Terms of Service & Acceptable Use
Effective Date: September 2026 • Version 1.0 • RootLayer Trust Framework
Mandatory Authorization Requirement
You must ONLY scan files or audit websites that you own, or for which you have received express, documented authorization from the owner. Scanning third-party web assets without consent may violate applicable computer misuse laws, including India's Information Technology Act, the US Computer Fraud and Abuse Act (CFAA), and equivalent international legislation.
1. Permitted Use Cases
RootLayer is designed exclusively for defensive, educational, and audit hygiene purposes, including:
- Checking documents, PDFs, or archives received via email for macro risks or embedded scripts.
- Auditing your own company web application for missing HTTP security headers (CSP, HSTS, X-Frame-Options).
- Evaluating cookie security flags and SSL/TLS configuration best practices.
- Checking suspicious links for brand impersonation and executable payloads.
2. Strictly Prohibited Activities
You agree not to use the RootLayer platform for:
- Attempting denial-of-service (DoS/DDoS) attacks or bombarding target websites with excessive requests.
- Uploading zero-day exploit payloads or weapons with intent to distribute.
- Automating high-frequency reconnaissance against unauthorized third-party infrastructure.
- Attempting to bypass our rate limiters or reverse engineer proprietary scanners.
3. Disclaimer of Warranties
RootLayer performs non-destructive passive reconnaissance, header inspection, and heuristic checks. While our engines detect a wide spectrum of known risks, static analysis cannot guarantee the total absence of security vulnerabilities or zero-day threats. The platform and its assessment reports are provided "AS IS" without warranties of any kind.
If you have questions regarding these terms, please contact legal counsel at legal@rootlayer.io.