1. The service
Assay fetches a web app you point us at, inspects what it already serves to browsers (its pages, its JavaScript bundles, its response headers) and runs bounded, read-only checks for common security problems — exposed keys, an open database, missing protections. It then explains what it found in plain language and, where it can, gives you the exact change to make. Assay is a best-effort detection tool, not a guarantee.
Three other documents form part of this agreement and are worth reading: our License Terms (who owns a report, and the rules for displaying the hallmark), our Acceptable Use Policy, and our Copyright & DMCA Policy. What we do with your data is set out separately in the Privacy Policy.
2. Your account
You sign in with a code we email you, or with GitHub. There is no password. You’re responsible for activity under your account, and for keeping access to the email address it uses — anyone who can read that inbox can sign in as you.
You must be at least 16 years old to use Assay.If you are under 18, you may only use it with the involvement of a parent or guardian, who accepts these terms with you and is responsible for any paid plan. We don’t knowingly collect data from anyone under 16 — tell us at hello@assaysecurity.com if that has happened and we’ll delete it.
3. Scan only what you own
You may submit a URL for scanning onlyif you own the app or are explicitly authorized to test it. Scanning apps you don’t control may be illegal and is a breach of these terms. Our Acceptable Use Policy is part of this agreement; read it.
4. No security guarantee
A passing result (“Certified” or the hallmark) means Assay did not find the specific issues it checks for at the time of the scan. It is nota warranty that your app is secure, and it is not a substitute for a professional security audit. Apps change; verification ages. New issues can appear that Assay does not check for. You remain responsible for your app’s security. Assay is provided “as is,” without warranties of any kind. Reports and badges are provided for your own informational use; Assay disclaims any duty of care to, and any liability toward, anyone other than the account holder who requested the scan — including third parties who view a shared report or badge link.
5. Plans and billing
Paid plans are not currently available to buy — every account is on the free tier, and nothing on this site can charge you today. The rest of this section, and the refund policy below, describe how billing works when it opens. Say so plainly rather than leave a section that reads as though a purchase is possible.
Assay has a free tier and paid plans. Paid plans are billed monthly in advance and renew until you cancel. Payments are processed by Lemon Squeezy, which is the merchant and seller of record for every paid plan: your purchase contract for the transaction is with Lemon Squeezy, they issue your invoice, and they collect any VAT or sales tax due in your country. Lemon Squeezy’s own terms apply to the payment alongside these terms. You can cancel any time from your billing page; access continues until the end of the paid period, and you are not charged again. We may change prices with notice, and any change applies only to future billing periods — never to one you have paid for.
6. Refunds
If Assay isn’t what you expected, email hello@assaysecurity.com within 14 days of a charge and we will refund it in full. No conditions and no explanation required. This applies to your first payment and to any renewal.
Refunds are issued by Lemon Squeezy, the seller of record, back to the original payment method — typically within 5–10 business days depending on your bank. You may also request a refund directly from Lemon Squeezy using the receipt they emailed you.
Beyond that window, a subscription can be cancelled at any time to stop future charges, and we’ll still consider a refund if something went wrong on our side — a failed scan you were billed for, a duplicate charge, or a renewal you had already cancelled. Nothing here limits any refund right you have under the consumer law of your own country. The full policy, in plain language, is at assaysecurity.com/refunds.
7. Acceptable use & limits
Don’t abuse the service: no scanning of apps you don’t own, no attempts to overload or circumvent rate limits, no use of Assay to attack or exploit any system. We rate-limit and meter scans, and we may suspend accounts that break these rules.
8. Indemnification
You agree to indemnify and hold Assay and its operators harmless from any claim, loss, or expense (including reasonable legal fees) arising from: your breach of these terms; your scanning of an app you don’t own or aren’t authorized to test; or a third party’s reliance on a report or badge you shared, generated, or embedded.
9. Limitation of liability
To the maximum extent permitted by law, Assay and its operators aren’t liable for indirect, incidental, or consequential damages, or for any loss arising from a security issue Assay did not detect. Our total liability for any claim is limited to the greater of (a) the amount you paid us in the three months before the claim, or (b) US$100.
Some countries don’t allow the exclusion of certain warranties or liabilities. Where that’s the case, the limits above apply only as far as that law permits, and nothing here removes a right you can’t contract out of — including liability for fraud, death, or personal injury caused by negligence.
10. Termination
You can stop using Assay and delete your account at any time. We may suspend or terminate access for breach of these terms. Sections that by their nature should survive termination (disclaimers, liability limits) will survive.
11. Changes
We may update these terms; we’ll change the date above and, for material changes, give reasonable notice. Continued use after a change means you accept the updated terms.
12. Contact & governing law
Assay is operated by Aynur Əliyeva, based in Baku, Azerbaijan Republic. These terms are governed by the laws of the Azerbaijan Republic, and the courts of Baku have jurisdiction over any dispute — except where the consumer law of your own country gives you the right to bring a claim locally, which nothing here takes away. Questions go to hello@assaysecurity.com.