Legal

Modern Stack Snapshot™: Service Terms

Effective: October 16, 2026 · Version: 2026-10-16

These terms govern the Modern Stack Snapshot™ ("the Snapshot") provided by Idextrus Inc. ("Idextrus", "we", "us"), an Ontario corporation. They apply when you submit the Snapshot request form, pay for a Snapshot, or receive one at no charge. "You" means the person submitting the request and the organization they represent. By ticking the agreement box on the request form, you confirm that you have read and accept these terms and our Privacy Policy.

1. What the Snapshot is

The Snapshot is an external assessment of the technology an organization exposes to the internet. Starting from the domain you give us, we:

  • discover assets related to that domain, such as subdomains, IP addresses and the infrastructure behind them, and run automated security tests against them;
  • check the main website's security headers, certificates and encryption settings, its performance and accessibility, and the domain's email authentication records (SPF, DKIM, DMARC);
  • if you ask us to, check email addresses you provide against public breach databases (section 4);
  • deliver a written report and a summary presentation within 5 business days of receiving your completed request and payment. If we miss that, you don't pay (section 7).

2. What the Snapshot is not

The Snapshot is a point-in-time view from outside your organization. It is not:

  • a penetration test, a code review or an internal audit;
  • a certification of compliance with any law, standard or framework;
  • a guarantee that your systems are secure, or that every vulnerability has been found.

We can only see what is reachable from the internet at the time of testing. Scores, severity ratings, priorities and the estimated hours in the report are our professional judgment based on that view. They are not quotes or warranties. Decisions you make based on the report, and any changes you make to your systems, are your responsibility.

3. Your authorization to test

Our tests send requests to your systems that are designed to find weaknesses without exploiting them or disrupting service. Because they test systems, we only test domains we are authorized to test. By submitting a request, you confirm that:

  1. you own the domain you submit, or you are authorized by its owner to request this assessment;
  2. you have authority to bind your organization to these terms;
  3. you authorize us, and the scanning providers we use, to test the domain and the assets we discover as related to it, for the duration in section 5.

Discovery can surface assets that someone else operates for you, such as a hosting company, content delivery network, email platform or software vendor. You authorize testing of those assets to the extent you are entitled to. If you know of an asset we must not test, tell us before testing begins and we will exclude it.

Our tests may show up in your logs or trigger alerts in your security tools. That is expected. If you would like advance notice of when testing starts, let us know.

If we have reason to believe a request is not authorized, we may decline it, stop testing and refund any fee paid.

4. Breach exposure check (optional)

If you ask for the breach exposure check, we send the email addresses you provide to Have I Been Pwned, a public breach-notification service, to see whether they appear in known data breaches. You confirm that the addresses belong to your organization and that you are entitled to share them with us for this purpose. We report which known breaches the addresses appear in. We never request, receive or report passwords.

5. Continued scanning after delivery

Automated vulnerability scanning of up to 15 assets related to your domain is included and continues for 3 months after we deliver the Snapshot, or 12 months if you go on to engage us for a Modern Stack Deep Dive. An asset is a distinct URL, host, or IP address found by our vulnerability scanner (powered by our partner Attaxion). We use these results to follow up with you about new or resolved issues. You can ask us to stop at any time by emailing chris@idextrus.com.

6. Fees and payment

The Snapshot costs $2,500 CAD, plus applicable taxes, payable in advance by card through our payment processor, Stripe. Work begins once payment is confirmed. When the Modern Stack Deep Dive launches, the Snapshot fee is credited in full against the Deep Dive fee if you book within 60 days of Deep Dive launch. We may provide a Snapshot at no charge (for example, with a complimentary code). These terms apply to it in the same way.

7. On-time guarantee, cancellation and refunds

  • On-time guarantee: if we do not deliver your report within 5 business days of receiving your completed request and payment, we refund the fee in full, and you keep the report when it arrives. The guarantee doesn't apply to delay you ask for or cause, such as asking us to pause testing, or not responding when we need information from you to continue. In that case the 5 days resume once the delay ends.
  • Before testing begins: you can cancel by email for a full refund.
  • After testing begins: apart from the on-time guarantee, the fee is non-refundable, because the work and third-party costs are already committed.
  • If we decline or stop a request under section 3, we refund any fee paid.
  • Refunds go back to the card you paid with, normally within 10 business days.

8. Your responsibilities

You agree to give us accurate information, to tell us promptly about any asset that must not be tested, and not to use the Snapshot or the report to assess systems you are not authorized to assess.

9. Confidentiality and use of the report

We treat your report, the findings behind it and the information you give us as confidential. We use them only to deliver and follow up on the Snapshot, or as described in our Privacy Policy. We will not name you or publish your findings without your written permission. We may use de-identified, aggregated information (for example, how often a type of issue occurs across all assessments) to improve our methods and in general publications. It will never identify you or your systems.

The report is yours to use within your organization and to share with your advisers, insurers, auditors and service providers. Our scoring methodology, templates and tools remain our property.

10. Disclaimer

The Snapshot is provided on the basis described in sections 1 and 2. To the extent permitted by law, we make no other warranties, express or implied, including warranties of merchantability or fitness for a particular purpose, or that the Snapshot will identify every vulnerability.

11. Limitation of liability

To the extent permitted by law:

  • our total liability arising out of or relating to the Snapshot is limited to the fees you paid for it, or CAD $100 for a Snapshot provided at no charge;
  • we are not liable for indirect, incidental, special or consequential damages, or for lost profits, revenue, data or business opportunity, even if we were told they were possible;
  • we are not liable for any security incident, breach or outage. This includes one that involves an issue the Snapshot did or did not identify.

Nothing in these terms limits liability that cannot be limited by law.

12. Changes to these terms

We may update these terms. The version in effect when you submit your request applies to that Snapshot. The effective date and version appear at the top of this page.

13. Governing law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there. The courts of Ontario have exclusive jurisdiction over any dispute arising from them. The Snapshot is offered only to businesses and other organizations, not to consumers.

14. Contact

Idextrus Inc. · 18 King Street East, Suite 1400, Toronto, ON M5C 1C4 · chris@idextrus.com