Terms of use.

The service

Surface reads the public DNS, TLS and HTTP header records of a domain you submit and grades what it finds. It makes a handful of read-only, standard requests and stops. It does not attack, fuzz, or brute-force anything. If a scan finds the Surface badge on a domain’s homepage, Surface rescans that domain automatically about once a week for as long as the badge stays there.

The grade is not a certification

A Surface grade is an automated, informational indication only. It is not an official certification, accreditation, or attestation of any kind, and it is not endorsed by any standards body, regulator, or third party. It reflects a small set of externally visible checks (email authentication, DNS, TLS, HTTP headers, and exposed files) and nothing else.

A grade is not a security audit, penetration test, or compliance assessment, and must never be used or presented as one. It does not examine your applications, code, servers, internal network, access controls, or processes. A high grade does not mean a domain is secure, and you may not describe a grade or badge as proof of security, certification, or compliance in marketing, contracts, questionnaires, or to customers or regulators.

Use you may not make

You agree not to use Surface, or our underlying infrastructure, to:

• —Scan a domain you do not own or have no authority to inspect in a way that is abusive, excessive, or aimed at flooding a target with traffic.
• —Attempt to bypass its rate limits, bot protection, or abuse controls (including by rotating IPs, proxies, or botnets).
• —Launch or proxy attacks — denial-of-service, port scans, exploitation, or any request that would cause harm to a third party.
• —Use it as a free relay or open proxy for outbound traffic.

We may restrict, throttle, or block access at any time if we reasonably believe the service is being misused — including automated, repeated, or distributed scanning that exceeds what a human inspecting a domain would do.

Public reports and removal

Reports are public and show the grade of whatever domain was scanned, whoever ran the scan. If you control a domain and want its stored report deleted, contact the operator through the contact form below and we will remove it.

No warranty

Surface is provided “as is” and “as available”, without warranty of any kind. It reads a changing public record and may be incomplete, delayed, or wrong. A passing report does not mean a domain is secure, and a failing report is not an invitation to attack it. Reports are informational and do not constitute security, legal, or professional advice.

Limitation of liability

To the maximum extent permitted by law, Darinor shall not be liable for any indirect, incidental, or consequential damages arising from your use of the service, including any reliance on a report or any interruption of the service.

Changes

We may update these terms from time to time. Continued use of the service after a change means you accept the updated terms. The date above reflects the latest revision.

Contact

Questions about these terms can be sent to the operator through the contact form.