Varaxon TechnologiesSign in

Varaxon Scan Hub — Terms of Service

Document set version: v3.5, effective October 27, 2026
Last updated: October 27, 2026
Provider: Varaxon Technologies LLC
Service: Varaxon Scan Hub and related Varaxon websites at varaxontech.com and scan.varaxontech.com
Contact: support@varaxontech.com

These Terms of Service ("Terms") govern access to Varaxon Scan Hub and related Varaxon websites (the "Service"). You agree to them by checking the box to accept them when you create an account, by accepting them at checkout, or by using the Service. Varaxon records the version you accepted. If you do not agree, do not use the Service.

1. The Service

Varaxon Scan Hub turns authorized vulnerability data into prioritized assessment reports. It accepts uploaded exports from network, host, and web vulnerability scanners such as Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp Suite, and Microsoft Defender, TLS audits from SSL Labs, sslyze, and testssl.sh, and other CSV, XML, or JSON exports that list findings by host, IP address, or URL; it accepts the same files through an upload API; it offers a free pre-flight check of a file that stores nothing and uses no AI; it can pull data from Microsoft Defender Vulnerability Management and ConnectSecure through connections you set up; it enriches findings with public vulnerability intelligence; it tracks findings per client over time; and it can draft remediation tickets for HaloPSA or ConnectWise PSA, sending them only after you approve them. Reports are decision-support outputs, not a guarantee that a system is secure and not a substitute for professional security, legal, or compliance judgment.

AI features

The Service uses artificial intelligence, provided by Anthropic's Claude models, to read file layouts, enrich findings, and write reports, proof pack summaries, and ticket drafts. Identifiers such as hostnames and IP addresses are replaced with placeholders before data is sent to the AI provider, as described in the Privacy Policy and the Data Processing Addendum. AI-generated content can be inaccurate or incomplete. Varaxon's software checks AI claims against its own records and calculates risk rankings itself, but you must review reports and ticket drafts before relying on them or sending them to anyone. If Varaxon's checks reject the AI's draft, the report is built by Varaxon's software alone, without AI-written text. Neither Varaxon nor its AI provider will use your data to train AI models.

The Service is offered to customers in the United States. By creating an account or purchasing a plan, you represent that you are located in, and are using the Service from, the United States unless Varaxon has agreed otherwise in writing. Any expansion to additional jurisdictions may require additional terms or privacy disclosures.

The Service is not represented as compliant with HIPAA, FISMA, GLBA, or any other industry-specific security or privacy framework unless Varaxon expressly agrees otherwise in a written customer agreement. You are responsible for determining whether the Service is suitable for your use, for obtaining any required authorizations, and for meeting obligations that apply to your business or client.

Who may use the Service

The Service is available to businesses and professionals, such as managed service providers and security consultants, and to individuals who want reports on systems they own or are authorized to assess, such as a home network. In these Terms, a consumer is an individual who uses the Service for personal, family, or household purposes rather than for a business.

If you are a consumer, you may have rights under the consumer-protection laws of your state that these Terms cannot take away. Where these Terms disclaim, exclude, or limit a warranty, a remedy, or liability, or require you to indemnify Varaxon, that provision applies to you only to the extent your state's law allows. Some states do not allow the exclusion of implied warranties or the limitation of incidental or consequential damages, so some of those provisions may not apply to you.

Data you may not upload

Unless a separate written agreement with Varaxon expressly permits it, you may not upload or submit to the Service:

  • protected health information;
  • payment-card data;
  • classified or controlled government information;
  • export-controlled technical data; or
  • personal data subject to European Union, United Kingdom, or Swiss transfer restrictions.

This restriction concerns the categories of data you submit, not the industry you work in. Varaxon does not restrict who may use the Service, and you may use it in healthcare, financial, or government engagements provided your uploads stay within the limits above. You are responsible for determining what an export contains before you upload it.

