These Terms of Use govern the travisasm.com website and, unless you have a signed agreement with us, your use of the TRaViS External Attack Surface Management service (the "Service"), a product of Seron Security, Inc. ("Seron," "we," "us"). Read section 6 carefully. It is the one that matters most for a scanning tool: you may only point TRaViS at systems you own or are authorized to test.
By browsing travisasm.com, submitting a form, starting a pilot, or logging in to the Service, you agree to these Terms and to our Privacy Policy and Cookie Policy. If you use the Service on behalf of an organization, you confirm you have authority to bind it, and "you" means that organization.
If there is a conflict, documents apply in this order: (1) a signed Order Form or Master Services Agreement, including its Service Level Agreement and Data Processing Agreement; (2) a signed Partner Agreement for MSP and MSSP partners; (3) these Terms; (4) our published policies. A signed agreement replaces sections 5 through 18 of these Terms for the Service, but sections 2 and 6 always apply.
You may view, download, and print pages from this site for your own evaluation and internal business use. You may not copy the site or its content for commercial redistribution, frame it, scrape it at volume, probe or test it for vulnerabilities except under our responsible-disclosure program, interfere with its operation, or use it to send unsolicited messages. Automated crawlers may access the site as permitted in our robots.txt.
Site content is for general information. Statistics, examples, and descriptions of what TRaViS finds are illustrative and do not promise a result for your environment. We may change or remove content at any time. Links to third-party sites are provided for convenience; we do not control or endorse them.
If you send us ideas, suggestions, or feedback about the site or the Service, you grant us a perpetual, royalty-free right to use them without obligation to you.
The Service is for businesses and their personnel. You must be at least 18 and able to form a binding contract. You are responsible for your Users, for keeping credentials confidential, and for everything done under your account. Multi-factor authentication is mandatory and may not be disabled. Tell us at once at security@travisasm.com if you suspect unauthorized access.
TRaViS discovers and monitors your externally exposed assets, identifies exposures, credentials, and misconfigurations, prioritizes them with AI assistance, and supports you with a human security team. Features, scan frequency, and limits depend on the plan in your Order. Subject to these Terms and payment, we grant you a non-exclusive, non-transferable, revocable right to access and use the Service during the term for your own internal security purposes, or, if you are a Partner, for the clients named in your Partner Agreement.
Unlimited on-demand scanning and reasonable use. On-demand scans are not metered, not capped by number, and are never billed per scan, per asset, or per host. Scheduled monitoring runs on the cadence set by your plan. In return, you will use scanning for the genuine security assessment of your own estate, or, if you are a Partner, of the clients named in your Partner Agreement. We may queue, rate-limit, or stagger scans to protect platform stability and the service of other customers. If your use is sustained and materially disproportionate to the size of your surface, or the Service is used as a general-purpose scanning engine rather than to assess your own exposure, we will contact you, and we may throttle scanning or ask you to move to a plan that fits the usage. We will not apply per-scan charges, and we will not invoice retroactively for scanning already performed.
This section is a condition of using the Service.
You will not: use the Service to assess, attack, or gain access to any system you are not authorized to test; use findings to harm, extort, or gain unauthorized access to anyone; resell, sublicense, or provide the Service to third parties except as a Partner; reverse engineer, decompile, or attempt to extract the models, signatures, or source code of the Service; use the Service or its output to build a competing product or to train a model; circumvent scan limits, plan boundaries, or security controls; upload malicious code; or use the Service in violation of any law. Direct plans cover your own estate; monitoring multiple unaffiliated client organizations requires a Partner Agreement.
We may offer a time-limited pilot, typically 14 days. Pilots are provided as-is, may be limited in scope, may be ended by us at any time, and carry no service-level commitment or guarantee. Sections 6, 7, 10, and 16 apply in full to pilots. If you do not convert to a paid plan, we delete pilot data within 30 days after the pilot ends. Our aggregate liability for a pilot is limited to USD 100.
You own Customer Data. You grant us a non-exclusive license to host, process, transmit, and display it solely to provide and support the Service, to protect the Service and its users, and as required by law. We do not sell Customer Data, we do not send it to third-party AI providers, and we do not use it to train any third-party model. We may use de-identified and aggregated data that cannot identify you or your Targets to improve detection and to publish statistics. Customer Data is processed in the United States in a per-customer isolated environment. On expiry or termination we will export Customer Data at your request and destroy it within 30 days, except for backups that expire on schedule and records the law requires us to keep. Personal data in Customer Data is processed under our Privacy Policy and, where signed, a Data Processing Agreement.
Each party will protect the other's confidential information with at least the care it uses for its own, and no less than reasonable care, will use it only to perform under these Terms, and will not disclose it except to personnel and advisers who need it and are bound to confidentiality. Findings are your confidential information. The Service's design, models, and pricing are ours. These obligations survive five years after termination, and indefinitely for trade secrets and security findings. Disclosure required by law is permitted with prompt notice where lawful.
