Public offer

1.1. This document is a public offer (the “Offer”) of Yulia Alekseevna Ladeyshchikova, taxpayer ID 231221603606, who applies the professional income tax regime (the “Provider”). It is addressed to any legally capable individual, sole proprietor or legal entity (the “Customer”) and sets out the terms of an agreement (the “Agreement”) under Article 435 and Article 437(2) of the Civil Code of the Russian Federation.

1.2. The Offer is accepted (Article 438(3) of the Civil Code) by signing up for the Service and confirming acceptance of the Offer, or by paying the Provider’s invoice. The Agreement is concluded upon acceptance.

1.3. A Customer acting on behalf of an organization confirms they are authorized to accept the Offer on its behalf.

1.4. The current version of the Offer is published at signalfort.ru/offer.

• Service — the signalfort web service at signalfort.ru, including the dashboard and the API.
• Account — the Customer’s account in the Service.
• Customer Resources — domains, subdomains, IP addresses, web applications and network services the Customer has added to the Service.
• Ownership verification — confirming the Customer’s right to a domain by publishing a DNS TXT record issued by the Service.
• Passive analysis — collecting information about Customer Resources from public sources (DNS, certificate logs, public databases) and matching it against vulnerability databases, with no test requests sent to the Resources.
• Active checks — safe network requests to Customer Resources to detect exposed services, misconfigurations and vulnerabilities.
• Finding — a security issue detected by the Service, with severity and confidence: “probable” (a version or signature match) or “confirmed” (passed a safe check).
• Plan — a set of Service features and the terms on which they are provided.

3.1. The Provider renders information services to the Customer by analysing the external security of Customer Resources through the Service; the Customer accepts the services and, on a paid Plan, pays for them.

3.2. Depending on the Plan, the services include:

• discovery of Customer Resources reachable from the internet;
• matching the software of the Resources against vulnerability databases (CVE, FSTEC BDU, GHSA, OSV, EUVD, CISA KEV) and a vulnerability feed for the Customer’s stack;
• Active checks of Resources with verified ownership;
• prioritization of Findings, notifications and re-checks after a fix;
• reports.

3.3. The services are rendered remotely, within the Service features available at the time. The Provider may develop the Service, add and change features without materially worsening the terms of a paid Plan.

4.1. The Radar plan (passive analysis and vulnerability feed) is free.

4.2. The scope and price of paid Plans, including Contour, are agreed with the Customer individually and stated in the invoice. Paying the invoice means accepting its terms.

4.3. Payment is made in roubles by bank transfer to the details in the invoice, 100% in advance for the billing period. No VAT is charged as the Provider applies the professional income tax regime. A receipt is issued via the “Moy Nalog” app and sent to the Customer by email.

4.4. Services for a billing period are deemed duly rendered and accepted unless the Customer sends a reasoned objection within 5 (five) business days after the period ends. An acceptance certificate is issued on request.

5.1. The Customer may cancel the services at any time (Article 782 of the Civil Code) by writing to hello@signalfort.ru or by deleting the Account.

5.2. On cancellation the Provider refunds the unused part of the paid period pro rata to the remaining days, within 10 (ten) business days of the request, by the same method used for payment unless agreed otherwise.

6.1. The Customer adds to the Service only Resources they own or have the right to test, including with the owner’s written permission. The Customer warrants this and is responsible for the accuracy of this warranty.

6.2. Active checks run only for domains with verified ownership. Without verification the Service is limited to passive analysis.

6.3. If Customer Resources are hosted by a hosting, cloud or CDN provider, the Customer complies with that provider’s rules on security testing.

6.4. Checks use safe methods: the Provider does not exploit vulnerabilities to access data, does not modify or delete data, does not run load tests, and limits the request rate. Checks come from fixed IP addresses, which the Provider shares on request.

6.5. A Finding stores minimal evidence: the fact of the issue (software version, field names, record count), not the content of the Customer’s data.

6.6. In-depth checks (with test accounts, access control and API testing) run only with a separate consent of the Customer, given in the Service or in writing.

6.7. The Customer must not use the Service to test resources they have no right to test, for attacks, to bypass Service limits, to resell access without the Provider’s consent, or for any other unlawful purpose.

6.8. If clause 6.1 or 6.7 is breached, or a resource owner files a reasonable complaint, the Provider may stop the checks and suspend the Account immediately.

7.1. The Provider shall keep the Service running except for planned and emergency maintenance, not disclose information about Customer Resources and Findings to third parties except as required by law, and respond to the Customer’s requests.

7.2. The Provider may carry out maintenance that temporarily limits access to the Service, engage third parties (hosting, email delivery) while remaining responsible for them, and use anonymized aggregate data that does not identify the Customer or its Resources to improve the Service and for statistics.

7.3. The Customer shall provide accurate data when signing up, keep the password confidential, be responsible for actions taken in the Account, and comply with section 6.

7.4. The Customer may use the Service within the chosen Plan, export reports and delete the Account at any time.

8.1. The Service is provided “as is”. The Provider does not guarantee that every vulnerability will be found or that there will be no false positives: the results are informational, and the Customer decides on remediation.

8.2. The Provider is not liable for losses caused by third parties, including a breach of Customer Resources, or for inaccurate information in public vulnerability databases.

8.3. To the extent permitted by Russian law, the Provider’s total liability under the Agreement is limited to the amount the Customer paid over the last 3 (three) months.

8.4. The parties are released from liability for failures caused by force majeure.

9.1. The Provider processes the Customer’s personal data under Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 and the Personal data policy.

10.1. The Agreement remains in force until terminated.

10.2. The Provider may change the Offer. A new version takes effect 10 (ten) calendar days after it is published on the website. The Customer is notified by email of changes affecting paid Plans. The terms of a paid period do not change to the Customer’s detriment before it ends.

10.3. The Provider may terminate the Agreement unilaterally if the Customer breaches section 6, or if the Service is discontinued — with at least 30 (thirty) days’ notice and a refund for services not rendered.

11.1. Disputes are settled by negotiation. Claims are sent to hello@signalfort.ru; the response time is 10 (ten) business days.

11.2. If a dispute is not settled, it goes to court under the laws of the Russian Federation, and with a consumer — subject to the jurisdiction rules of the Russian Consumer Protection Law.