Terms of Service

1. Definitions

• "Service" means the CSP Warden platform at cspwarden.com, including all features, tools, APIs, and related services.
• "User", "you" means any individual or entity that registers for or uses the Service.
• "Content" means any data, CSP reports, domain configurations, CSP policies, or materials uploaded to or generated by the Service.
• "Subscription Plan" means the tier of service selected by the User (Free, Professional, Business, or Enterprise).

2. Eligibility and Account Registration

You must be at least 16 years of age to use the Service. By registering, you represent that you meet this requirement.

When creating an account, you agree to:

• Provide accurate and complete registration information (email address, username, name)
• Maintain only one account per individual or entity, unless otherwise authorised
• Keep your account credentials confidential and secure
• Notify us immediately at [email protected] of any unauthorised use of your account
• Accept responsibility for all activity that occurs under your account

3. Service Description

CSP Warden provides tools for monitoring, analysing, and managing Content Security Policies. Core features include:

• CSP violation report collection and analysis
• Analytics dashboards and reporting
• CSP policy builder and validation tools
• Security header scanning
• Cloudflare integration for CSP deployment (on applicable plans)
• API access (on applicable plans)

The Service helps you identify and resolve CSP violations but does not guarantee the prevention of all security incidents or vulnerabilities. You remain responsible for your own website security practices and should maintain appropriate security measures beyond the Service.

4. Subscription Plans and Pricing

CSP Warden offers the following subscription tiers: Free, Professional, Business, and Enterprise. Each plan has defined limits on the number of domains, monthly reports, data retention periods, and available features.

• The Free plan is restricted to personal, non-commercial use only (see Section 6).
• Paid plans are billed monthly or yearly in advance, in USD.
• Prices may change with at least 30 days' prior notice. Existing subscriptions will be honoured at the current rate until the next renewal cycle after the notice period.
• Plan limits (domains, reports per month, retention period) are enforced. Exceeding your plan limits may require upgrading to a higher tier.

Current plan details and pricing are available on our Pricing page.

5. Billing and Payment

• All payments are processed securely through Stripe. CSP Warden does not store your credit card details.
• Subscriptions renew automatically at the end of each billing cycle unless cancelled before the renewal date.
• By subscribing, you authorise us to charge your payment method on a recurring basis for the selected billing cycle.
• If a payment fails, we may retry the charge. Persistent payment failure may result in a downgrade or suspension of your account.
• Refunds: All fees are non-refundable. Refunds may be provided at our sole discretion on a case-by-case basis following investigation. To request a refund, contact [email protected].
• You are responsible for any applicable taxes, duties, or levies associated with your subscription.

6. Free Plan Restrictions

The Free plan is provided for personal, non-commercial use only. Commercial use - including use by businesses, for client websites, or in any professional or revenue-generating context - requires a paid subscription plan.

We reserve the right to suspend or terminate Free plan accounts that we reasonably determine are being used for commercial purposes.

The Free plan is subject to additional rate limiting and feature restrictions as described on our Pricing page.

7. Acceptable Use Policy

You agree not to:

• Use the Service for any unlawful purpose
• Attempt to gain unauthorised access to the Service, its systems, or other users' accounts
• Submit false, misleading, or fabricated CSP reports, or manipulate violation data
• Abuse the CSP report ingestion endpoint, including denial-of-service attacks, synthetic report flooding, or other forms of intentional overload
• Reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code of any part of the Service
• Resell, sublicense, or redistribute the Service or any part thereof without our prior written authorisation
• Use the Service to collect personal data in violation of applicable privacy or data protection laws
• Interfere with or disrupt other users' use of the Service
• Use automated tools (bots, scrapers, crawlers) to extract data from the Service beyond what is available through the provided API

8. Intellectual Property

CSP Warden owns all rights, title, and interest in and to the Service, including its software, design, documentation, and branding. The "CSP Warden" name and logo are our trademarks. You may not use our trademarks without prior written permission.

You retain ownership of your data, including domain configurations and CSP policies you create. CSP violation reports are data generated by your visitors' browsers - you own the rights to this data as collected through your websites.

You grant us a limited, non-exclusive licence to process your data solely as necessary to provide the Service to you. This licence terminates when your account is deleted.

9. Data Processing and Privacy

Our collection and use of personal data is governed by our Privacy Policy, which forms part of these Terms.

For CSP violation reports submitted by your website visitors' browsers:

• You are the Data Controller for your visitors' data.
• CSP Warden acts as a Data Processor, processing this data on your behalf to deliver the Service.

You are responsible for:

• Ensuring you have a lawful basis to collect and transmit CSP violation data (including data from your website visitors) to our platform
• Disclosing in your own privacy policy that CSP reports are sent to a third-party processor
• Complying with all applicable data protection laws in relation to your visitors' data

10. API Access

API access is available on Business and Enterprise plans. If your plan includes API access:

• API keys must be kept confidential. You are responsible for all actions taken using your API keys.
• Rate limits apply and are subject to your subscription plan.
• We reserve the right to revoke API access for abuse or violation of these Terms.
• API keys may have an expiration date. You are responsible for rotating keys as needed.

