Terms of Service

1Who we are and what these terms cover

Hullwise is operated by CDTechnology, a sole proprietorship of Utku Cem Dogan, Markt 36, 60311 Frankfurt am Main, Germany. You can reach us at cem@cdcapital-group.com. All mandatory information is provided in the Legal Notice (Impressum).

These terms apply to the website, the API, the MCP server and all services of Hullwise. The Acceptable Use Policy forms part of these terms. For Enterprise, the individual contract concluded for it takes precedence (see the section on Enterprise).

Our customers' own terms and conditions only apply if we expressly agree to them in text form.

2Who the offer is for

We offer Hullwise's paid services (single report, Business, Enterprise and Security Audit) exclusively to businesses (Unternehmer) within the meaning of Section 14 of the German Civil Code (BGB), meaning persons and companies acting in the course of their trade, business or profession when ordering. We do not enter into contracts with consumers within the meaning of Section 13 BGB. Before every order, you expressly confirm that you are buying for a business. We may decline an order or unwind the contract if it turns out that this confirmation is not true.

Anyone may use the free scan. Where these terms contain rules for consumers, they only apply in case a contract with a consumer is concluded despite this restriction. These terms do not restrict any mandatory consumer rights.

3Services at a glance

• Scan (free): a security check from the outside with a shortened report.
• Single report (€79, one-time per scan): the full report of one scan of a domain; every further report for the same domain at €39.50.
• Business (€149 per month or €1,428 per year): full reports, weekly monitoring of up to 10 domains and further features.
• Enterprise (from €490 per month): services and price under a separate contract.
• Security Audit (from €1,500 per application): a manual review, including beneath the surface, only after you have proven ownership.

How the check works and how it grades is explained under How we check, with all technical details under Method. The details of each service are set out in the following sections.

4Conclusion of contract and account

You can use the Scan without an account. By using it, you accept these terms and the Acceptable Use Policy.

You need an account for an API key, the history, the Single report and Business. The information you provide must be accurate, and your access is for you alone.

The presentation of the plans on the website is not yet a binding offer. You make a binding offer when you submit the order in the checkout of our payment provider Stripe. Before submitting, you see all details and the total price there and can correct input errors or cancel. The contract is concluded when we confirm the order, at the latest with the confirmation email or the activation of the service.

You receive the details of your order with the confirmation and the invoice by email. You can access and save these terms here at any time. The contract language is German. The English version is for information only.

5Scan (free)

With the Scan, we load a page once, as a browser would, load the JavaScript files that the page itself includes, perform a TLS handshake and read SPF and DMARC from the public DNS. The result is a grade from A to F.

You receive a shortened report: the grade, the number of findings per area and the two most urgent findings in full. We only show the remaining findings and the versions of detected software with the Single report or with Business. This also applies to the API and MCP.

The Scan is free of charge and a non-binding indication. It is not advice and not a promise that any particular result is correct. There is no entitlement to it being available at all times. We may change, restrict or discontinue it.

6Single report

The Single report costs €79 one-time. It covers the full report of exactly one scan of a domain. It is not a subscription and ends automatically.

What is included

• The full report for the purchased domain with every finding and the steps to fix it.
• The report stays available under a private link and can be downloaded as PDF. It shows the state at the time of the scan and does not change afterwards.
• A new scan of the same domain, for example after a fix, is not included. It is a further purchase at the reduced price (see below).
• An invoice by email.

Which domain it covers

The Single report covers exactly the domain that is actually scanned after all redirects. If the address you enter redirects to another domain, it covers that target domain. The free Scan shows you which domain this is before you buy.

Upper and lower case, a leading “www.”, paths and ports make no difference. Other domains and other subdomains are not included; for example, app.example.com is a different domain from example.com. It cannot be transferred to another domain afterwards.

Provision and duration

We unlock the full report immediately after payment: in the browser you bought it in, and for the account with the email address you entered at checkout. You don't need an account to buy. If you later sign in with that address, you see the report on other devices too. Full reports through the API and MCP are part of Business. After payment we take you straight to your report under a private link. Anyone who knows this link can open the report, so only share it with people who should see it.