You may use reports internally and share them with your auditors, regulators, insurers, board, and the advisers or Partners who support your program. You may not publish reports or excerpts as a comparative claim about TRaViS or as an assertion that a system is secure. Reports reflect the state of the public-facing Targets at the time of the scan and are not a certification, an audit opinion, or a penetration test unless separately contracted.
The Service, including its software, models, detection logic, taxonomy, documentation, and the TRaViS and Seron Security names and marks, is owned by Seron and its licensors and protected by intellectual-property law. No rights are granted except those stated in these Terms. You may not remove proprietary notices. Partners may present reports under their own brand only as permitted in the Partner Agreement.
TRaViS uses machine learning to discover, classify, and prioritize findings. Those outputs can be incomplete, out of date, or wrong. They are decision support for a qualified security team, not a substitute for one. You are responsible for validating a finding before taking action that could disrupt a production system, and for your remediation decisions.
We warrant that the Service will perform materially as described in the Order and that we will provide it with reasonable skill and care. Your exclusive remedy for breach of this warranty is that we re-perform the affected service or, if we cannot, credit or refund the fees for the affected period as set out in the applicable Service Level Agreement.
Except as stated above, the Service and this site are provided "as is" and "as available." We disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. No security tool finds everything. We do not warrant that the Service will identify every exposure, that Targets will be free of vulnerabilities, that the Service will be uninterrupted or error-free, or that it will prevent any incident, breach, or loss. Some jurisdictions do not allow certain disclaimers, so parts of this section may not apply to you.
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, arising from these Terms or the Service, even if advised of the possibility. Each party's total liability for all claims arising from these Terms in any 12-month period is limited to the fees you paid or owed for the Service in the 12 months before the event giving rise to the claim, or USD 100 for free use of the site or a pilot. These limits do not apply to your breach of section 6 or 7, either party's indemnification obligations, a party's fraud or willful misconduct, or liability that cannot be limited by law. If your Order states different limits, the Order governs.
By you. You will defend and indemnify Seron and its officers, employees, and contractors against third-party claims, and the resulting damages, penalties, and reasonable legal costs, arising from Targets that you were not authorized to have assessed, from your or your Users' breach of sections 6 or 7, from a Partner's relationship with its clients, or from your unlawful use of the Service or its output.
By us. We will defend you against a third-party claim that the Service, used as permitted, infringes a United States patent, copyright, or trademark, and will pay the resulting damages and costs finally awarded. If such a claim arises we may modify or replace the Service or, if that is not commercially reasonable, terminate it and refund prepaid fees for the unused term. This does not cover claims arising from Customer Data, your Targets, or combinations with products we did not supply.
The indemnified party must give prompt notice, allow the indemnifying party to control the defense and settlement (no settlement may impose obligations on the indemnified party without its consent), and cooperate reasonably.
These Terms apply while you use the site or the Service. Subscriptions run for the term in the Order. Either party may terminate for a material breach that is not cured within 30 days of written notice, or immediately if the other party becomes insolvent. We may suspend the Service immediately, with notice as soon as practicable, if we reasonably believe your use threatens the Service, another customer, or a third party, or violates section 6 or 7. On termination your access ends, unpaid fees for the remaining term become due unless we terminated without cause, and section 10 governs your data. Sections 2, 6 (as to past activity), 10 through 13, and 15 through 21 survive.
The Service is subject to United States export-control and sanctions laws. You represent that you and your Targets' owners are not located in, organized under, or ordinarily resident in a country or region subject to comprehensive US sanctions, and are not on any US government restricted-party list. You will not use or export the Service in violation of those laws. If you are a US government entity, the Service is commercial computer software provided with only the rights set out here.
These Terms are governed by the laws of the State of New Hampshire and the federal laws of the United States, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Before filing a claim, a party will give written notice and the parties will attempt in good faith to resolve the dispute for 30 days. Any claim not resolved will be brought exclusively in the state or federal courts sitting in Merrimack County, New Hampshire, and each party consents to that jurisdiction and venue, except that either party may seek injunctive relief in any court to protect its intellectual property or confidential information. Each party waives trial by jury to the extent permitted by law.
These Terms, with the documents listed in section 1, are the entire agreement on their subject and replace prior proposals and communications. Purchase-order terms are void. You may not assign these Terms without our written consent, except to a successor in a merger or sale of substantially all assets that assumes them in writing; we may assign to an affiliate or successor. Neither party is liable for delay caused by events beyond its reasonable control, other than payment obligations. Notices to us go to legal@travisasm.com with a copy by post to the address below; notices to you go to your account email. If a provision is unenforceable the rest remains in effect. A waiver must be in writing. The parties are independent contractors. We may identify you as a customer by name and logo in customer lists unless you tell us in writing not to.
We may revise these Terms. We will post the revised version with a new date and, for material changes affecting active subscriptions, notify you by email or in the platform at least 30 days before they take effect. Changes do not apply retroactively to a term already paid unless required by law. Continued use after the effective date is acceptance.
Questions about these Terms: legal@travisasm.com. Seron Security, Inc., Attn: Legal, 2 Smokey Road, Bow, NH 03304, USA. Phone: 617.855.0005.