Perimeter by Cod3Lab
Draft — not yet reviewed by counsel. This text is a working draft and will be replaced by a reviewed version before general availability.

Legal

Terms of Service

These terms govern your use of Perimeter. They are written to be read, so we have kept the language plain; where a word has a specific legal meaning we say so.

Version 0.1 (draft) · Effective date: [EFFECTIVE DATE] · Last updated 22 October 2026

1. Who we are and what these terms cover

Perimeter ("the Service") is operated by [COMPANY LEGAL NAME], a company registered in Poland with its registered office at [ADDRESS], trading as Cod3Lab ("we", "us", "Cod3Lab"). The Service is available at perimeter.cod3lab.com and perimeter-app.cod3lab.com and through any API we provide.

By creating an account or using the Service you agree to these terms, to the Scanner Policy, and to the processing of personal data described in the Privacy Policy. If you use the Service on behalf of an organisation, you confirm you are authorised to bind that organisation, and "you" means that organisation.

2. The Service

Perimeter performs passive, external checks against internet domains you add to your account, scores the results, explains them, and notifies you about changes. The checks are described on the product page and the technical limits on what the scanner does are set out in the Scanner Policy, which forms part of these terms.

The Service is in early access. Some check categories are marked as coming soon and are not yet available; features, limits and pricing may change as described in sections 6 and 14.

3. Accounts

  • You must be at least 18 years old and provide accurate account information, including a working email address.
  • You are responsible for keeping your credentials confidential and for all activity under your account. Tell us promptly at privacy@cod3lab.com if you believe your account has been compromised.
  • An account may belong to several organisations (workspaces). The organisation's owner controls its members, domains and plan.

4. Acceptable use

You may add a domain to the Service only if you own it, administer it, or have been authorised by its owner to monitor it (for example as a managed service provider or insurance broker acting for a client). You agree not to:

  • use the Service to gather information about domains for the purpose of attacking, harassing or defrauding anyone;
  • circumvent domain limits, rate limits, the ownership verification gate or the exclusion list;
  • create multiple free accounts to obtain more scans than a single free account allows;
  • scrape, resell or redistribute scorecards or findings as a dataset, or build a competing rating service from them;
  • misrepresent a scorecard as a certification, audit or guarantee of security;
  • interfere with the Service, probe its infrastructure, or access it by any means other than the interfaces we provide.

We may suspend or remove domains, scorecards or accounts that we reasonably believe breach this section, and we may refuse to scan any domain whose owner has asked to be excluded.

5. Scanning and ownership verification

Unverified domains receive passive checks only, at monthly cadence, with no alerts. Publishing the verification TXT record described in the Scanner Policy confirms to us that you control the domain and unlocks the features of your plan for that domain. You warrant that you are entitled to publish that record. If the record is removed, the domain reverts to the unverified tier.

You acknowledge that the Service observes your domain from the public internet in the same way any third party could, and that findings reflect the state of your configuration at the time of the scan.

6. Plans, payment and introductory pricing

  • Plans, prices, domain limits and scan cadences are listed on the pricing page. Prices are in US dollars and exclude VAT and other applicable taxes, which will be added where required.
  • Paid plans are billed monthly in advance through our payment provider (currently Stripe). Your subscription renews automatically until cancelled. You can upgrade, downgrade or cancel from your account at any time; downgrades and cancellations take effect at the end of the current billing period and are not refunded pro rata, except where the law requires otherwise.
  • If a payment fails we will notify you and retry; if it remains unpaid for 14 days we may downgrade the organisation to the free plan, which may pause monitoring of domains above the free limit.
  • Introductory pricing. Current prices are introductory and may change as the Service matures. We will give existing subscribers at least 30 days' notice by email before a price change applies to their plan; if you do not accept the new price you may cancel before it takes effect.
  • The free plan is provided without charge and may be modified or withdrawn at our discretion with reasonable notice.

7. Public scorecards

Verified owners may choose to publish a read-only public scorecard for a domain. Unverified domains added by any user may also have a limited public scorecard based on passive checks; this shows only information that is publicly observable. You can ask us to remove a public scorecard for a domain you control, or to exclude the domain from the Service entirely, by following the opt-out process.

8. Your data

You retain all rights in the domains you add and in any content you provide. You grant us a licence to process that data as needed to provide the Service, including storing scan results and evidence, generating scores and reports, and sending alerts to the recipients you configure. We do not sell your data. Personal data is handled as described in the Privacy Policy; where we process personal data on your behalf (for example recipient addresses you add), a data processing agreement is available on request at privacy@cod3lab.com.

Raw evidence captured during scans is retained for 90 days and then deleted. Scores and findings are retained while the domain is in your account, so that history and trends can be shown.

9. Intellectual property

The Service, its software, scoring methodology, documentation and branding are owned by Cod3Lab or its licensors and are protected by copyright and other laws. These terms do not transfer any of those rights to you. You may use reports and scorecards generated for your domains for your own internal purposes and, on plans that include it, present them to your clients under your own branding.

10. Third-party data sources

Some check categories rely on data from third parties such as certificate transparency logs, internet-scan datasets, DNS blocklists and Have I Been Pwned. We use that data under the providers' terms and cannot guarantee its completeness or accuracy. Where a provider changes its terms or availability, we may change or withdraw the affected category.

11. What the Service is not

Scores, grades and findings are informational. They describe publicly observable configuration at a point in time and are not a security audit, a penetration test, a certification, legal or compliance advice, or a guarantee that a domain or organisation is or is not secure. You are responsible for evaluating findings and deciding what to change. To the extent permitted by law, the Service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement.

12. Liability

To the extent permitted by applicable law, our total liability to you arising out of or in connection with the Service in any twelve-month period is limited to the amount you paid us for the Service in that period, and we are not liable for indirect or consequential loss, loss of profit, loss of data, or loss arising from your reliance on a score or finding. Nothing in these terms limits liability that cannot be limited under Polish law, including liability for intentional misconduct (wina umyślna) or for death or personal injury.

If you are a consumer within the meaning of the Polish Civil Code, your statutory rights are not affected by this section.

13. Suspension and termination

You may close your account at any time from the app or by emailing us. We may suspend or terminate your access if you materially breach these terms, if required by law, or if the Service is discontinued, in which case we will give you reasonable notice and an opportunity to export your reports where possible. On termination we delete your account data within 30 days, subject to backups that expire within a further 30 days and to any retention required by law.

14. Changes to the Service and to these terms

We may change the Service, including adding or removing checks, as it develops. We may also update these terms; if a change is material we will notify account holders by email at least 14 days before it takes effect. Continued use after that date constitutes acceptance. The current version is always available at perimeter.cod3lab.com/terms.html.

15. Governing law and disputes

These terms are governed by the laws of the Republic of Poland and, where applicable, European Union law. Any dispute that cannot be resolved amicably will be submitted to the competent common court for the registered office of [COMPANY LEGAL NAME], except that consumers resident in the EU may bring proceedings in the courts of their own member state and may use the EU Online Dispute Resolution platform at ec.europa.eu/consumers/odr. Nothing in this section deprives a consumer of the protection of mandatory provisions of the law of their country of residence.

16. Contact

[COMPANY LEGAL NAME]
[ADDRESS]
Poland

General and billing: privacy@cod3lab.com
Abuse, opt-out and disputes: abuse@cod3lab.com