Assay is a hosted service — there's nothing to install, so this isn't a licence for software on your computer. It's the part people actually need in writing: who owns a report, what you may do with the fixes we give you, and the rules for displaying the hallmark.

1. What this covers

These License Terms are part of our Terms of Service and apply whenever you use Assay. Where the two disagree about licensing or ownership, this document wins; for everything else, the Terms do.

Nothing is installed on your device. You are not being granted a copy of any software, and no source code, model, or scanning logic is licensed to you.

2. Your licence to use Assay

While your account is in good standing, you get a personal, non-exclusive, non-transferable, revocable right to use Assay for your own apps and for client work you carry out. That right ends when your account does.

You may not:

resell, sublicense, or provide Assay to others as a scanning service of your own — running scans for your clients is fine, reselling access to the scanner is not;
copy, scrape, or reverse-engineer the service, its checks, its detection patterns, or its prompts, or use it to build a competing scanner;
use automated means to run scans beyond the documented API and your plan’s limits, or work around rate limits and quotas;
remove, obscure, or alter any attribution, notice, or date on a report, badge, or export.

3. Who owns what

Your app is yours. We claim no ownership of your app, your code, your content, or your data. Submitting a URL grants us permission to fetch and analyse what that URL already serves publicly, for the purpose of producing your report, and nothing more.
Your reports are yours. You own the reports Assay generates for your apps and may keep, print, and share them — including sending them to a client as part of paid work. You do not need our permission and you owe us no fee for that.
The fixes are yours to use. The paste-back prompts and code suggestions in a report are provided for you to use in your app, commercially, with no attribution required and no restriction on the resulting code.
Assay is ours.The service, the checks, the wording of the explanations, the site, the name “Assay”, and the hallmark are ours and stay ours.

4. About the fixes we suggest

Some explanations and suggested fixes are generated with the help of a large language model from your scan findings. They are suggestions, not reviewed engineering advice. They can be wrong, incomplete, or wrong for your particular setup.

Read a suggested change before you apply it, and test it. You are responsible for what you ship. We give no warranty that a suggested fix will resolve an issue, that it will not break something else, or that it is suitable for your app.

5. The hallmark

If a scan passes, you may display the Assay hallmark and link to its badge page on the app that passed. That permission is limited, revocable, and specific:

display it only on the app it was earned for, and only while the result it points to is still the latest one for that app;
don’t alter the mark — no recolouring, redrawing, cropping, or removing the link to the badge page;
don’t display it in a way that suggests Assay endorses, certifies, audits, or insures your app, or that it is secure. It means specific checks were run and passed on a specific date, which is what the badge page says;
don’t use the Assay name or mark in your own product name, logo, domain, or advertising without written permission.

The badge page is served by us and reflects the current state. A mark can stop being valid without you doing anything — that is deliberate, and it is why the mark is worth showing. We may withdraw permission to display it at any time, and you agree to remove it promptly if we ask.

6. Feedback

If you send us an idea, a bug report, or a suggestion, we may use it to improve Assay without owing you anything for it. You keep whatever rights you already had in it; you are just not charging us for the suggestion.

7. No warranty, and limits

Assay is provided “as is”. It is a best-effort detection tool for known, mechanical misconfigurations — it is not a penetration test, not an audit, and not a certification, and a passing result is not a statement that your app is secure. The disclaimers, liability limits, and indemnities in the Terms of Service apply to everything in this document and are not repeated here.

8. If this licence ends

If your account is closed or suspended, your right to use Assay and to display the hallmark ends immediately, and you must remove the mark from your app. Reports you already generated remain yours to keep and to use. Sections 3, 6 and 7 survive.

License Terms (EULA)