11. Service Availability

We aim to provide high availability but do not guarantee uninterrupted or error-free operation of the Service. We may perform scheduled maintenance with reasonable advance notice.

We are not liable for service interruptions caused by factors outside our reasonable control, including but not limited to network outages, third-party service failures, natural disasters, or force majeure events.

The CSP report ingestion endpoint operates independently from the dashboard and may have different availability characteristics. We prioritise report ingestion uptime to ensure minimal data loss.

12. No Guarantee of Security

CSP Warden is an informational and analytical tool. By using the Service, you acknowledge and agree that:

• The Service does not guarantee, warrant, or certify the security of your infrastructure, website, application, or any other system. CSP Warden provides monitoring, analysis, and grading tools - these are advisory in nature and do not constitute a security guarantee, legal certification, or assurance of protection against any form of attack, breach, or vulnerability.
• A website or application that receives a top score, "A+" grade, or passes all checks within the Service - including but not limited to security header scans, security readiness assessments, CSP policy evaluations, and DMARC policy checks - can still be compromised, breached, or exploited. No combination of security headers, policies, or configurations eliminates all risk.
• CSP Warden does not provide legal advice or legal protection. Use of the Service does not establish compliance with any law, regulation, standard, or framework (including but not limited to GDPR, PCI DSS, SOC 2, ISO 27001, or any industry-specific security requirement).
• You are solely responsible for the security of your own infrastructure, websites, applications, networks, data, and systems. The Service is one tool among many that may assist your security posture, but it is not a substitute for comprehensive security practices, penetration testing, vulnerability management, or professional security consulting.

The Service is provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, CSP Warden expressly disclaims all warranties, whether express, implied, or statutory, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

CSP Warden assumes no responsibility or liability for any security incident, data breach, unauthorised access, data loss, or other harm that may occur to your systems or data, regardless of whether you used the Service or acted upon its outputs, scores, or recommendations.

13. Limitation of Liability

To the maximum extent permitted by applicable law:

• CSP Warden shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or business opportunities, regardless of the cause of action or theory of liability.
• Our total aggregate liability for any claim arising from or relating to these Terms or the Service shall not exceed the total amount you paid to us in the twelve (12) months immediately preceding the event giving rise to the claim.
• We do not guarantee that CSP monitoring will detect or prevent all security vulnerabilities, attacks, or policy violations.

These limitations apply to the fullest extent permitted by law, regardless of whether CSP Warden has been advised of the possibility of such damages. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law.

14. Indemnification

You agree to indemnify, defend, and hold harmless CSP Warden and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising from: (a) your use of the Service; (b) your violation of these Terms; (c) your violation of any rights of a third party; or (d) your failure to comply with applicable data protection laws in relation to CSP violation data collected from your website visitors.

15. Termination

Cancellation by You

You may cancel your subscription at any time through your account settings or by contacting us. Upon cancellation, your account remains active and accessible until the end of the current billing period. No further charges will be made after cancellation.

Suspension or Termination by Us

We may suspend or terminate your access to the Service if you violate these Terms, with notice where practicable. In cases of serious or repeated violations, suspension or termination may be immediate.

Service Discontinuation

We may discontinue the Service entirely with at least 90 days' prior notice. In such an event, we will provide a pro-rated refund for any unused prepaid subscription period.

Effect of Termination

• Access to the Service is revoked
• Your data is deleted in accordance with our data retention policy described in the Privacy Policy
• You may request a data export before account deletion by contacting [email protected]

16. Modifications to Terms

We may update these Terms from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the platform at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of updated Terms constitutes acceptance of those changes. If you do not agree with the updated Terms, you must stop using the Service and cancel your subscription.

17. Governing Law and Dispute Resolution

These Terms are governed by and construed in accordance with the laws of England and Wales, without regard to conflict of law principles.

Any dispute arising from or in connection with these Terms or the Service shall first be attempted to be resolved through good-faith negotiation between the parties. If the dispute cannot be resolved through negotiation within 30 days, it shall be submitted to the exclusive jurisdiction of the courts of England and Wales.

Nothing in this section prevents you from exercising your rights under applicable consumer protection laws or filing a complaint with a relevant regulatory authority.

18. Miscellaneous

• Severability: If any provision of these Terms is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.
• Entire Agreement: These Terms, together with our Privacy Policy, constitute the entire agreement between you and CSP Warden regarding the Service.
• Waiver: Our failure to enforce any provision of these Terms shall not constitute a waiver of that provision or any other provision.
• Assignment: You may not assign or transfer your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations in connection with a merger, acquisition, or sale of assets.