Terms of Service

About these terms#

Lockpick is a hosted service that runs bounded, non-intrusive security assessments of public websites. It is operated by datascience2go Inc. ("Lockpick", "we" or "us"). These Terms of Service apply to the Lockpick website, the web app and any API, agent or command-line access we offer.

By creating an account, running an assessment or otherwise using Lockpick, you agree to these terms and to our Privacy Policy. If you use Lockpick for a company or other organization, you agree for it and confirm that you have the authority to do so. In that case "you" means that organization.

If you do not agree, do not use Lockpick.

Eligibility and accounts#

You must be at least 18 years old and able to enter into a binding contract to use Lockpick.

Give us accurate account details and keep them up to date. You can sign in with an email address and password or with a supported provider such as Google or GitHub. Keep your sign-in details secure.

You are responsible for everything that happens under your account and in workspaces you control, including actions by teammates you invite and by tools or agents you connect.

Tell us promptly at support@lockpick.app if you think someone has used your account without permission.

Only test sites you are allowed to test#

You may only ask Lockpick to assess a website that you own, or that its owner has clearly allowed you to test. Each time you add a site or start an assessment, you confirm that this is true for that site and for every domain and subdomain in scope.

Lockpick adds its own checks on top of your promise. They do not replace it.

• A Quick check works without an account and reads only public information about the site.
• A Pulse runs only after you confirm that you own the site or may test it.
• A Deep scan runs only after you prove control of the site with a DNS record, a meta tag or a file we ask you to publish.

We may refuse, limit, pause or stop any assessment at any time, block a site from being assessed, or ask for more proof of permission. We may do this, for example, when a site owner tells us they did not agree to testing. We do not have to explain each decision.

You are solely responsible for any assessment you start, or ask us to run, on a site you are not allowed to test, and for its consequences. The Indemnity section below covers claims that result.

Connected apps and agents#

You can connect apps and agents, such as Claude or the Lockpick command line, to a Lockpick workspace. Each one can do only what you allowed when you connected it, and never more than your role and project permissions allow.

• When you allow an app to start Pulse scans, you confirm for every site you ask it to assess that you own the site or may test it. It is the same promise as starting a Pulse yourself.
• A Deep scan an app prepares starts only after you approve that exact scan, at the cost shown, in Lockpick. The app cannot approve it for you.
• Scans an app starts use your monthly allowance like scans you start yourself.

Connected apps are provided by their makers under their own terms, and we are not responsible for them. You are responsible for what you ask them to do with Lockpick. You can revoke a connection at any time on the Add to your AI page. Revoking it does not delete past assessments.

Other services#

Lockpick works with services we do not control, such as sign-in providers, our merchant of record, AI providers, the apps and agents you connect and the sites you assess. Their own terms and policies apply to them. We are not responsible for those services, for what they do with information you give them, or for their availability.

What Lockpick does and does not do#

Lockpick assessments are bounded and read only. They read public pages, response headers, scripts, public DNS records, certificate transparency logs and domain registration data. Every assessment has a small, paced request budget. A Pulse sends at most 12 requests to your site and a Deep scan at most 200.

Lockpick does not try to log in, does not send attack payloads and does not submit forms.

We run assessments on our own infrastructure. You receive findings, redacted evidence, coverage, status and repair guidance. Our internal workflows, rules, prompts and tooling are not part of what we deliver.

An assessment is not a certification, an audit, a compliance attestation or a full security assessment. It checks a limited set of things at one point in time. It can miss issues, and a finding can turn out to be wrong or not to matter for your site. You decide what to change on your site, and you are responsible for those changes, including changes you or your tools make by following our repair guidance.

Master Key is not available yet. The starting price the pricing page shows for it is not an offer to sell it. Joining its waiting list does not create a contract for it. If we offer it, separate terms will apply.

Not legal or compliance advice#

Reports, scores, grades, findings, privacy and regulation observations and repair guidance are general information about technical signals we observed at one point in time. They are not legal, regulatory, compliance, privacy, insurance or other professional advice, and using Lockpick does not create a lawyer-client or any other professional relationship.

You alone are responsible for your site and for complying with the laws that apply to you and your visitors, including privacy, cookie, consent, data protection, accessibility and consumer protection laws. A report that does not mention an issue does not mean the issue is absent or that your site complies with any law. Ask a qualified professional before you rely on a report for a legal or compliance decision.

Reports are for you and the people you choose to share them with. Nobody else may rely on them, and we owe no duty to anyone who reads a shared report.

Acceptable use#

You agree not to do any of the following, or to help anyone else do them.