Recheck at a reduced price

If you have already bought a single report for a domain, every further single report for the same domain costs 50% less, currently €39.50. We recognise this from your account or, for a purchase without an account, from a marker in the browser you bought in (for up to one year). The reduced price is shown at checkout before payment.

No refund after provision

Once we have unlocked the full report, we do not refund the price. This does not affect the statutory right of withdrawal for consumers as long as it has not expired (see the section on the right of withdrawal), or your statutory rights in the event of defects.

7Business

Business costs €149 per month or €1,428 per year. You pay in advance for the selected period.

What is included

• Full reports with every finding and fix, including through the API and MCP.
• Up to 10 domains under monitoring, scanned automatically every week.
• An email alert as soon as the grade of a monitored domain drops.
• The history per domain.
• “Find apps”: for a domain of your company, we search public certificate logs (Certificate Transparency) for further subdomains and check whether they are reachable and where they are hosted. You may only start this search for domains that belong to your company, and you confirm this before each search.
• Higher limits for scans (see the section on limits).

Term and cancellation

The subscription renews for the selected period until you or we cancel. You can cancel at any time with effect from the end of the current period: in your account under “Billing” via “Invoices and cancellation”, or by email to cem@cdcapital-group.com. Business then remains active until the end of the paid period. We do not refund periods already paid on a pro rata basis, unless we terminate with ordinary notice ourselves.

For consumers, the following also applies: after the first year, an annual subscription continues for an indefinite period. You may then cancel it at any time with one month's notice. We refund on a pro rata basis the amount paid in advance for the time after the contract ends.

8Enterprise

We agree Enterprise with you in a separate contract in text form, for example on the number of domains, scan frequency, price, term and a data processing agreement under Art. 28 GDPR.

The individual contract takes precedence over these terms. These terms apply in addition, unless the individual contract provides otherwise. Until the individual contract is concluded, any call or quote is non-binding.

9Security Audit

The Security Audit costs from €1,500 per application. You pay this amount when you order. If the price depends on the scope and exceeds the amount paid, we will tell you the final price in text form before the review begins. You only owe an additional amount if you agree to it.

Process

• Proof of ownership. You prove that you own the domain or are authorized to have it reviewed. Without such proof, we do not review. If third parties such as your host or platform provider must permit the review, you obtain that permission.
• Agreement. We agree scope, time frame, access and contact persons with you in text form before we start.
• Start. The review begins when we start the actual review of your application. We will tell you the date in advance.
• Report. You receive a report with every confirmed finding and how to fix it. One follow-up review after your fixes is included in the price; we agree the timing with you.

Cancellation and refund before the start

Until the review begins, you may cancel the order at any time without giving reasons by email to cem@cdcapital-group.com. We will then refund the full amount within 14 days using the same means of payment you used.

If proof of ownership has not been provided 30 days after the order despite a reminder, or if we cannot agree on scope or final price, both you and we may withdraw from the contract. In that case too, we refund the full amount.

Termination after the start

After the start, you may terminate the audit at any time. We then only charge the share that corresponds to the services provided up to that point in relation to the agreed total scope, and refund the rest. For consumers, the rules on the right of withdrawal also apply.

Confidentiality and your cooperation

We treat everything we see during the review as confidential. The report goes to you only. Credentials you give us for the review are used only for that purpose and deleted once it is complete. We review carefully. Nevertheless, we cannot entirely rule out an outage or disruption of your application. Back up your data before the start and tell us about any parts that must not be reviewed.

10Use of the website, API and MCP

You may only check sites that belong to you or that you are authorized to check. This also applies when an AI agent performs checks on your behalf. The details are set out in the Acceptable Use Policy.

Keep your API key secret. If it becomes known to others, revoke it in your account and create a new one. Anything done with your key is attributed to you, unless you are not responsible for the misuse.

11Limits

Without a key, 20 scans per hour are possible, with a free key 100, and with Business 2,000. “Find apps” is also limited per hour. We may change limits where this is necessary for stable operation. In doing so, we will not restrict paid services below the agreed level.