Third-party connections

If you connect the Service to Microsoft Defender, ConnectSecure, HaloPSA, ConnectWise PSA, or another system, you represent that you are authorized to grant that access for the tenant, company, or account concerned. You authorize Varaxon to read data from, and for PSA connections to create approved tickets in, those systems on your behalf and only within the access you grant. Your use of those systems is governed by your agreements with their providers, and Varaxon is not responsible for their availability, accuracy, or changes to their interfaces. You may remove a connection at any time; a Microsoft tenant administrator may also revoke Varaxon's application in Microsoft Entra ID. Tickets are your communications to your own systems once you approve them.

Build report and automatic reports

Every pull from a Microsoft Defender or ConnectSecure connection builds a report, and every such report is charged as described in Section 5, whether you start it with Build report or an automatic schedule starts it. An owner or admin can set a connection's automatic reports to Off, Every month, Every week, or Every day, after confirming that each report costs one report from the plan or one credit. The first automatic report is built shortly after a schedule is turned on or changed, and later reports follow at the chosen interval. A daily schedule builds about 30 reports a month for that client. If a report cannot be paid for, or a pull fails, the connection's automatic reports pause and the Connections page shows it; they resume after a successful Build report. Varaxon does not send an email when automatic reports pause. You are responsible for the schedules your organization turns on.

Upload API

Owners and admins can create API keys that let your own systems submit files and receive reports. An API key is a credential: keep it secret, revoke it in the Service if it may have been exposed, and do not embed it where others can read it. Reports requested with your organization's keys are charged as described in Section 5, and you are responsible for requests made with them until a key is revoked.

2. Authorized security testing and customer warranty

You may upload or process scan exports only when you are authorized to assess the systems and data represented in them. You warrant that you have that authorization, that your use complies with applicable law and your customer agreements, and that you will not use the Service to facilitate unauthorized access, scanning, exploitation, or surveillance. Varaxon does not grant permission to access or test any system.

Indemnity

You will defend and indemnify Varaxon from third-party claims, losses, and reasonable costs to the extent caused by:

  • your unauthorized scanning or testing of a system;
  • your unlawful use of the Service;
  • your breach of the authorization warranties in this Section; or
  • your infringement of another party's rights.

This indemnity does not apply to any claim to the extent it is caused by Varaxon's own negligence, willful misconduct, fraud, or breach of these Terms.

Your aggregate liability under this indemnity will not exceed the greater of (a) the fees you paid to Varaxon for the Service during the 12 months before the event giving rise to the claim or (b) $100 — the same limit that applies to Varaxon under Section 11. That cap does not apply to your fraud or intentional unlawful conduct, for which your liability under this indemnity is not limited by this paragraph.

Varaxon will notify you promptly of a claim for which it seeks indemnity, allow you to control the defense of that claim with counsel of your choosing, and provide reasonable cooperation at your expense. Varaxon may participate with its own counsel at its own cost. You may not settle a claim in a way that imposes an obligation or admission on Varaxon without its written consent.

3. Customer data and reports

You retain ownership of uploaded scan exports, customer-provided data, and the reports generated from that data. Varaxon receives only the limited license needed to process the data, provide the Service, secure the Service, and support your account. Varaxon does not claim ownership of scan exports or reports and will not sell them or use them for advertising or AI training. Raw uploaded files are deleted within 7 days; findings and reports are kept for your organization until deleted, as described in the Privacy Policy.

You may use, download, and deliver generated reports to the end customer or other authorized recipient whose systems were assessed. You are responsible for confirming that the recipient is authorized to receive the report and for protecting the report after download.

Risk acceptances and sign-offs. You can record that your client has accepted the risk of leaving a finding unfixed, and you can send your client's contact a link to sign that acceptance electronically. The acceptance is an agreement between you and your client. Varaxon is not a party to it and does not decide whether a risk should be accepted. Varaxon stores the record, including the wording shown, who signed, and when, so that you can show it later. You are responsible for sending sign-off requests only to people authorized to accept risk for your client, and for the reason and expiry you record.

Product feedback that you voluntarily send to Varaxon may be used to improve the Service. Feedback does not include uploaded scan exports, reports, credentials, or confidential customer information, and the feedback license does not transfer ownership of Customer Data.

