Varaxon Scan Hub — Terms of Service

Document set version: v1.0, effective September 11, 2026
Last updated: September 11, 2026
Provider: Varaxon Technologies LLC
Service: Varaxon Scan Hub and related Varaxon websites at varaxontech.com and scan.varaxontech.com
Contact: support@varaxontech.com

These Terms of Service ("Terms") govern access to Varaxon Scan Hub and related Varaxon websites (the "Service"). By creating an account, using the Service, or accepting these Terms at checkout, you agree to them. If you do not agree, do not use the Service.

1. The Service

Varaxon Scan Hub accepts authorized Nessus and Greenbone exports, applies deterministic prioritization and security-data enrichment, and generates assessment reports. Reports are decision-support outputs, not a guarantee that a system is secure and not a substitute for professional security, legal, or compliance judgment.

The Service is initially offered for U.S. business use. By creating an account or purchasing a plan, you represent that you are located in, and are using the Service from, the United States unless Varaxon has agreed otherwise in writing. Any expansion to additional jurisdictions may require additional terms or privacy disclosures.

The Service is not represented as compliant with HIPAA, FISMA, GLBA, or any other industry-specific security or privacy framework unless Varaxon expressly agrees otherwise in a written customer agreement. You are responsible for determining whether the Service is suitable for your use, for obtaining any required authorizations, and for meeting obligations that apply to your business or client.

Business use

The Service is intended for business and professional use. It is not intended or offered for personal, family, or household purposes.

Data you may not upload

Unless a separate written agreement with Varaxon expressly permits it, you may not upload or submit to the Service:

protected health information;
payment-card data;
classified or controlled government information;
export-controlled technical data; or
personal data subject to European Union, United Kingdom, or Swiss transfer restrictions.

This restriction concerns the categories of data you submit, not the industry you work in. Varaxon does not restrict who may use the Service, and you may use it in healthcare, financial, or government engagements provided your uploads stay within the limits above. You are responsible for determining what an export contains before you upload it.

Anonymous pre-flight assessment

The Service offers a pre-flight assessment that accepts a scan upload without an account. If you use it, you represent that you are authorized to submit the scan and to have it processed. Your use is governed by these Terms and by the Privacy Policy's pre-flight notice, and you remain responsible for the data you submit.

The Data Processing Addendum does not apply to a pre-flight upload made without an account, because no customer has accepted that Addendum for it. If you require Data Processing Addendum coverage, create an account and accept the Addendum before submitting data.

2. Authorized security testing and customer warranty

You may upload or process scan exports only when you are authorized to assess the systems and data represented in them. You warrant that you have that authorization, that your use complies with applicable law and your customer agreements, and that you will not use the Service to facilitate unauthorized access, scanning, exploitation, or surveillance. Varaxon does not grant permission to access or test any system.

Indemnity

You will defend and indemnify Varaxon from third-party claims, losses, and reasonable costs to the extent caused by:

your unauthorized scanning or testing of a system;
your unlawful use of the Service;
your breach of the authorization warranties in this Section; or
your infringement of another party's rights.

This indemnity does not apply to any claim to the extent it is caused by Varaxon's own negligence, willful misconduct, fraud, or breach of these Terms.

Your aggregate liability under this indemnity will not exceed the greater of (a) the fees you paid to Varaxon for the Service during the 12 months before the event giving rise to the claim or (b) $100 — the same limit that applies to Varaxon under Section 11. That cap does not apply to your fraud or intentional unlawful conduct, for which your liability under this indemnity is not limited by this paragraph.

Varaxon will notify you promptly of a claim for which it seeks indemnity, allow you to control the defense of that claim with counsel of your choosing, and provide reasonable cooperation at your expense. Varaxon may participate with its own counsel at its own cost. You may not settle a claim in a way that imposes an obligation or admission on Varaxon without its written consent.

3. Customer data and reports

You retain ownership of uploaded scan exports, customer-provided data, and the reports generated from that data. Varaxon receives only the limited license needed to process the data, provide the Service, secure the Service, and support your account. Varaxon does not claim ownership of scan exports or reports and will not sell them or use them for advertising or AI training.