• Assess, or ask us to assess, a site you do not own or have permission to test.
• Use Lockpick to attack, overload or disrupt any website, network or service, including ours.
• Get around our limits, budgets, ownership checks or rate limits, for example by opening extra accounts to get more free runs.
• Reverse engineer, probe, scan or copy our assessment infrastructure, or try to extract our internal rules, prompts, workflows or source code.
• Resell, sublicense or provide Lockpick or its reports as a service to others, unless we agree in writing, for example for a Teams and agencies plan.
• Access Lockpick by automated means other than the interfaces we provide for that purpose.
• Break the law, infringe anyone's rights, or upload malware or unlawful content.

We may investigate suspected misuse, and we may report it to the owner of an affected site or to the authorities when we believe that is needed.

Sanctions and export laws#

You may not use Lockpick if you are located or ordinarily resident in a country or region subject to comprehensive sanctions by Canada, the United States, the United Kingdom, the European Union or the United Nations, or if you are named on, or owned or controlled by someone named on, one of their sanctions lists. You will comply with the export control and sanctions laws that apply to your use of Lockpick.

Your content#

Your content is the information you give us or that we produce for you, such as your account and workspace details, the sites you add, ownership proofs, onboarding answers and the reports we produce for your sites. As between you and us, you keep whatever rights you have in your content.

You give us a worldwide, non-exclusive, royalty-free license to host, copy, process and display your content only as needed to provide, secure and support Lockpick, as our Privacy Policy describes. This license ends when your content is deleted, except for copies we must keep by law or that remain in backups for a limited time.

We train Lockpick’s defensive security model on anonymized vulnerability findings. We do not use your source code, product ideas, account details or identifying information for training. Anonymized training records contain only a supported weakness category, severity and evidence classification; they contain no code, paths, domains, customer identifiers or free-text reasons. Earlier reports collected under our no-training promise are excluded.

If you share a report link, anyone who has the link can see what the report shows.

If you send us feedback about Lockpick, we may use that feedback to improve Lockpick. This does not give us rights to your source code or your product.

Our service and intellectual property#

Lockpick, including its software, assessment methods, rules, workflows, report formats, design and brand, belongs to datascience2go Inc. and its licensors. These terms do not give you any rights in it, except the right to use Lockpick as these terms allow.

Subject to these terms, you may use Lockpick, and the reports we produce for your sites, for your own business purposes, including sharing a report with the people who work on those sites.

Beta and coming-soon features#

Features marked as beta, preview or coming soon may be incomplete, may change and may be removed. We may change what each plan includes and how assessments work. We tell you about a change to a paid plan before it applies to your next billing period.

We do not promise any particular availability, uptime or response time.

Plans and payment#

Lockpick has a Free plan and paid plans. The Free plan includes 5 Pulse scans a month on one site and no Deep scans. The pricing page shows each plan's current price and monthly scans. Every scan you or your connected apps start uses one scan from your monthly allowance, and so do Check again and auto-checks. Unused scans do not roll over. We may add bonus scans to an account, for example for early access. Bonus scans are not part of a plan, and we may end them.

These rules apply to paid plans.

• Paid plans are sold by Polar (polar.sh), our merchant of record. Polar is the seller for your purchase and handles payment, taxes, receipts and invoices. Its terms govern the purchase, and these terms govern your use of Lockpick.
• Scans measure your use of Lockpick. They have no cash value, cannot be sold or transferred, and cannot be exchanged for money.
• Paid plans are billed each month, or once a year for the whole year, and renew automatically at the end of each billing period until you cancel. Either way, a plan's scans reset at the start of each month (UTC) and do not roll over.
• A scan that fails, or that your site blocks, is not charged.
• Refunds follow Polar's refund policy and the law that applies to you.
• We will tell you about a price change before it applies to your next billing period. You can cancel a paid plan at any time from Billing in Lockpick, where Manage billing opens Polar's customer portal. Cancelling stops the next renewal: you keep the plan until the end of the period you have paid for, and then your workspace moves to the Free plan.

Suspension and termination#

You can stop using Lockpick at any time and ask us to delete your account.

We may suspend or close your account, or stop any assessment, if you break these terms, if we believe you are testing a site without permission, if your use creates risk or harm for others or for us, if the law requires it, or if we stop offering Lockpick. Where it is reasonable, we will tell you first and give you a chance to fix the problem.

When your account closes, your right to use Lockpick ends and we handle your data as our Privacy Policy describes. The parts of these terms that by their nature should continue, including authorized use, the license to your content, disclaimers, limitation of liability, indemnity and governing law, continue after your account closes.