4. Accounts, organizations, and security

You must provide accurate account information, keep your password and multi-factor authentication (MFA) device secure, and tell us promptly at support@varaxontech.com if you believe your account has been compromised. Every user must use MFA. Accounts are identified by email address; the Service does not use public usernames.

Each account belongs to an organization. The organization's owners and admins control who belongs to it, their roles, its connections, and its billing, and the organization is responsible for the actions of its members. Findings, reports, and billing records belong to the organization, not to an individual member, and remain with it if a member's profile is deleted.

Owners and admins can invite people to the organization by email, as admins or members. Each person gets their own sign-in, must accept these Terms and the Privacy Policy, and must set up MFA before they can see any of the organization's data. A sign-in belongs to one organization, so an email address that already has a Varaxon account cannot be invited. Owners can change roles and hand ownership to another person who has joined; owners can remove anyone else, and admins can remove members. Removing a person, or cancelling their invitation, deletes their sign-in and turns off any upload API keys they created. Closing the organization deletes every sign-in on its team. You must invite only people who are authorized to see your organization's data, and you are responsible for removing people who should no longer have access.

You must be at least 18 years old and legally able to enter these Terms. The Service is not directed to children.

5. Plans, free reports, credits, and payment

Automatic renewal disclosure

YOUR SUBSCRIPTION RENEWS AUTOMATICALLY. Unless you cancel before the end of your current billing period, your subscription will automatically renew for another period of the same length, and the payment method on file will be charged the then-current price for that plan. You may cancel at any time, effective at the end of the current paid billing period, from the billing page of your account — see Section 6 for the cancellation steps.

The plan price, billing frequency, included report allowance, and next renewal date are shown before checkout and in the account billing surface. We charge the payment method through Stripe. Stripe hosts payment-card entry; Varaxon does not receive or store card numbers or security codes.

Renewal reminders

For any subscription whose renewal term is longer than 60 days, Varaxon will send a renewal reminder to the email address associated with the account at least 15 days and no more than 45 days before the renewal date. The reminder will state the renewal date, the amount to be charged, and how to cancel. Varaxon will also send a reminder at least once every 12 months to any account on a continuing subscription of any term length.

Price changes

Varaxon will give clear and conspicuous notice of any price increase or other material change to a plan at least 30 days before it takes effect. A price increase will not be charged to an existing subscription without the account holder's affirmative consent. If the account holder does not consent, the subscription will continue at the existing price until the end of the current paid period and will then end rather than renew at the higher price, unless the account holder cancels sooner.

Plans, allowances, and credits

Each plan includes a number of people in the organization (Starter 1, Core 3, Growth 10, Scale unlimited; during a free trial, as the trial's plan; 1 without an active plan or trial), counting the owner and open invitations, and a monthly report allowance (Starter 10, Core 25, Growth 60, Scale 150) that resets on the 1st of each calendar month (UTC), including on yearly plans; unused reports do not carry over. A report uses one report from the allowance first, then one credit, however it is started: by upload, through the upload API, with Build report, or by an automatic schedule. A proof pack uses one report from the allowance first, then one credit, in the same way; a proof pack that cannot be made does not count, and any credit it used is returned automatically. A report that fails, whether at once because its file cannot be read or after automatic retries, does not count, and any credit it used is returned automatically. A report that Varaxon's software builds without AI-written text, because the AI's draft was rejected, is also not charged, and neither is a report of a scan with no findings. While a renewal payment is past due, the plan's monthly allowance pays for no reports until the payment goes through; credits can still be used.

An owner or admin can change plans from the Plan and credits page. A plan that includes fewer people than the organization has cannot be chosen until people are removed or invitations are cancelled. If a plan ends, everyone keeps their access, but no one new can be invited until the organization fits its plan again. A plan change replaces the current subscription, applies at once, and is prorated by Stripe for the rest of the current billing period, as described in the Cancellation and Refund Policy.