You may use, download, and deliver generated reports to the end customer or other authorized recipient whose systems were assessed. You are responsible for confirming that the recipient is authorized to receive the report and for protecting the report after download.

Product feedback that you voluntarily send to Varaxon may be used to improve the Service. Feedback does not include uploaded scan exports, reports, credentials, or confidential customer information, and the feedback license does not transfer ownership of Customer Data.

4. Accounts, email, and API keys

You must provide accurate account information, protect your password, and promptly revoke or rotate a key you believe is exposed. Accounts are identified by email address; the Service does not use public usernames. API keys may be used by your authorized tooling, including automated jobs, to submit scans within your plan and rate limits. Do not share keys outside your organization or embed them in public code.

You must be at least 18 years old and legally able to enter these Terms. The Service is not directed to children.

5. Plans, free reports, credits, and payment

Automatic renewal disclosure

YOUR SUBSCRIPTION RENEWS AUTOMATICALLY. Unless you cancel before the end of your current billing period, your subscription will automatically renew for another period of the same length, and the payment method on file will be charged the then-current price for that plan. You may cancel at any time, effective at the end of the current paid billing period, from the billing page of your account — see Section 6 for the cancellation steps.

The plan price, billing frequency, included report allowance, and next renewal date are shown before checkout and in the account billing surface. We charge the payment method through Stripe. Stripe hosts payment-card entry; Varaxon does not receive or store card numbers or security codes.

Renewal reminders

For any subscription whose renewal term is longer than 60 days, Varaxon will send a renewal reminder to the email address associated with the account at least 15 days and no more than 45 days before the renewal date. The reminder will state the renewal date, the amount to be charged, and how to cancel. Varaxon will also send a reminder at least once every 12 months to any account on a continuing subscription of any term length.

Price changes

Varaxon will give clear and conspicuous notice of any price increase or other material change to a plan at least 30 days before it takes effect. A price increase will not be charged to an existing subscription without the account holder's affirmative consent. If the account holder does not consent, the subscription will continue at the existing price until the end of the current paid period and will then end rather than renew at the higher price, unless the account holder cancels sooner.

Free reports and credits

Verified accounts may receive the free reports and credits described in the current product offer. The free tier does not require a payment card and never converts to a paid subscription automatically. Pay-as-you-go reports and purchased credits are subject to the limits shown at purchase.

Purchased credits are prepaid entitlements to receive the Service. They are not cash, a deposit, a stored-value instrument, or a payment instrument; they are not transferable; and they are not redeemable for cash except where applicable law requires it.

Purchased credits do not expire while the account remains in good standing. For this purpose, good standing means that the account is active and has not been suspended or terminated for fraud, abuse, unauthorized use, or material breach; cancelling a subscription alone does not remove an account from good standing.

Non-payment alone does not forfeit purchased credits. Varaxon may suspend an account for non-payment, and credits remain available when the account is restored. Unused purchased credits are forfeited only where Varaxon terminates an account for documented fraud, abuse, unauthorized use, or serious material breach, and except where applicable law requires otherwise. Purchased credits are not refundable except as stated in the Cancellation and Refund Policy or required by law.

The Cancellation and Refund Policy is incorporated into these Terms.

6. Cancellation and termination

If you subscribed online, you may cancel online. A cancellation control is available in the billing page of your account, and reaching it does not require you to call, email, chat, or speak with anyone. Selecting it cancels the subscription; Varaxon may show an alternative offer during that flow, but a direct link to complete the cancellation will remain visible alongside it. You may also cancel by emailing support@varaxontech.com from the address associated with the account, but you are not required to do so.

Cancellation takes effect at the end of the current paid billing period, and the subscription will not renew after that period. The detailed refund and credit rules are in the Cancellation and Refund Policy.

Varaxon may suspend or terminate access for non-payment, fraud, abuse, unauthorized testing, security risk, or material breach. If Varaxon terminates a prepaid subscription without customer fault or discontinues a paid plan, Varaxon will provide a pro-rata refund for the unused prepaid period unless applicable law or the customer agreement requires a different remedy.

