Legal
Scan terms (v1, 9 October 2026)
Version: v1 · Date: 9 October 2026 · Page: nightshiftscan.com/scan-terms
These terms apply to every scan you authorise by replying "I confirm" to our scope email.
Designed to minimise impact: we create only two clearly labelled test accounts, plus a few test records inside them. We don't intentionally access or change anything else. We delete them within 7 days of the report; if your app can't (or only soft-deletes), we send you the account IDs and removal is yours from then. The app, dates and any extra limits for each scan are set out in the scope email you confirm; these terms apply to every scan.
We test only whether one customer's account can reach another's data, from two accounts we create via your normal signup: "Nightshift Scan Test A" and "B" (ns-test-a@ / ns-test-b@nightshiftscan.com).
- Dates: the dates in your scope email. Rate: no more than 2 requests per second, unless your scope email sets a different rate. No load or stress testing.
- Inside our test accounts we may create a few records labelled NIGHTSHIFT TEST. We don't intentionally access or change anything else: no inviting users, messaging anyone, billing or seats, webhooks or integrations, or public posts, nor anything you list in your scope email.
- We don't intentionally read, copy or keep your customers' real data. If we come across any, we stop, keep nothing, and tell you within 24 hours. Proof is limited to row counts, record IDs, tenant IDs and column names.
- If we can't verify your authorisation or ownership, we don't test.
- If signup is closed, paid, or needs a company number, SMS or card, we'll ask you for two test logins instead.
- We delete our accounts within 7 days of the report; if your app can't (or only soft-deletes), we send you the account IDs and removal is yours from then.
- Findings are confidential and sent only to you, from scans@nightshiftscan.com, with one free re-check after your fix.
- Liability limited to €500 or the fees paid, whichever is greater, except for intent or gross negligence.
- You warrant that this testing complies with the terms of your hosting and cloud providers (including Supabase), or that you've told us their limits.
- Reply STOP to halt testing at any time.
Signer: a founder, director or named CTO/security lead. Replies from non-company addresses are verified first.