Terms of service

These terms govern your use of Fulcrum, operated by Aaryan G, an individual, not a registered company. By creating an account you accept them. If you do not, do not use the service.

Eligibility

You must be 18 or older. You confirm this when you register. Accounts belonging to people under 18 will be deleted.

The service

Fulcrum examines what a website exposes publicly — HTTP response headers, TLS configuration, and software versions a server advertises about itself — and returns a graded scorecard with a remediation plan ordered by how much risk each fix removes per unit of effort.

It is free. There are no paid tiers, and no charges of any kind.

What you may scan

This is the most important section of these terms. There are two kinds of check, and they are treated differently because what they do to the target is different.

Full scans — only domains you control

A full scan includes a TLS examination that opens hundreds of connections to the target, probing cipher suites, protocol versions and renegotiation behaviour. In a target’s logs this is indistinguishable from reconnaissance.

You may therefore run a full scan only against a domain you have proven you control, by publishing a challenge we issue to its DNS or its web root. The service enforces this and refuses anything else. Proving control of a domain is not the same as being authorised to test it: if the domain belongs to an employer or a client, you are responsible for having their permission.

Headers-only checks — any public site

A headers-only check sends the target one HTTPS request and reads the response headers, which is what a browser does when anyone visits the page. No ownership proof is required for this, and no TLS probing happens.

These checks are rate limited per account, limited per target across all accounts, and recent results are reused rather than refetched, so the service cannot be turned into a source of traffic against a site.

What you must not do

• Use the service to generate traffic against any site, or to circumvent the rate limits above.
• Attempt to run a full scan against a domain you do not control, including by falsifying ownership verification.
• Use results to attack a system, or to assist anyone else in doing so.
• Scan systems where doing so is unlawful in your jurisdiction or the target’s. Unauthorised scanning is a criminal offence in many countries, including under the Information Technology Act, 2000 in India.
• Probe, overload or attempt to break the service itself, or access another user’s account or results.

Refusals and abuse are logged. Accounts that break these rules may be suspended without notice.

What a grade does and does not mean

A good grade means the checks Fulcrum ran did not find a problem. It is not a statement that a site is secure, and no tool can make that statement.

Fulcrum does not examine:

• application logic, authentication, or access control;
• your dependencies or supply chain;
• infrastructure, configuration or people;
• anything requiring credentials or reaching past the public surface.

The vulnerability data is a small curated set covering common web server software, snapshotted rather than live. The absence of a CVE finding means nothing in that set matched — not that no known vulnerability exists. The scorecard says so on every result, and checks that fail to complete are shown as incomplete rather than clean.

Your account

Two-factor authentication is required. You are responsible for keeping your password, authenticator and backup codes safe, and for activity under your account.

You can reset a forgotten password by email, but doing so also needs a code from your authenticator app or one of your backup codes, so that access to an inbox alone is never enough to take over an account. If you lose your authenticator and your backup codes, access cannot be restored — we hold nothing that would let us verify your identity. This is a consequence of not collecting that information in the first place.

No warranty

The service is provided as it is, without warranty of any kind. It may be unavailable, may contain defects, and may report findings that are incomplete or wrong. Do not rely on it as your only assessment of a system’s security.

Limitation of liability

To the extent permitted by law, Aaryan G is not liable for any indirect or consequential loss arising from your use of the service, including loss arising from a security issue it did not detect, from a finding that proved incorrect, or from acting on a remediation plan.

Nothing here excludes liability that cannot lawfully be excluded.

Ending your use

You may delete your account at any time from the account page, which removes your data as described in the privacy policy. We may suspend or remove an account that breaks these terms, or stop offering the service entirely — it is free and comes with no commitment to continue.

Governing law

These terms are governed by the laws of India.

Contact

Questions about these terms: aaryan@fulcrumsecurity.in.