Discontinuing a paid plan means retiring a plan tier or materially removing the functionality that plan was contracted to provide. A change that applies only to new customers is not a discontinuation, provided existing prepaid customers continue to receive the service they contracted for through the end of their paid period.

7. Acceptable use

You may not:

upload data without authorization or use the Service for unlawful access, scanning, exploitation, or surveillance;
upload malware or content intended to compromise the Service;
bypass authentication, rate limits, upload limits, or other security controls;
interfere with the Service or impose an unreasonable load;
use another person's account or expose credentials or API keys;
reverse engineer or copy the Service except where applicable law permits; or
use the Service to violate another person's privacy, confidentiality, intellectual-property rights, or applicable law.

Automated use through your authorized API keys is permitted within the published API, plan, and rate limits. You may use the Service in your commercial business and may deliver reports to authorized clients; you may not copy or resell the Service itself.

8. Intellectual property

Varaxon owns the Service, its software, documentation, visual design, trademarks, and service marks. Subject to these Terms, Varaxon grants you a limited, non-exclusive, non-transferable license to access and use the Service and download reports for your authorized business and client work. No rights are granted except those expressly stated.

9. Privacy and data processing

The Privacy Policy describes Varaxon's handling of account, billing, security, support, and service information. For customer-uploaded data processed on a customer's behalf, the Data Processing Addendum applies and controls over these Terms on data-protection matters. The Cancellation and Refund Policy and the DPA are part of the agreement; the entire-agreement clause below is subject to them.

10. Availability and disclaimers

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE AND REPORTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE FULLEST EXTENT PERMITTED BY LAW, VARAXON DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND DOES NOT WARRANT UNINTERRUPTED AVAILABILITY, ERROR-FREE OPERATION, OR THAT A REPORT IDENTIFIES EVERY VULNERABILITY.

Independent validation and customer responsibility

The Service and reports are automated decision-support tools. You are solely responsible for ensuring that uploaded data is authorized, accurate, complete, and current; for independently validating findings and outputs; for determining whether and how to act on them; for obtaining professional advice when appropriate; and for making all security, remediation, legal, compliance, operational, and business decisions.

Reports may contain false positives, false negatives, omissions, or incomplete information, and must not be used as the sole basis for a material decision.

To the fullest extent permitted by law, you are responsible for decisions made from your use of the Service, subject to liability that cannot lawfully be disclaimed or limited.

You also remain responsible for protecting downloaded reports and for maintaining your own business records. Varaxon does not promise that it maintains backups of every account record or report.

Insurance

You are responsible for determining and maintaining insurance appropriate to your systems, data, security obligations, and use of reports.

11. Liability

To the fullest extent permitted by law, Varaxon will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or business opportunity. Varaxon's aggregate liability for claims arising from the Service will not exceed the greater of (a) the fees you paid to Varaxon for the Service during the 12 months before the event giving rise to the claim or (b) $100. This limitation does not apply where prohibited by law or to liability that cannot legally be limited.

Risk allocation

The parties agree that the disclaimers, exclusions, and liability limits in these Terms are material terms of the bargain and reflect the allocation of risk, pricing, and availability of the Service. Nothing in this Section limits liability that cannot lawfully be limited.

12. Disputes and governing law

Informal resolution first

Before starting an arbitration or a lawsuit, the party raising the dispute will send written notice describing it to the other party and the parties will attempt to resolve it informally for 30 days. Notice to Varaxon goes to support@varaxontech.com.

Binding arbitration

If the dispute is not resolved within those 30 days, it will be resolved by final and binding arbitration rather than in court, except for the claims carved out below. The arbitration will be administered by the American Arbitration Association under its Commercial Arbitration Rules, or under its Consumer Arbitration Rules where those rules apply by their own terms. The arbitration will take place in North Carolina, or by remote hearing if the parties agree. The arbitrator's award may be entered as a judgment in any court with jurisdiction.