A new organization receives a free 14-day trial of the Core plan when its owner first confirms their email address, once per email address. During the trial, the organization has the people and features of the Core plan and up to 10 reports, proof packs included, counted over the whole trial instead of a calendar month. We may extend a trial, or offer one to an existing organization, at our discretion. A free trial does not require a payment card and never converts to a paid subscription automatically. Choosing a paid plan during a trial ends the trial at once. When a trial ends, new reports need a plan or credits, the rules above for a plan that ends apply, and nothing in the organization is deleted. Free trial credits granted to organizations created before October 27, 2026 remain usable. Purchased credits are subject to the price, quantity, and limits shown at purchase.

Purchased credits are prepaid entitlements to receive the Service. They are not cash, a deposit, a stored-value instrument, or a payment instrument; they are not transferable; and they are not redeemable for cash except where applicable law requires it.

Purchased credits do not expire while the account remains in good standing. For this purpose, good standing means that the account is active and has not been suspended or terminated for fraud, abuse, unauthorized use, or material breach; cancelling a subscription alone does not remove an account from good standing.

Non-payment alone does not forfeit purchased credits. Varaxon may suspend an account for non-payment, and credits remain available when the account is restored. Unused purchased credits are forfeited only where Varaxon terminates an account for documented fraud, abuse, unauthorized use, or serious material breach, and except where applicable law requires otherwise. Purchased credits are not refundable except as stated in the Cancellation and Refund Policy or required by law.

The Cancellation and Refund Policy is incorporated into these Terms.

6. Cancellation and termination

If you subscribed online, you may cancel online. An owner or admin can cancel from the Plan and credits page of the account, and doing so does not require you to call, email, chat, or speak with anyone. You may also cancel by emailing support@varaxontech.com from the address associated with the account, but you are not required to do so.

Cancellation takes effect at the end of the current paid billing period, and the subscription will not renew after that period. The detailed refund and credit rules are in the Cancellation and Refund Policy.

An owner can also close the organization from the Account page once its plan is no longer active. Closing permanently deletes the organization's data, as described in the Privacy Policy.

Varaxon may suspend or terminate access for non-payment, fraud, abuse, unauthorized testing, security risk, or material breach. If Varaxon terminates a prepaid subscription without customer fault or discontinues a paid plan, Varaxon will provide a pro-rata refund for the unused prepaid period unless applicable law or the customer agreement requires a different remedy.

Discontinuing a paid plan means retiring a plan tier or materially removing the functionality that plan was contracted to provide. A change that applies only to new customers is not a discontinuation, provided existing prepaid customers continue to receive the service they contracted for through the end of their paid period.

7. Acceptable use

You may not:

  • upload data without authorization or use the Service for unlawful access, scanning, exploitation, or surveillance;
  • upload malware or content intended to compromise the Service;
  • bypass authentication, MFA, rate limits, upload limits, or other security controls, or share an API key outside your organization;
  • attempt to make the Service's AI features produce content unrelated to your reports, or insert instructions into uploaded data intended to manipulate them;
  • interfere with the Service or impose an unreasonable load;
  • use another person's account or expose credentials;
  • reverse engineer or copy the Service except where applicable law permits; or
  • use the Service to violate another person's privacy, confidentiality, intellectual-property rights, or applicable law.

You may use the Service in your business, or for your own systems as a consumer, and may deliver reports to authorized clients; you may not copy or resell the Service itself.

8. Intellectual property

Varaxon owns the Service, its software, documentation, visual design, trademarks, and service marks. Subject to these Terms, Varaxon grants you a limited, non-exclusive, non-transferable license to access and use the Service and download reports for your authorized business and client work. No rights are granted except those expressly stated.

9. Privacy and data processing

The Privacy Policy describes Varaxon's handling of account, billing, security, support, and service information, and lists the providers that process it, including Anthropic (AI), Supabase (database and storage), OVHcloud (hosting), Resend (email), and Stripe (payments). For Customer Data processed on your behalf, the Data Processing Addendum applies, is accepted with these Terms, and controls over these Terms on data-protection matters. The Cancellation and Refund Policy and the DPA are part of the agreement; the entire-agreement clause below is subject to them.

10. Availability and disclaimers

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE AND REPORTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE FULLEST EXTENT PERMITTED BY LAW, VARAXON DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND DOES NOT WARRANT UNINTERRUPTED AVAILABILITY, ERROR-FREE OPERATION, OR THAT A REPORT IDENTIFIES EVERY VULNERABILITY.

