Terms of Service

These Terms of Service (the “Terms”) are an agreement between you and Boltaic LLC, a Texas limited liability company doing business as Tenant Strike (“Tenant Strike”, “we”, “us”), covering your use of the Tenant Strike websites, dashboard, scanning service, and related services (together, the “Service”). By creating an account, connecting a Microsoft tenant, or otherwise using the Service, you agree to these Terms and to our Privacy Policy.

The Service is built for businesses. You represent that you are using it on behalf of an organization, that you have authority to bind that organization to these Terms, and that you are at least 18 years old. “You” in these Terms means that organization.

Tenant Strike inspects the security configuration of your Microsoft 365 tenant and, on eligible plans, your Azure subscriptions. It authenticates through Microsoft’s admin-consent flow using read-only permissions, runs a battery of configuration checks, and reports findings with recommended fixes. It can also examine your external attack surface — DNS records, TLS certificates, and services exposed on domains you tell us you own.

The Service is read-only: it does not create, modify, or delete anything in your tenant, and it holds no permissions that would let it. How we enforce and prove that is documented on our trust page. Applying any recommended fix is always your action, in your tenant, under your control — see Section 08 on what our recommendations are (and aren’t).

Security scanning is only lawful against systems you own or are authorized to assess. By connecting a tenant or adding a domain, portal URL, or other asset to your account, you represent and warrant that:

• –you own, control, or have explicit authorization from the owner to assess that tenant, subscription, domain, or asset;
• –the Microsoft administrator who grants consent is authorized to do so for that tenant; and
• –your use of the Service and of its reports complies with the laws that apply to you.

You authorize us to access the connected tenant through Microsoft’s APIs using the read-only permissions granted at consent, and to make read-only requests against, and public-data lookups about, the domains and assets you list — for the purpose of providing the Service. You can revoke tenant access at any time from your Microsoft admin center; scanning stops when consent is revoked.

Keep the information on your account accurate, and keep your sign-in credentials confidential. You are responsible for activity that happens under your organization’s account, including activity by teammates you invite. Tell us promptly at [email protected] if you suspect unauthorized access to your account.

Available plans, their features, and current pricing are described on our pricing page. Where these Terms and the pricing page differ on price or plan contents, the pricing page at the time you subscribe controls.

• –Free trial. New accounts may receive a free trial of the Pro plan (currently 7 days). No payment method is required to start. When the trial ends, your account moves to the free tier unless you subscribe — we don’t auto-charge you.
• –Payment. Paid subscriptions bill in advance on a recurring basis through our payment processor, Stripe. We never see or store your card details. Fees are exclusive of taxes; you are responsible for any that apply.
• –Cancellation. You can cancel anytime from the billing portal in your dashboard. Cancellation takes effect at the end of the current billing period, and paid features remain available until then. Except where required by law, fees already paid are non-refundable.
• –Price changes. We may change prices with at least 30 days’ notice; changes apply from your next billing period.
• –Non-payment. If a renewal payment fails and isn’t resolved, paid features pause until it is.
• –Complimentary plans. We may grant free or discounted access at our discretion (for example, to early testers) and may modify or end such grants with reasonable notice.

When using the Service, you agree not to:

• –connect, scan, or add any tenant, subscription, domain, or asset you are not authorized to assess;
• –use the Service or its findings to attack, gain unauthorized access to, or harm any system or person;
• –resell, sublicense, or provide the Service to third parties as your own offering without our written agreement;
• –probe, disrupt, or circumvent the security or usage limits of the Service itself, or access it by automated means outside its intended interfaces;
• –copy, reverse engineer, or create derivative works of the Service except where law grants that right despite this term; or
• –use the Service in violation of applicable law.

We may suspend or limit access immediately if we reasonably believe your use violates this section or threatens the Service or others, and will tell you why when we do.

You retain all rights to the data we read from your tenant and the assets you list (“Customer Data”). You grant us a limited license to collect, store, and process Customer Data solely to provide and secure the Service — running scans, tracking changes over time, alerting you, and supporting you. We do not sell Customer Data, use it for advertising, or use it to train machine-learning models. Our Privacy Policy describes exactly what we collect and how long we keep it.

Scan reports and findings are provided for your organization’s internal use (including sharing with your IT provider or auditors). Aggregated or anonymized statistics that identify neither you nor your tenant may be used to improve the Service and our published research.

Tenant Strike is an automated configuration-assessment tool. It is not a penetration test, a compliance certification, an audit, or a guarantee of security. No scanner finds every weakness, and a clean report does not mean your tenant cannot be compromised. Findings, severity scores, and recommended fixes are informational — evaluate them against your own environment before acting, and make changes to your tenant at your own discretion.

Parts of the Service rely on third-party and public data sources (such as Microsoft’s APIs, vulnerability databases, certificate-transparency logs, and internet-scan datasets) that we don’t control and that may be incomplete, delayed, or inaccurate.

The Service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or will identify every security issue.

To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data, even if advised of the possibility; and (b) our total liability arising out of or relating to the Service is limited to the amounts you paid us for the Service in the 12 months before the event giving rise to the claim (or US $100 if you have paid nothing). These limits do not apply to liability that cannot be limited by law.

You will defend and indemnify us against third-party claims arising from your breach of Section 03 (authorization to scan) or Section 06 (acceptable use), including claims that a scan you directed was not authorized by the system’s owner.

These Terms apply while you use the Service. You may stop using the Service and close your account at any time by emailing [email protected]. We may suspend or terminate your access for material breach of these Terms that isn’t cured within a reasonable time after notice, for non-payment, or if we discontinue the Service (with at least 30 days’ notice and a pro-rated refund of prepaid fees for the unused period).

On closure, we delete Customer Data on the schedule described in our Privacy Policy. Sections that by their nature should survive (including 07–10 and 13) survive termination.

We’re a young product and the Service will evolve; we may add, change, or remove features, and will not materially reduce the core security-scanning functionality of your paid plan mid-period. We may update these Terms from time to time. For material changes we’ll notify you (by email or in the dashboard) at least 14 days before they take effect; continuing to use the Service after that means you accept the updated Terms. The latest version always lives at this page.

These Terms are governed by the laws of the State of Texas and applicable United States federal law, without regard to conflict-of-laws rules, and the state and federal courts located in Texas have exclusive jurisdiction — except that either party may seek injunctive relief in any court of competent jurisdiction.

These Terms plus the Privacy Policy are the entire agreement between us about the Service. If a provision is unenforceable, the rest remains in effect. Failure to enforce a provision is not a waiver. You may not assign these Terms without our consent, except to a successor in a merger or sale of your business; we may assign them to a successor of ours. Neither party is liable for delay or failure caused by events beyond its reasonable control.

Questions about these Terms? Email [email protected] — a human reads it.