Terms of Service

About these terms#

Lockpick is a hosted service that runs bounded, non-intrusive security assessments of public websites. It is operated by datascience2go Inc. ("Lockpick", "we" or "us"). These Terms of Service apply to the Lockpick website, the web app and any API, agent or command-line access we offer.

By creating an account, running an assessment or otherwise using Lockpick, you agree to these terms and to our Privacy Policy. If you use Lockpick for a company or other organization, you agree for it and confirm that you have the authority to do so. In that case "you" means that organization.

If you do not agree, do not use Lockpick.

Eligibility and accounts#

You must be at least 18 years old and able to enter into a binding contract to use Lockpick.

Give us accurate account details and keep them up to date. You can sign in with an email address and password or with a supported provider such as Google or GitHub. Keep your sign-in details secure.

You are responsible for everything that happens under your account and in workspaces you control, including actions by teammates you invite and by tools or agents you connect.

Tell us promptly at mark@promptadvisers.com if you think someone has used your account without permission.

Only test sites you are allowed to test#

You may only ask Lockpick to assess a website that you own, or that its owner has clearly allowed you to test. Each time you add a site or start an assessment, you confirm that this is true for that site and for every domain and subdomain in scope.

Lockpick adds its own checks on top of your promise. They do not replace it.

• A Quick check works without an account and reads only public information about the site.
• A Pulse runs only after you confirm that you own the site or may test it.
• A Deep scan runs only after you prove control of the site with a DNS record or a file we ask you to publish.

We may refuse, limit, pause or stop any assessment at any time, block a site from being assessed, or ask for more proof of permission. We may do this, for example, when a site owner tells us they did not agree to testing. We do not have to explain each decision.

You are solely responsible for any assessment you start, or ask us to run, on a site you are not allowed to test, and for its consequences. The Indemnity section below covers claims that result.

What Lockpick does and does not do#

Lockpick assessments are bounded and read only. They read public pages, response headers, scripts, public DNS records, certificate transparency logs and domain registration data. Every assessment has a small, paced request budget. A Pulse sends at most 10 requests to your site and a Deep scan at most 200.

Lockpick does not try to log in, does not send attack payloads and does not submit forms.

We run assessments on our own infrastructure. You receive findings, redacted evidence, coverage, status and repair guidance. Our internal workflows, rules, prompts and tooling are not part of what we deliver.

An assessment is not a certification, an audit, a compliance attestation or a penetration test. It checks a limited set of things at one point in time. It can miss issues, and a finding can turn out to be wrong or not to matter for your site. You decide what to change on your site, and you are responsible for those changes, including changes you or your tools make by following our repair guidance.

Our break-in test, a penetration testing product, is not available yet. Joining its waiting list does not create a contract for it. If we offer it, separate terms will apply.

Acceptable use#

You agree not to do any of the following, or to help anyone else do them.

• Assess, or ask us to assess, a site you do not own or have permission to test.
• Use Lockpick to attack, overload or disrupt any website, network or service, including ours.
• Get around our limits, budgets, ownership checks or rate limits, for example by opening extra accounts to get more free runs.
• Reverse engineer, probe, scan or copy our assessment infrastructure, or try to extract our internal rules, prompts, workflows or source code.
• Resell, sublicense or provide Lockpick or its reports as a service to others, unless you are on an agency plan or we agree in writing.
• Access Lockpick by automated means other than the interfaces we provide for that purpose.
• Break the law, infringe anyone's rights, or upload malware or unlawful content.

We may investigate suspected misuse, and we may report it to the owner of an affected site or to the authorities when we believe that is needed.

Your content#

Your content is the information you give us or that we produce for you, such as your account and workspace details, the sites you add, ownership proofs, onboarding answers and the reports we produce for your sites. As between you and us, you keep whatever rights you have in your content.

You give us a worldwide, non-exclusive, royalty-free license to host, copy, process and display your content only as needed to provide, secure, support and improve Lockpick, as our Privacy Policy describes. This license ends when your content is deleted, except for copies we must keep by law or that remain in backups for a limited time.

We do not use your reports to train AI models.

If you share a report link, anyone who has the link can see what the report shows.

If you send us feedback or ideas, we may use them without any obligation to you.

Our service and intellectual property#

Lockpick, including its software, assessment methods, rules, workflows, report formats, design and brand, belongs to datascience2go Inc. and its licensors. These terms do not give you any rights in it, except the right to use Lockpick as these terms allow.