What is not covered

Either party may (a) bring an individual claim in a small claims court with jurisdiction, and (b) seek emergency injunctive relief or enforce intellectual-property rights in a court with jurisdiction, without first arbitrating.

Class action and jury waivers

BOTH PARTIES WAIVE THE RIGHT TO A TRIAL BY JURY.

BOTH PARTIES AGREE TO BRING CLAIMS ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate the claims of more than one person and may not preside over any form of representative proceeding. If this paragraph is found unenforceable as to a particular claim, that claim — and only that claim — will be decided in court rather than in arbitration, and the rest of this Section 12 will remain in effect.

Rights that cannot be waived

Nothing in this Section waives any right or remedy that applicable law does not permit to be waived, and a customer who is not acting in a business capacity retains every such right and remedy, including the right to bring a matter before a government agency.

Governing law

These Terms are governed by North Carolina law, excluding conflict-of-law rules.

13. Miscellaneous

Confidentiality

Each party may receive information of the other that is marked confidential or that a reasonable person would understand to be confidential from its nature or the circumstances of disclosure ("Confidential Information"). Each party will use the other's Confidential Information only to perform under these Terms, will protect it with at least the care it uses for its own confidential information of like importance, and will not disclose it except to personnel and contractors who need it and are bound by confidentiality obligations at least as protective as these.

Confidential Information does not include information that is or becomes public without breach of this Section, was known to the receiving party without a duty of confidence before disclosure, is received from a third party without a duty of confidence, or is independently developed without use of the disclosing party's Confidential Information. A party may disclose Confidential Information where required by law or legal process, and will, where lawful and practicable, give the other party advance notice and a reasonable opportunity to seek protective treatment.

Customer Data uploaded to the Service is Customer's Confidential Information and is also governed by the Data Processing Addendum, which controls on data-protection matters. These obligations continue for three years after the information is disclosed, and indefinitely for anything that qualifies as a trade secret.

Export control and sanctions

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions, and that you are not a person or entity identified on any U.S. government restricted-party list, including the Specially Designated Nationals and Blocked Persons List administered by the U.S. Department of the Treasury's Office of Foreign Assets Control. You will not access, use, export, re-export, or make the Service available in violation of U.S. export control or economic sanctions laws, and you will not permit any person subject to those restrictions to use the Service through your account or your API keys. Varaxon may suspend or terminate access it reasonably believes is required to comply with these laws.

Force majeure

Varaxon is not responsible for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, governmental action, internet or telecommunications failures, or outages or failures of third-party providers.

Assignment

You may not assign or transfer these Terms without Varaxon's prior written consent. Varaxon may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of substantially all of its assets, provided the assignee assumes the applicable obligations.

No waiver

A failure to enforce any provision is not a waiver of the right to enforce that provision later. A waiver must be in writing and applies only to the specific instance stated.

Survival

Sections concerning customer data and reports, intellectual property, payment obligations, acceptable use, disclaimers, liability, disputes, confidentiality, export control and sanctions, indemnity, and any provision that by its nature should survive termination will survive termination or expiration of these Terms.

Notices and electronic communications

Operational notices may be sent to the email address associated with your account or posted in the Service. Legal notices to Varaxon must be sent to support@varaxontech.com and, when appropriate, to the mailing address in Section 14. You consent to receive agreements, notices, disclosures, and records electronically. You may withdraw consent by closing your account, but doing so may prevent continued use of the Service.

Third-party beneficiaries

Except for a permitted assignee, these Terms do not create any third-party beneficiary rights. An end customer or other recipient of a report does not become a party to these Terms and may not enforce them solely because it received or relied on a report.

Entire agreement and severability

These Terms, the Privacy Policy, the Cancellation and Refund Policy, the Data Processing Addendum, and any applicable order form constitute the agreement between you and Varaxon concerning the Service. If a provision is unenforceable, the remainder remains effective. Varaxon may update these Terms by posting a revised version and, for material changes, providing notice as required by law or the customer agreement.

14. Contact

Varaxon Technologies LLC
5372 Washington St
Camp Lejeune, NC 28547
United States
support@varaxontech.com