12Prices and payment

Final prices. All prices are final, because as a small business under Section 19 of the German VAT Act (UStG) CDTechnology charges no VAT.

Total price before you order. In the checkout, we show you the total price before you submit the order. This total price is decisive.

Payment. We bill through Stripe. You enter your payment details directly with Stripe; we do not see them. The price is due when you order, and for Business at the start of each period. You receive the invoice by email.

Late payment. If a payment for Business fails, we may suspend the services after a reminder until the amount is settled.

13Right of withdrawal for consumers

If you are a consumer, you have a statutory right of withdrawal for contracts concluded through this website. It does not apply to businesses.

When the right of withdrawal expires early

• Single report (digital content): the right of withdrawal expires as soon as we unlock the full report, provided that you have expressly consented beforehand to us beginning before the withdrawal period expires, you have acknowledged that you thereby lose your right of withdrawal once performance begins, and we have provided you with the confirmation of the contract (Section 356(6) no. 2 and Section 312f BGB).
• Business and Security Audit (services): the right of withdrawal expires once we have fully performed the service, provided that you expressly consented before the start to us beginning before the withdrawal period expires and acknowledged that your right of withdrawal expires upon full performance (Section 356(5) no. 2 BGB). If you withdraw earlier, you pay a proportionate amount for the services provided up to the withdrawal, provided that you requested the start during the withdrawal period (Section 357a(2) BGB).

14What a finding means

A scan only sees what your site serves to every visitor, meaning the page itself and the JavaScript files it includes. Every finding means “possibly affected”, not proven. A good grade does not mean that your site is secure. A scan is not a substitute for a penetration test. This describes the scope of the service and does not limit your rights.

We check carefully, but we cannot rule out false alarms or overlooked issues. Any decisions you make on the basis of a finding are your own.

For paid services, the statutory rights in the event of defects apply, and for consumers, Sections 327 et seq. BGB on digital products. Liability is governed by the next section.

15Liability

We are liable without limitation for intent and gross negligence, for injury to life, body or health, for fraudulently concealed defects, where we have given a guarantee, and under the German Product Liability Act (Produkthaftungsgesetz).

In cases of slight negligence, we are liable for paid services only if we breach a material contractual obligation. Material obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment you may regularly rely. At Hullwise, these are above all: providing the paid full report, scanning monitored domains at the agreed frequency and notifying you when a grade drops, carrying out the Security Audit as agreed, and treating everything we see in the process as confidential. In these cases, liability is limited to the damage that was typically foreseeable when the contract was concluded.

Free services. The Scan and the free use of the API are provided free of charge. For these, we are liable only in the cases in which we are liable without limitation under the first paragraph.

These rules also apply to persons we engage to perform our obligations. If you have not backed up data or protected credentials, we take this into account under the statutory rules on contributory fault.

16Suspension and termination

If you violate these terms or the Acceptable Use Policy, we may block keys, accounts or access, in the case of serious violations also without prior warning. Both parties' right to terminate for good cause remains unaffected.

You may request the deletion of your account at any time. An email to cem@cdcapital-group.com is sufficient. Ongoing paid periods are governed by the section on Business.

17Changes

We may change these terms for the future. For ongoing paid contracts, changed terms only apply if you agree. We will ask you by email in advance. If you do not agree, the contract continues under the previous terms. We may then terminate it at the end of the current period. The date at the top shows the current version.

18Governing law and jurisdiction

The law of the Federal Republic of Germany applies. If you are a consumer, this choice of law applies only insofar as it does not deprive you of the protection afforded to you by mandatory provisions of the country in which you have your habitual residence (Art. 6(2) of Regulation (EC) No 593/2008, Rome I).

If you are a merchant (Kaufmann), a legal entity under public law or a special fund under public law, the place of jurisdiction for all disputes arising from this contract is Frankfurt am Main, to the extent such an agreement is permitted under Section 38 of the German Code of Civil Procedure (ZPO). We may also sue you at your general place of jurisdiction. In all other cases, the statutory places of jurisdiction apply.