The Not legal or compliance advice and Resolving disputes sections also continue after your account closes.

Disclaimers#

Lockpick and all reports are provided as is and as available. To the fullest extent the law allows, we disclaim all warranties and conditions, whether express, implied or statutory, including merchantability, fitness for a particular purpose, title, non-infringement and accuracy.

We do not promise that Lockpick will find every issue, that its findings are correct or complete, that your site is secure, or that the service will be uninterrupted or free of errors.

Some places do not allow some of these exclusions. Where that is the case, they apply only as far as the law allows.

Limitation of liability#

To the fullest extent the law allows, datascience2go Inc. and its directors, officers, employees and suppliers are not liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data, goodwill or business opportunity, arising from or related to Lockpick or these terms, even if we were told they were possible.

To the fullest extent the law allows, our total liability for all claims arising from or related to Lockpick or these terms is limited to the greater of the fees you paid for Lockpick in the 12 months before the event that gave rise to the claim, or 100 US dollars.

These limits apply to every kind of claim, whether in contract, tort (including negligence), strict liability or otherwise, even if a limited remedy fails of its essential purpose. They are an essential part of the bargain between you and us, and the price of Lockpick reflects them.

Lockpick is provided by datascience2go Inc. alone. To the fullest extent the law allows, you may bring a claim arising from these terms or Lockpick only against datascience2go Inc., and not personally against any of its directors, officers, employees, shareholders or contractors, who are not parties to these terms and owe you no personal duty under them.

Nothing in these terms limits liability that the law does not allow to be limited.

Indemnity#

You will defend, indemnify and hold harmless datascience2go Inc. and its directors, officers, employees and suppliers against any claim, loss, liability, damage, fine, cost or expense, including reasonable legal fees, arising from any site you assess or ask us to assess (including a site you were not allowed to test), your content, your breach of these terms, or your violation of any law or of anyone's rights.

This includes any claim that your site, or the way it collects or uses its visitors' data, breaks a privacy, cookie, consent, data protection or consumer protection law.

We will tell you about such a claim promptly and let you control its defense. You may not settle a claim in a way that puts an obligation on us without our written consent.

Changes to these terms#

We may update these terms from time to time. The effective date and version at the top of this page show which terms apply.

If a change materially affects you, we will give you reasonable notice before it takes effect, by email or in Lockpick. If you keep using Lockpick after a change takes effect, you accept the updated terms. If you do not agree, stop using Lockpick and close your account.

Governing law and disputes#

These terms are governed by the laws of Ontario, Canada, including the federal laws of Canada that apply there, without regard to conflict of law rules. The courts located in Toronto, Ontario have exclusive jurisdiction over any dispute arising from these terms or Lockpick, and you and we both agree to their jurisdiction.

If you are a consumer, you keep any rights that the mandatory law of the place where you live gives you.

Resolving disputes#

Before you bring a claim against us, write to us at support@lockpick.app and describe it. We will try to resolve it with you informally for 30 days before either of us starts a court case. This does not stop either of us from asking a court for urgent relief to protect a right.

To the fullest extent the law allows, you and we may bring claims against each other only individually, and not as a plaintiff or class member in any class, collective, consolidated or representative action. No court may combine your claims with anyone else's or award relief to anyone other than you. If a court decides that this paragraph cannot apply to a particular claim, that claim is heard separately, and this paragraph still applies to every other claim.

To the fullest extent the law allows, you and we each waive any right to a jury trial.

To the fullest extent the law allows, a claim arising from these terms or Lockpick must be started within one year after it arose, or it is permanently barred.

Either of us may instead bring an individual claim in a small claims court that has jurisdiction over it.

If you accepted an earlier version of these terms, this section applies to you 30 days after we tell you about it, and never to a claim you started before then. If you are a consumer and the mandatory law of the place where you live does not allow part of this section, that part does not apply to you.

General#

These terms and our Privacy Policy, together with the merchant of record's terms for any purchase, are the whole agreement between you and us about Lockpick.

If a court finds part of these terms unenforceable, the rest stays in effect. If we do not enforce a right, we have not waived it. You may not transfer these terms without our written consent. We may transfer them to an affiliate or as part of a merger, acquisition or sale of assets. We are not responsible for delays or failures caused by events outside our reasonable control.

These terms give no rights to anyone other than you and us. We may offer these terms in other languages. If a translation differs from the English version, the English version governs, unless the law where you live requires otherwise.

Contact#

If you have a question about these terms, write to us at support@lockpick.app.

Lockpick is operated by datascience2go Inc., Ontario, Canada.