Terms of Service

These Terms of Service (the “Terms”) are an agreement between you and Boltaic LLC, a Texas limited liability company doing business as Tenant Strike (“Tenant Strike”, “we”, “us”), covering your use of the Tenant Strike websites, dashboard, scanning service, and related services (together, the “Service”). By creating an account, connecting a Microsoft tenant, or otherwise using the Service, you agree to these Terms and to our Privacy Policy.

The Service is built for businesses. You represent that you are using it on behalf of an organization, that you have authority to bind that organization to these Terms, and that you are at least 18 years old. “You” in these Terms means that organization.

Tenant Strike inspects the security configuration of your Microsoft 365 tenant and, on eligible plans, your Azure subscriptions. It authenticates through Microsoft’s admin-consent flow using read-only permissions, runs a battery of configuration checks, and reports findings with recommended fixes. It can also examine your external attack surface — DNS records, TLS certificates, and services exposed on domains you tell us you own.

The Service is read-only: it does not create, modify, or delete anything in your tenant, and it holds no permissions that would let it. How we enforce and prove that is documented on our trust page. Applying any recommended fix is always your action, in your tenant, under your control — see Section 08 on what our recommendations are (and aren’t).

Security scanning is only lawful against systems you own or are authorized to assess. By connecting a tenant or adding a domain, portal URL, or other asset to your account, you represent and warrant that:

• –you own, control, or have explicit authorization from the owner to assess that tenant, subscription, domain, or asset;
• –the Microsoft administrator who grants consent is authorized to do so for that tenant; and
• –your use of the Service and of its reports complies with the laws that apply to you.

You authorize us to access the connected tenant through Microsoft’s APIs using the read-only permissions granted at consent, and to make read-only requests against, and public-data lookups about, the domains and assets you list — for the purpose of providing the Service. You can revoke tenant access at any time from your Microsoft admin center; scanning stops when consent is revoked.

We offer a free scanner that looks up publicly available information about a domain. It requires no account and no permissions, and it does only what any browser or mail server already does: it reads published DNS records, public domain-registration data, certificate-transparency logs, and files the domain serves publicly for anyone to read. It does not scan ports, attempt to sign in to anything, or connect to anything private.

When you use it, you agree to:

• –enter one domain at a time, through the form, as a person — not through scripts, bulk lists, or automated means;
• –use it to understand your own organization’s exposure, or a domain’s exposure with that owner’s authorization — not for reconnaissance against third parties; and
• –accept that we rate-limit it per visitor and per domain, cache results, and may refuse or withdraw access to it at any time, for any domain, without notice.

The scan itself needs no email address. If you give us one to unlock the rest of a result, we send the results to that address when it belongs to the domain that was scanned, and we may follow up about Tenant Strike. We will not email a report about one domain to an address at another. Unsubscribe in one click from anything we send. Our Privacy Policy covers what that follow-up is, what we keep, and for how long.

Free scan results are provided as-is, describe only what is visible from outside at that moment, and are not a security assessment of any organization. The disclaimers in section 08 apply to them in full.

Keep the information on your account accurate, and keep your sign-in credentials confidential. You are responsible for activity that happens under your organization’s account, including activity by teammates you invite. Tell us promptly at [email protected] if you suspect unauthorized access to your account.

Available plans, their features, and current pricing are described on our pricing page. Where these Terms and the pricing page differ on price or plan contents, the pricing page at the time you subscribe controls.

• –Free trial. New accounts may receive a free trial of the Pro plan (currently 7 days). No payment method is required to start, and nothing is charged during the trial. If you don’t add a payment method, we never charge you — scanning simply pauses when the trial ends until you subscribe. If you do add one during the trial, the plan and billing interval you selected start automatically when the trial ends, at the price shown when you added it.
• –Payment. Paid subscriptions bill in advance on a recurring basis — monthly or yearly, per your selection — through our payment processor, Stripe. We never see or store your card details. Fees are exclusive of taxes; you are responsible for any that apply.
• –Cancellation. You can cancel anytime from the billing portal in your dashboard. Cancellation takes effect at the end of the current billing period — the month for monthly plans, the annual term for yearly plans — and paid features remain available until then. Except where required by law (and our 30-day first-payment guarantee on the pricing page), fees already paid are non-refundable, including the remainder of a yearly term.
• –Price changes. We may change prices with at least 30 days’ notice; changes apply from your next billing period.
• –Non-payment. If a renewal payment fails and isn’t resolved, paid features pause until it is.
• –Complimentary plans. We may grant free or discounted access at our discretion (for example, to early testers) and may modify or end such grants with reasonable notice.