Independent validation and customer responsibility

The Service and reports are automated decision-support tools. You are solely responsible for ensuring that uploaded data is authorized, accurate, complete, and current; for independently validating findings and outputs; for determining whether and how to act on them; for obtaining professional advice when appropriate; and for making all security, remediation, legal, compliance, operational, and business decisions.

Reports may contain false positives, false negatives, omissions, or incomplete information, and must not be used as the sole basis for a material decision.

To the fullest extent permitted by law, you are responsible for decisions made from your use of the Service, subject to liability that cannot lawfully be disclaimed or limited.

You also remain responsible for protecting downloaded reports and for keeping your own copies of reports you need. Varaxon's backups exist to recover the Service from failures, are kept for only 7 days, and are not a records service for customers.

Proof packs and control mapping

Proof packs, email and domain checks, on-time and overdue figures, and any mapping of evidence to a security framework, regulation, or insurance question are prepared from the data you supply and are evidence to support your own work. They are not legal, audit, compliance, or insurance advice. They do not certify, attest, or guarantee that you or your client meets any framework, regulation, contract, or insurance requirement, and Varaxon holds no certification for the frameworks it maps to. You choose which frameworks and insurance questions a pack includes, and you are responsible for any answer you give to an auditor, insurer, regulator, or client. If AI writes a pack's summary, Varaxon's software checks it against the pack's facts; if the check rejects it, the pack is still made in full with the summary in fixed wording and is charged as usual.

Insurance

You are responsible for determining and maintaining insurance appropriate to your systems, data, security obligations, and use of reports.

11. Liability

To the fullest extent permitted by law, Varaxon will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or business opportunity. Varaxon's aggregate liability for claims arising from the Service will not exceed the greater of (a) the fees you paid to Varaxon for the Service during the 12 months before the event giving rise to the claim or (b) $100. This limitation does not apply where prohibited by law or to liability that cannot legally be limited.

Risk allocation

The parties agree that the disclaimers, exclusions, and liability limits in these Terms are material terms of the bargain and reflect the allocation of risk, pricing, and availability of the Service. Nothing in this Section limits liability that cannot lawfully be limited.

12. Disputes and governing law

Informal resolution first

Before starting an arbitration or a lawsuit, the party raising the dispute will send written notice describing it to the other party and the parties will attempt to resolve it informally for 30 days. Notice to Varaxon goes to support@varaxontech.com.

Binding arbitration

If the dispute is not resolved within those 30 days, it will be resolved by final and binding arbitration rather than in court, except for the claims carved out below. The arbitration will be administered by the American Arbitration Association under its Commercial Arbitration Rules, or under its Consumer Arbitration Rules where those rules apply by their own terms. The arbitration will take place in North Carolina, or by remote hearing if the parties agree; if you are a consumer, it will take place in the county where you live, or by video or telephone if you prefer. The arbitrator's award may be entered as a judgment in any court with jurisdiction.

Consumer arbitration costs and opt-out

If you are a consumer, Varaxon will pay all AAA filing, administration, and arbitrator fees for an arbitration you start, other than an amount equal to the filing fee you would have paid to bring the claim in court, unless the arbitrator finds your claim frivolous. The arbitrator may award a consumer any individual remedy a court could award.

You may opt out of arbitration by emailing support@varaxontech.com from the address on your account within 30 days after you first accept these Terms, with the subject "Arbitration opt-out". If you opt out, disputes will be decided in court under the Governing law section, and the rest of these Terms still apply. Opting out does not affect any other part of your relationship with Varaxon.

What is not covered

Either party may (a) bring an individual claim in a small claims court with jurisdiction, and (b) seek emergency injunctive relief or enforce intellectual-property rights in a court with jurisdiction, without first arbitrating.

Class action and jury waivers

BOTH PARTIES WAIVE THE RIGHT TO A TRIAL BY JURY.

BOTH PARTIES AGREE TO BRING CLAIMS ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate the claims of more than one person and may not preside over any form of representative proceeding. If this paragraph is found unenforceable as to a particular claim, that claim — and only that claim — will be decided in court rather than in arbitration, and the rest of this Section 12 will remain in effect.

