan starts with a 14 day free trial.
• You can upgrade, downgrade, or cancel at any time inside the app; changes take effect immediately.
• Prices may change; existing subscribers are notified in advance.

• You can cancel at any time. Your access continues until the end of the paid period.
• We do not give prorated refunds for the unused part of a billing period.
• If you were charged in error (for example a duplicate charge, or a charge after you cancelled), email us within 14 days and we refund it in full.

• On the Pro plan you can connect your Cloudflare account with a scoped API token. Fixes are applied to your zone only when you click apply, and our undo removes only the rules we created.
• We never auto-apply a Content-Security-Policy; it can break real sites, so we only report on it and provide guidance.
• Changes are made at your request to your own infrastructure. Review them like any change you would make yourself; you remain responsible for your site.

Do not scan targets you are not authorized to audit, attempt to breach or overload the service, or use reports to attack third parties. We may suspend accounts used this way.

The service is provided “as is”. We aim for high availability but do not guarantee uninterrupted operation. A good score means the checks we run passed; it does not guarantee your site is free of vulnerabilities. To the maximum extent permitted by law, our total liability is limited to the fees you paid us in the 12 months before the claim, and we are not liable for indirect damages or lost profits.

You can stop using the service and delete your account at any time from your settings. We may suspend or terminate accounts that violate these terms, with notice where reasonable.

We may update these terms; material changes are announced in-app or by email. Questions: [email protected]. Our Privacy Policy explains how we handle your data.