Subject to these terms, you may use Lockpick, and the reports we produce for your sites, for your own business purposes, including sharing a report with the people who work on those sites.

Pilot, beta and coming-soon features#

Lockpick is in a free pilot. Features marked as pilot, beta, preview or coming soon may be incomplete, may change and may be removed. We may change pilot limits, what each plan includes and how assessments work at any time.

We do not promise any particular availability, uptime or response time during the pilot.

Plans, credits and payment#

During the free pilot every account gets 3 Pulse runs and 3 Deep runs a month on one site, and rechecks count as runs. Credits and paid plans are launching soon. Nothing is charged during the pilot.

When paid plans launch, these rules apply.

• Paid orders are sold by a merchant of record that we name at checkout. The merchant of record is the seller for your purchase and handles payment, taxes and invoices. Its terms govern the purchase, and these terms govern your use of Lockpick.
• Credits measure your use of Lockpick. They have no cash value, cannot be sold or transferred, and cannot be exchanged for money.
• Monthly plan credits expire at the end of each billing period, unless your plan says they roll over.
• An assessment that fails, or that your site blocks, is not charged.
• Refunds follow the merchant of record's refund policy and the law that applies to you.
• We will tell you about a price change before it applies to your next billing period. You can cancel a paid plan at any time and keep access until the end of the period you have paid for.

Suspension and termination#

You can stop using Lockpick at any time and ask us to delete your account.

We may suspend or close your account, or stop any assessment, if you break these terms, if we believe you are testing a site without permission, if your use creates risk or harm for others or for us, if the law requires it, or if we stop offering Lockpick. Where it is reasonable, we will tell you first and give you a chance to fix the problem.

When your account closes, your right to use Lockpick ends and we handle your data as our Privacy Policy describes. The parts of these terms that by their nature should continue, including authorized use, the license to your content, disclaimers, limitation of liability, indemnity and governing law, continue after your account closes.

Disclaimers#

Lockpick and all reports are provided as is and as available. To the fullest extent the law allows, we disclaim all warranties and conditions, whether express, implied or statutory, including merchantability, fitness for a particular purpose, title, non-infringement and accuracy.

We do not promise that Lockpick will find every issue, that its findings are correct or complete, that your site is secure, or that the service will be uninterrupted or free of errors.

Some places do not allow some of these exclusions. Where that is the case, they apply only as far as the law allows.

Limitation of liability#

To the fullest extent the law allows, datascience2go Inc. and its directors, officers, employees and suppliers are not liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data, goodwill or business opportunity, arising from or related to Lockpick or these terms, even if we were told they were possible.

To the fullest extent the law allows, our total liability for all claims arising from or related to Lockpick or these terms is limited to the greater of the fees you paid for Lockpick in the 12 months before the event that gave rise to the claim, or 100 US dollars.

Nothing in these terms limits liability that the law does not allow to be limited.

Indemnity#

You will defend, indemnify and hold harmless datascience2go Inc. and its directors, officers, employees and suppliers against any claim, loss, liability, damage, fine, cost or expense, including reasonable legal fees, arising from any site you assess or ask us to assess (including a site you were not allowed to test), your content, your breach of these terms, or your violation of any law or of anyone's rights.

We will tell you about such a claim promptly and let you control its defense. You may not settle a claim in a way that puts an obligation on us without our written consent.

Changes to these terms#

We may update these terms from time to time. The effective date and version at the top of this page show which terms apply.

If a change materially affects you, we will give you reasonable notice before it takes effect, by email or in Lockpick. If you keep using Lockpick after a change takes effect, you accept the updated terms. If you do not agree, stop using Lockpick and close your account.

Governing law and disputes#

These terms are governed by the laws of Ontario, Canada, including the federal laws of Canada that apply there, without regard to conflict of law rules. The courts located in Toronto, Ontario have exclusive jurisdiction over any dispute arising from these terms or Lockpick, and you and we both agree to their jurisdiction.

If you are a consumer, you keep any rights that the mandatory law of the place where you live gives you.

General#

These terms and our Privacy Policy, together with the merchant of record's terms for any purchase, are the whole agreement between you and us about Lockpick.

If a court finds part of these terms unenforceable, the rest stays in effect. If we do not enforce a right, we have not waived it. You may not transfer these terms without our written consent. We may transfer them to an affiliate or as part of a merger, acquisition or sale of assets. We are not responsible for delays or failures caused by events outside our reasonable control.

Contact#

If you have a question about these terms, write to us at mark@promptadvisers.com.

Lockpick is operated by datascience2go Inc., Ontario, Canada.