Acceptable Use Policy

Infrality sends traffic to hosts you nominate. This is the policy that says which hosts those may be — the one rule a scanning tool cannot do without.

In effect since 4 September 2026 Version 2026-09-04 English is the only version of this document.

This policy is part of the Terms of Service. Breaking it is grounds for immediate suspension without notice.

1. Scan only what is yours to scan

You may point Infrality at a network or host only if you own it, or if you hold documented authorisation from whoever does. Nothing else is acceptable use — not curiosity, not research, not "it was responding anyway", not a range you believe to be unused.

Scanning without authorisation is a criminal offence in most jurisdictions. In France, articles 323-1 and following of the Penal Code cover fraudulent access to and interference with an automated data-processing system. In the United States the Computer Fraud and Abuse Act applies. Other countries have equivalents. Infrality will not defend or indemnify you for it, and you indemnify us against any claim arising from it.

Before you scan, satisfy yourself that:

every address range you configure is under your organisation's control;
where the infrastructure is hosted by someone else — a cloud provider, a landlord, a managed service — their terms permit scanning, and you have their permission where required;
you have not included a range by mistake. A typo in a CIDR block is the most common way a legitimate user becomes an unlawful one.

2. Do not reach for other people's data

Do not attempt to access another organisation's account, projects or scan results.
Do not probe our authorisation controls for a way around them. If you find one, tell us — see the security page, which explains what we commit to in return.
Do not use another person's credentials, or share yours.

3. Do not attack or overload the service

No denial-of-service, no traffic floods, no attempts to exhaust our capacity.
Do not circumvent rate limits, quotas or the anti-bot checks on public forms, including by distributing requests across addresses or accounts.
Automate against the API within the published limits. If you need more, ask at [email protected] — we would rather raise a limit than find out this way.
Do not resell or resupply the service to third parties without a written agreement.

4. Do not use Infrality unlawfully

Not for anything illegal, and not to prepare an attack on infrastructure — whether or not it is yours.
Not to store or transmit malware, and not as part of command-and-control for anything.
Not to store personal data you have no basis to hold. Your topology is your responsibility; for that data you are the controller and we are your processor.
Not to infringe anyone's intellectual property.

5. Reporting abuse

If you believe Infrality is being used against you or your infrastructure, write to [email protected] with the source address, the timestamps and what you observed. We investigate every report and will suspend an account that is scanning without authorisation.

6. What we do about breaches

Depending on what we find, we may contact you, throttle your account, suspend it, or close it. We suspend without notice where the conduct is unlawful, where it endangers a third party's infrastructure, or where it threatens the service for everyone else. Where the law requires it we will cooperate with authorities.

We would much rather talk to you. Nearly every problem we have seen was a misconfigured range rather than bad intent, and those are fixed in a five-minute conversation.