When using the Service, you agree not to:

• –connect, scan, or add any tenant, subscription, domain, or asset you are not authorized to assess;
• –use the Service or its findings to attack, gain unauthorized access to, or harm any system or person;
• –resell, sublicense, or provide the Service to third parties as your own offering without our written agreement;
• –probe, disrupt, or circumvent the security or usage limits of the Service itself, or access it by automated means outside its intended interfaces;
• –copy, reverse engineer, or create derivative works of the Service except where law grants that right despite this term; or
• –use the free external scanner for reconnaissance against domains you have no authorization to assess, or drive it by script, bulk list, or any means other than its form; or
• –use the Service in violation of applicable law.

We may suspend or limit access immediately if we reasonably believe your use violates this section or threatens the Service or others, and will tell you why when we do.

You retain all rights to the data we read from your tenant and the assets you list (“Customer Data”). You grant us a limited license to collect, store, and process Customer Data solely to provide and secure the Service — running scans, tracking changes over time, alerting you, and supporting you. We do not sell Customer Data, use it for advertising, or use it to train machine-learning models. Our Privacy Policy describes exactly what we collect and how long we keep it.

Scan reports and findings are provided for your organization’s internal use (including sharing with your IT provider or auditors). Aggregated or anonymized statistics that identify neither you nor your tenant may be used to improve the Service and our published research.

Tenant Strike is an automated configuration-assessment tool. It is not a penetration test, a compliance certification, an audit, or a guarantee of security. No scanner finds every weakness, and a clean report does not mean your tenant cannot be compromised. Findings, severity scores, and recommended fixes are informational — evaluate them against your own environment before acting, and make changes to your tenant at your own discretion.

Parts of the Service rely on third-party and public data sources (such as Microsoft’s APIs, vulnerability databases, certificate-transparency logs, and internet-scan datasets) that we don’t control and that may be incomplete, delayed, or inaccurate.

The Service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or will identify every security issue.

To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data, even if advised of the possibility; and (b) our total liability arising out of or relating to the Service is limited to the amounts you paid us for the Service in the 12 months before the event giving rise to the claim (or US $100 if you have paid nothing). These limits do not apply to liability that cannot be limited by law.

You will defend and indemnify us against third-party claims arising from your breach of Section 03 (authorization to scan) or Section 06 (acceptable use), including claims that a scan you directed was not authorized by the system’s owner.

These Terms apply while you use the Service. You may stop using the Service and close your account at any time by emailing [email protected]. We may suspend or terminate your access for material breach of these Terms that isn’t cured within a reasonable time after notice, for non-payment, or if we discontinue the Service (with at least 30 days’ notice and a pro-rated refund of prepaid fees for the unused period).

On closure, we delete Customer Data on the schedule described in our Privacy Policy. Sections that by their nature should survive (including 07–10 and 13) survive termination.

We’re a young product and the Service will evolve; we may add, change, or remove features, and will not materially reduce the core security-scanning functionality of your paid plan mid-period. We may update these Terms from time to time. For material changes we’ll notify you (by email or in the dashboard) at least 14 days before they take effect; continuing to use the Service after that means you accept the updated Terms. The latest version always lives at this page.

These Terms are governed by the laws of the State of Texas and applicable United States federal law, without regard to conflict-of-laws rules, and the state and federal courts located in Texas have exclusive jurisdiction — except that either party may seek injunctive relief in any court of competent jurisdiction.

These Terms plus the Privacy Policy are the entire agreement between us about the Service. If a provision is unenforceable, the rest remains in effect. Failure to enforce a provision is not a waiver. You may not assign these Terms without our consent, except to a successor in a merger or sale of your business; we may assign them to a successor of ours. Neither party is liable for delay or failure caused by events beyond its reasonable control.

Questions about these Terms? Email [email protected] — a human reads it.