Acceptable Use Policy

Last updated: 28 October 2026

This is an English translation of the Dutch “Acceptable Use Policy (Gebruiksvoorwaarden)”. Only the Dutch version is legally binding; if the two differ, the Dutch version prevails.

1. Purpose

Exposentry is a security scanning service that gives business organisations insight into the vulnerabilities of their own domains and infrastructure. This Acceptable Use Policy (AUP) describes the permitted and prohibited use of the Service and forms part of the agreement between Hasecon and the Customer.

2. Permitted use

  • Scanning domains of which you are the owner or the demonstrably authorised administrator, and which have been successfully validated.
  • Using scan results for defensive security purposes.
  • Sharing reports with relevant internal staff or with your security advisers.

3. Prior validation and scan levels

Every domain first goes through Validation, via a DNS record, a file on the web server or a meta tag on the homepage. Only after a successful Validation is the scan configuration created and run. It is prohibited to circumvent or manipulate the Validation, or to validate a domain for which you are not authorised.

The Service works with scan levels. At level 1, only public sources are consulted. At level 2, contact is made with your systems, including a port scan and the retrieval of your website and certificates. At level 3 and above, the Service actively tests your systems for known vulnerabilities and searches for subdomains via the name server. These active tests are intended to demonstrate vulnerabilities, not to exploit them: test modules labelled for uploading files, guessing login credentials, fuzzing, overloading or causing damage are filtered out on the basis of that label (this relies on the modules' labels and is not an absolute guarantee). The tests can, however, place load on your systems and on those of your hosting, cloud, CDN or DNS provider.

Active tests run only on your own domains, and only once a domain has been validated with both a DNS record and a file on the web server. In the Ketenpartner plan, they additionally take place only after your explicit consent per domain in the dashboard. Hasecon records that consent with the accepted text, the time, the user and the outcome of the Validation, and keeps that data as evidence of the consent given, also after withdrawal. Hasecon deletes it five years after the consent ends. You can withdraw consent at any time; no new active tests will then be scheduled. You are responsible for ensuring that your hosting, cloud, CDN and DNS providers permit such tests and, where they require this, have been informed in advance. The addresses from which the Service scans are listed on the page Recognising Exposentry scan traffic. If you withdraw consent or ask us to stop, Hasecon schedules no new active tests from that moment; a test already running at that moment will be completed, and the domain will be back at scan level 2 within four hours at the latest. Results already found remain available in the last report.

4. Prohibited use

It is expressly prohibited to:

  • Scan, or have scanned, domains or infrastructure for which you do not have demonstrable authorisation.
  • Scan in breach of agreements with your hosting, cloud or platform provider.
  • Use the Service for offensive purposes, including but not limited to denial-of-service attacks, exploiting discovered vulnerabilities, or data exfiltration.
  • Use scan results to blackmail, extort or otherwise harm third parties.
  • Use the Service to violate the privacy of third parties.
  • Circumvent, or attempt to circumvent, the technical security measures of the Service.
  • Deliberately overload the Service or disrupt its availability for other users.
  • Resell the Service or make it available to third parties without the prior written consent of Hasecon.

5. Responsible handling of the open-source foundation

The Service is based on the open-source scanner OpenKAT, developed by a community. Misuse of the Service that could damage the reputation or integrity of the OpenKAT project (for example, by using the Service for attacks that are wrongly attributed to OpenKAT) is also prohibited.

6. Reporting duty and responsible disclosure

If you discover a serious vulnerability via the Service in a domain you manage, we advise you to report it responsibly to the relevant parties (coordinated vulnerability disclosure). Hasecon can advise you on this if you wish.

7. Consequences of misuse

In the event of a breach of this AUP, Hasecon may, depending on its severity and where possible after a warning:

  • suspend or terminate the account;
  • cancel ongoing scans;
  • file a criminal complaint (aangifte) with the competent authorities;
  • claim damages.

In the event of an attributable, serious breach, subscription fees already paid will not be refunded.

8. Changes

Hasecon may amend this AUP. Substantial changes will be announced by email at least 30 days in advance. Continued use after the date of the change constitutes acceptance.

9. Contact

For questions about this Acceptable Use Policy: scan@exposentry.io.