One scan is free. Watching it is the subscription.

Questions, answered

What exactly do you read?

Public Certificate Transparency logs, public DNS records, the TLS handshake and ordinary HTTP response headers. That is the whole input list. We do not port scan, brute force, fuzz, or send payloads, and we never touch a private system.

Do I need to prove I own the domain?

Not to sign up. If we ever question a claim, we will ask you to add a TXT record or a file under /.well-known/ and we will drop the account if you cannot. We only ever scan domains you are authorised to monitor, and the terms make that your responsibility.

What counts as an alert?

A finding that was not open during the previous scan. A new subdomain, a changed DNS record, a certificate entering its expiry window, a header disappearing, a host that stopped resolving. Findings that persist do not re-alert.

Can I cancel myself?

Yes. Every plan is self-serve through the billing portal, which Lemon Squeezy hosts. You keep access until the end of the period you already paid for, then drop to the free tier with your history intact.

Why Lemon Squeezy and not Stripe?

Because they act as merchant of record and handle sales tax and VAT in every country. One person should not be handling international tax registration. They take 5% plus 50c and pass the rest through.

What happens to my data?

We store the domain, the findings, and the scan history needed to diff against the next scan. Passwords are hashed with scrypt. We never sell anything and there is no third-party analytics on this site.