Who you are dealing with
vibeship.eu is provided by Marc Arndt, Berghalde 96, 69126 Heidelberg, Germany. Questions about these terms go to support@vibeship.eu.
What the service is
- The quick check looks at a website the way a visitor would. It needs no account and costs nothing. Its result is a summary: the score, the grade and how many things each area found. What each finding is, where it sits and how to fix it requires a subscription for that website.
- The extensive scan is a bounded, real attempt to get into a website from the outside, in sixteen parts. It needs an account and costs nothing, but it is limited: one run per website, up to three websites per account, and it tests only what is reachable without signing in. Its result is a summary: the score, the grade, how many things each part found and the shape of the app. What each finding is, where it sits and how to fix it stays locked.
- The full report is a one-time payment of €19.99. Bought on a quick check, it unlocks that check and runs one extensive scan of the same website, whose report is unlocked too. Bought on an extensive scan, it unlocks that scan. The included extensive scan is the same as the free one: from the outside, without signing in, and without reading the code. It does not include running the scan again, and it does not include the record of runs over time that the subscription keeps.
- The subscription unlocks every report for one website — the quick check's details as well as every extensive scan — and lets you run the extensive scan as often as you like. It adds a real attempt to get in behind that site's login, a check of the code behind it for leaked keys and known weaknesses, and a map of the app. It costs €9.99 a month per site, with a three-month minimum term, and then continues monthly until you cancel.
Only test what is yours
The extensive scan and the deep test send real attack traffic, and the code check reads a repository you connect. You may only run a scan against a website, attach one to a subscription, or connect a code repository if you own it or have the owner's explicit permission to have it tested, and you confirm that before every run. Getting and keeping that permission is your responsibility, not ours: we cannot check who owns a site. If the permission is limited, for example to certain times or certain parts of a site, staying inside those limits is your job too.
If you point the service at a site or repository you have no right to test, you are responsible for the consequences, and we may end your account without refund. If someone makes a claim against us because of a scan you were not entitled to run, you cover the claim and the reasonable cost of defending it, unless you were not at fault.
The quick check reads public pages only, but the same rule applies: use it on sites you are entitled to look at.
Your account
Keep your sign-in to yourself. What happens under your account is your responsibility until you tell us it has been compromised. You must be at least 18 to buy a report or subscribe.
Paying, cancelling and refunds
- The full report is a one-time payment of €19.99 through Stripe. Bought on a quick check, it covers that check and one extensive scan of the same website; bought on an extensive scan, it covers that scan. Once paid, those reports stay open. It does not open any other run.
- The subscription is billed monthly through Stripe, starting when you subscribe.
- The first three months are a commitment. You can cancel at any time from the dashboard; a cancellation inside the first three months takes effect at the end of the third month, and the site stays active until then. After that, cancelling takes effect immediately.
- A subscription is bound to one website and its code. To test a second site, you need a second subscription. Additional code repositories for the same site can be added to an existing subscription at the price shown on the dashboard.
- Refunds. If the subscription is not useful to you, tell us through the contact page within 7 days of its first payment and we refund that payment in full and end the subscription. One refund per person and per website. The one-time full report is not refundable once the report has been unlocked, because what you paid for has been delivered.
- Report emails. If you ask us to email you the quick check, we send the link to the report, one reminder the next day, and nothing else. Every one of those mails has a one-click link that stops them.
- If you are a consumer in the EU, you have the right to withdraw within 14 days of subscribing by emailing us. If you asked us to start straight away and ran a deep test in that time, we may keep a proportionate amount for what was already provided.
- If we change the price, we will tell you at least 30 days before it applies to you, and you can cancel before it does.
What our scans are, and what they are not
Best effort. Every scan we offer — the quick check, the extensive scan, the deep test behind your login and the check of your code — is provided on a best-effort basis. We run the checks described, with reasonable care, and we tell you when a part could not run rather than pretend it did. Beyond that, we do not promise:
- Completeness. A scan can only find what it knows how to look for, in the parts of your site it can reach, in the time it has. It can and will miss weaknesses. A clean report does not mean your site is secure.
- Accuracy. A scan can report something as a problem that is not one, or rate a problem as more or less serious than it is. Findings can be wrong in both directions.
- That a scan runs. Your site, your hosting company or a firewall in front of it may block or slow our scanner, a site may be down, and our own service may be unavailable. We do not promise any particular availability. If a scan you paid for could not run because of a fault on our side, tell us and we run it again or refund it.
Advice, not a replacement. What we give you is advice: a tool to help you decide what to fix. It is not a security audit, a penetration test by qualified people, a certification, or legal advice, and it does not replace a professional security firm. If your site handles money, health data or anything else whose loss would seriously hurt you or your customers, have it tested by people as well. You remain responsible for the security of your own systems, for deciding what to change, and for the changes you make.
Breaches are not covered. Because a scan can miss things, we are not responsible if your site, app, code or data is broken into, taken over, leaked or damaged through a weakness — whether our scan found it, missed it, or reported it and it was not fixed. The same goes for what follows from acting, or not acting, on our results. This describes what the service is; it does not limit our responsibility for our own mistakes, which the next section covers.
The deep test is designed to be safe, but it is a real test against a real site. It can create records, send emails and slow the site while it runs. Back up your data before running it, and do not run it on a site whose failure would hurt you.
Our responsibility to you
We are fully liable, without limit, for harm we cause on purpose or through gross negligence, for injury to life, body or health, under the German Product Liability Act, and where we have given an explicit guarantee.
For ordinary negligence we are liable only if we break a duty that is essential to the service — one the contract cannot be carried out without and that you are entitled to rely on — and then only for the damage that is typical for this kind of service and that could be foreseen when you started using it. For ordinary negligence otherwise, we are not liable. If you use the service for your business, our liability for ordinary negligence is in addition limited to what you paid us in the twelve months before the claim.
Where we are liable for lost data, it is limited to what restoring it would have cost if you had kept regular backups.
These limits also protect the people who work for us. Nothing in these terms takes away rights the law gives you as a consumer that cannot be taken away by contract.
Ending things
You can stop using the quick check at any time, and cancel a subscription as described above. We may suspend or end your account if you break these terms, in particular by testing sites you have no right to test, or if we have to stop offering the service; in the second case we will refund any part of a term you have paid for and not received.
Agreeing, and changes to these terms
You agree to these terms when you create an account, buy a report or a subscription, or start a scan — each time, the version shown on this page at that moment.
We may update these terms. If a change matters to you, we will tell you on the dashboard at least 30 days before it takes effect, and you can cancel before then. The date at the top is the date of the last change.
Which law applies
These terms are governed by the law of Germany. If you are a consumer, you also keep the protection of the law of the country you live in, and you can bring a claim in its courts.