Terms of Service

Decloak (decloak.dev) is operated by Sparrow Technology Ltd, a company registered in England and Wales under company number 15676284 (“Sparrow Technology”, “we”, “us”, “our”). These Terms of Service (“Terms”) govern your access to and use of Decloak. By using the service you agree to these Terms. If you do not agree, do not use the service.

1. The service

Decloak scans a URL you submit and produces a report covering HTTP/TLS configuration, page content, network behaviour, JavaScript library vulnerabilities, tag manager and third-party domain activity, and an AI-generated summary. A free tier runs a single-page scan with no account required. Paid tiers (Starter, Pro) run a multi-page AI agent investigation and require a registered account and active subscription.

By default, Decloak performs passive, non-intrusive analysis of information a normal page load and its associated network requests already expose. It does not attempt to exploit vulnerabilities, bypass authentication, or access non-public systems.

Enterprise scans may additionally run limited active testing (forced browsing of common paths, CORS and HTTP method probing, reflected-input checks) where you have explicitly enabled it for that scan. This still does not include exploitation, credential bypass, or access to systems you have not authorised us to test. A further, separately-consented Enterprise capability, AI Pentesting, does include controlled exploitation attempts - see Section 2 below.

2. AI Pentesting

For Enterprise accounts, and only where you have separately enabled it for a specific scan (in addition to, and on top of, the active testing described in Section 1), Decloak's AI Pentesting feature runs a fixed set of established, third-party security tools (currently sqlmap, dalfox, ffuf, nuclei, and jwt_tool) inside an isolated, temporary sandbox to attempt to confirm whether specific findings already identified by the scan are genuinely exploitable.

This is materially different from the passive analysis and active testing in Section 1: it involves real exploitation attempts against the target you specify - for example, submitting SQL injection or cross-site-scripting payloads, or attempting to crack weak JSON Web Token signing secrets - rather than detecting a plausible signal alone.

AI Pentesting:

• only targets specific findings the scan has already surfaced, not open-ended exploration of the target;
• runs a fixed, curated set of non-destructive confirmation techniques, and excludes payloads intended to write, delete, or otherwise alter data;
• requires its own separate, explicit consent for that scan, confirming you own or are authorised to test the target and understand that real exploitation attempts will be made against it; and
• runs each tool inside a sandboxed environment intended to restrict outbound network access to the specific target domain for that scan.

You are solely responsible for having the right to run AI Pentesting against any target you submit, on the same basis as Section 3 (Acceptable use) below. As with the rest of the service, AI Pentesting results are provided on an as-is basis and are not a certified penetration test.

3. Acceptable use

You agree that you will only submit URLs for scanning where you:

• own the target, or
• have the explicit authorisation of the owner to run automated security scans against it, and
• are not violating the target's own terms of service, or any applicable law, by doing so.

You are solely responsible for having the right to scan any target you submit. We reserve the right to suspend or terminate accounts used to scan targets without authorisation, or to abuse, overload, or attempt to circumvent the service's rate limits or infrastructure.

4. Accounts and billing

A free account may be created at no cost. Paid plans (Starter, Pro) are billed monthly via Stripe. By subscribing you authorise recurring charges to your payment method until you cancel. Subscriptions can be upgraded, downgraded, or cancelled at any time via the self-service billing portal in Account Settings; cancellation takes effect at the end of the current billing period unless otherwise stated at checkout.

You are responsible for keeping your account credentials secure and for all activity under your account.

5. No warranty; not a certified audit

Decloak is provided on an “as is” and “as available” basis. Findings are generated by automated scanning and, for the executive summary, an AI model - both can produce incomplete results, false positives, or miss issues entirely. A high or low score is not a guarantee of a site's actual security posture, and a Decloak report is not a certified penetration test, compliance audit, or legal attestation of any kind. Any compliance control mapping (e.g. ISO 27001, SOC 2) shown in a report is an indicative reference, not a certified assessment.

You are responsible for independently verifying any finding before acting on it, and for any decisions made based on a Decloak report.

6. Limitation of liability

To the maximum extent permitted by law, Sparrow Technology Ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or business opportunity, arising from your use of or inability to use the service, including reliance on any scan result. Our total liability for any claim arising from these Terms or the service is limited to the amount you paid us in the 12 months preceding the claim.

7. Intellectual property

Decloak's software, design, and branding are owned by Sparrow Technology Ltd. Reports generated from your own scans are yours to use, share, and export. You may not resell, sublicense, or scrape the service to build a competing product.

8. Termination

We may suspend or terminate access to the service for any account that violates these Terms, including the acceptable use provisions in Section 3, without prior notice where necessary to protect the service or other users.

9. Changes to these Terms

We may update these Terms from time to time. Material changes will be reflected by updating the effective date at the top of this page. Continued use of the service after a change constitutes acceptance of the updated Terms.

10. Governing law

These Terms are governed by the laws of England and Wales, and any disputes arising from them are subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

Questions about these Terms can be sent to support@decloak.dev.