Terms and privacy

Effective 2026-09-07. Plain language on purpose; the short version is at the top of each section.

1. What the service is

ctscout.dev ("the service") publishes data derived from public Certificate Transparency logs, the GLEIF legal-entity register, and other public sources named in the research notes: which organization a website certificate names, which domains an organization holds certificates for, and which vendors a DNS check found running an organization's domains. It is served as web pages, a JSON API and an MCP server. The service is operated by an individual, not a company, from California, USA ("the operator"). By using it you accept these terms; if you use it for an organization, you confirm you may accept them for it.

2. What it is not

Short version: it reports what public records say, it does not tell you what to do. The service is not a cyber-risk score, a credit or compliance opinion, a KYC or sanctions product, or legal advice. A certificate naming an organization is evidence that someone requested a certificate in that name; it is not proof of ownership, control or affiliation. Names are matched to legal entities by a published rule with a measured error rate; that rate is documented in the notes and is not zero. Read the limitations before relying on any answer.

3. Acceptable use

You may use the data in your own products, analyses and publications, including commercial ones, and you may cache what you retrieve for your own use. You may not resell or republish the dataset as a whole or in bulk as a substitute for the service, share an API key outside the organization it was issued to, circumvent quotas or the human check on key creation, or use the service to harass or target any individual. The service describes organizations and is not intended to identify natural persons; where a public record names a person (a sole trader, a personal name in a certificate), do not use the service to profile them. The service is not offered where United States law prohibits it.

4. Keys, tiers and payment

Short version: free keys are self-serve; Pro is bought at the subscription link and paid monthly, with the key sent by email; either side can stop, and you are not charged for time you do not get. Free keys are issued without an account and carry the quota shown on the front page. Pro keys are bought at the subscription link on the front page, at the price shown there, paid monthly by card through Stripe, which sells the subscription as merchant of record: your receipt names Stripe as the seller and CTScout as the product, and any sales tax or VAT is charged and remitted by Stripe. To cancel, email; the key is turned off at the end of the paid month, and a month already started is not refunded. If the operator ends a Pro arrangement for any reason other than a breach of section 3, the unused part of the paid month is refunded. Quotas are stated on the front page; what counts as a lookup is stated there too, and changes to prices or quotas are posted there with at least seven days' notice and never apply to a month already paid. Keys used in breach of section 3 are revoked without notice.

5. No warranty, limited liability

Short version: it is provided as is, and the most you can recover is what you paid in the last three months.

The service is provided "as is" and "as available", without warranty of any kind, express or implied, including any implied warranty of accuracy, completeness, merchantability, fitness for a particular purpose, non-infringement, or uninterrupted operation. Public sources change and lag; the refresh cadences are stated on the pages that carry the data.

To the fullest extent permitted by law, the operator is not liable for any indirect, incidental, consequential or special damages, or for any loss arising from reliance on the data, and total liability for all claims together is limited to the fees you paid for the service in the three months before the claim. You agree to indemnify the operator against third-party claims arising from your use of the data or your breach of these terms. The operator is not responsible for failures caused by events outside reasonable control, including outages of the hosting provider. Where a jurisdiction does not allow one of these limits, it applies to the extent it is allowed, and the rest of these terms stand.

6. Privacy

Short version: no account and no email for free use; what is tied to a key is the key, the queries made with it, and a short-lived hash of the address that created it. The long-form notice, with retention periods and the list of processors, is PRIVACY.md; where the two differ, the long-form notice is the one that applies.

• Key creation. A free key is created after a Cloudflare Turnstile check, which Cloudflare handles under its policy. No email or name is collected. A keyed hash of your IP address is stored to limit keys per address; rows older than two days are removed by a monthly cleanup, so a hash lives between two days and about a month. The front page stores your key in your browser's local storage so the search box can use it; clear it there.
• Query logs. For every keyed query the service records the key id, the tier, the query (the company name or domain you asked for), the result count, the request's country as reported by Cloudflare, latency and technical fields such as the client and transport. Rows stay in the live database for 90 days and are then archived, with those fields, for as long as the service exists; monthly counts per queried name are kept alongside. Failed requests are recorded separately with the key fingerprint, route, status and timings for 90 days. Per-request telemetry (tier, latency, result count) goes to Cloudflare's analytics for 90 days. These records exist to run quotas, find bugs and see which names are looked up; they are not sold and not shared, except with the processors named in the long-form notice.
• Unkeyed pages and endpoints (answer pages, research notes, the LEI endpoints, the name lookup on the front page) log only what Cloudflare logs for any request.
• Pro customers. The email you write from is kept to reach you about the key; card details are collected and kept by Stripe under its policy, and the operator never sees them.
• Cookies. None of the service's own; Turnstile may set its own.
• Requests. To see or delete what is tied to your key, email pro@ctscout.dev from the address you used or, for a free key, quoting the key. Expect a reply within 14 days; it is one person's inbox.

7. Law and changes

These terms are governed by the law of California, USA, and any dispute is heard in the state or federal courts of California. They are the whole agreement about the service and may not be assigned by you without consent. Changes are posted here with a new effective date, and Pro customers are emailed at least seven days before a change takes effect; using the service after that date accepts them. Questions: pro@ctscout.dev.