Rights that cannot be waived

Nothing in this Section waives any right or remedy that applicable law does not permit to be waived, and a customer who is not acting in a business capacity retains every such right and remedy, including the right to bring a matter before a government agency.

Governing law

These Terms are governed by North Carolina law, excluding conflict-of-law rules, and by the Federal Arbitration Act for Section 12. If you are a consumer, you also keep the protection of any mandatory consumer-protection law of the state where you live. Court proceedings permitted by these Terms will be brought in the state or federal courts located in North Carolina, except that a consumer may bring them in the courts of the county where the consumer lives.

13. Miscellaneous

Confidentiality

Each party may receive information of the other that is marked confidential or that a reasonable person would understand to be confidential from its nature or the circumstances of disclosure ("Confidential Information"). Each party will use the other's Confidential Information only to perform under these Terms, will protect it with at least the care it uses for its own confidential information of like importance, and will not disclose it except to personnel and contractors who need it and are bound by confidentiality obligations at least as protective as these.

Confidential Information does not include information that is or becomes public without breach of this Section, was known to the receiving party without a duty of confidence before disclosure, is received from a third party without a duty of confidence, or is independently developed without use of the disclosing party's Confidential Information. A party may disclose Confidential Information where required by law or legal process, and will, where lawful and practicable, give the other party advance notice and a reasonable opportunity to seek protective treatment.

Customer Data uploaded to the Service is Customer's Confidential Information and is also governed by the Data Processing Addendum, which controls on data-protection matters. These obligations continue for three years after the information is disclosed, and indefinitely for anything that qualifies as a trade secret.

Export control and sanctions

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions, and that you are not a person or entity identified on any U.S. government restricted-party list, including the Specially Designated Nationals and Blocked Persons List administered by the U.S. Department of the Treasury's Office of Foreign Assets Control. You will not access, use, export, re-export, or make the Service available in violation of U.S. export control or economic sanctions laws, and you will not permit any person subject to those restrictions to use the Service through your account. Varaxon may suspend or terminate access it reasonably believes is required to comply with these laws.

Force majeure

Varaxon is not responsible for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, governmental action, internet or telecommunications failures, or outages or failures of third-party providers.

Assignment

You may not assign or transfer these Terms without Varaxon's prior written consent. Varaxon may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of substantially all of its assets, provided the assignee assumes the applicable obligations.

No waiver

A failure to enforce any provision is not a waiver of the right to enforce that provision later. A waiver must be in writing and applies only to the specific instance stated.

Survival

Sections concerning customer data and reports, intellectual property, payment obligations, acceptable use, disclaimers, liability, disputes, confidentiality, export control and sanctions, indemnity, and any provision that by its nature should survive termination will survive termination or expiration of these Terms.

Notices and electronic communications

Operational notices may be sent to the email address associated with your account or posted in the Service. Legal notices to Varaxon must be sent to support@varaxontech.com and, when appropriate, to the mailing address in Section 14. You consent to receive agreements, notices, disclosures, and records electronically. You may withdraw consent by closing your account, but doing so may prevent continued use of the Service. When you send a sign-off request, the signer is shown the acceptance wording, is told that typing their name and confirming is an electronic signature, and can decline.

Third-party beneficiaries

Except for a permitted assignee, these Terms do not create any third-party beneficiary rights. An end customer or other recipient of a report does not become a party to these Terms and may not enforce them solely because it received or relied on a report.

Entire agreement and severability

These Terms, the Privacy Policy, the Cancellation and Refund Policy, the Data Processing Addendum, and any applicable order form constitute the agreement between you and Varaxon concerning the Service. If a provision is unenforceable, the remainder remains effective. Varaxon may update these Terms by posting a revised version and, for material changes, giving at least 30 days' notice by email or in the Service. Each version is identified by a version number and effective date, and the version you accepted at checkout remains available.

14. Contact

Varaxon Technologies LLC
5372 Washington St
Camp Lejeune, NC 28547
United States
support@varaxontech.com