Terms and Conditions

Last updated: 28 October 2026

This is an English translation of the Dutch “Algemene voorwaarden”. Only the Dutch version is legally binding; if the two differ, the Dutch version prevails.

Target group. Exposentry is an exclusively business-to-business (B2B) service. By creating an account, the Customer declares that it is acting in the course of a profession or business. Hasecon verifies the business character through a check against the Chamber of Commerce (KvK) register. Consumer provisions, including the statutory right of withdrawal (herroepingsrecht) and the consumer rules on tacit renewal, do not apply.

1. Identity of the service provider

Hasecon (sole proprietorship, eenmanszaak)
Eemwijkstraat 4, 2271 RE Voorburg-Leidschendam, the Netherlands
KvK number: 55122434
VAT number (BTW-nummer): NL002039317B75
Email: scan@exposentry.io

Conversion into a private limited company. Hasecon is being converted into a private limited company (besloten vennootschap, B.V.). From the date on which the B.V. is entered in the Commercial Register (Handelsregister), all rights and obligations under this agreement pass to the B.V. by operation of law. The Customer hereby consents in advance to this transfer of contract (contractsoverneming) within the meaning of Article 6:159 of the Dutch Civil Code (Burgerlijk Wetboek, BW). Hasecon will announce the transition in advance by email and will update these terms with the details of the new entity. The transition does not change the content of the service or the prices.

2. Definitions

• Hasecon / we: the service provider named in Article 1, or its legal successor.
• Service: the Exposentry SaaS service for security scanning, offered through exposentry.io.
• Customer: the legal entity, or the natural person acting in the course of a profession or business, that creates an account and/or takes out a subscription.
• Subscription: the agreement between Hasecon and the Customer for the use of the Service, in the form of a one-time scan or an ongoing subscription.
• Scan: an automated security check of a domain specified and validated by the Customer.
• Report: the result of a Scan, consisting of an overview of the vulnerabilities found and recommendations.
• OpenKAT: the open-source security scanner on which the Service is based, see Article 5.
• Validation: the verification of the ownership or management of a domain described in Article 7.

3. Applicability

These Terms and Conditions apply to every offer made by Hasecon and to every agreement concluded between Hasecon and the Customer. Deviating or additional terms of the Customer (such as purchasing conditions) are expressly rejected, unless Hasecon has accepted them in writing. In addition to these Terms and Conditions, the Acceptable Use Policy, the Privacy Statement, the Cookie Policy and the Service Level Agreement apply; in the event of conflict, these Terms and Conditions prevail, unless the arrangement concerned expressly provides otherwise.

4. Formation of the agreement and business capacity

The agreement is concluded at the moment the Customer places an order or activates a subscription and Hasecon confirms this. The Customer warrants that it is acting in the course of a profession or business. Hasecon may verify the business capacity through a KvK check and may refuse an order or suspend an account if this verification does not succeed.

5. Provision of the service and open-source basis

Hasecon provides the Service on the basis of a best-efforts obligation (inspanningsverplichting, "best effort"), with due observance of the Service Level Agreement.

The Service is based on OpenKAT, an open-source security scanner developed by a community. Hasecon provides the Service as a managed service on top of OpenKAT and is one of the code owners (mede-code-owner) of the OpenKAT project, but is not the sole rights holder in or developer of OpenKAT. The OpenKAT components are subject to the relevant open-source licence terms. Hasecon is not liable for defects, vulnerabilities or behaviour originating in the upstream open-source components, except to the extent that these result from configuration or modifications made by Hasecon itself. How Hasecon deals with defects in OpenKAT and the effect of this on the service levels is set out in more detail in the Service Level Agreement.

Hasecon does not guarantee that all vulnerabilities will be detected, that detections are complete or free of errors, or that the absence of a detection means that a domain is secure. The Customer acknowledges that a Scan is solely a tool and not a substitute for a professional security audit or penetration test.

6. Independence and separation of duties

Exposentry is an independent measurement service. Hasecon reports the results of a Scan directly to the Customer, and never solely through a third party that manages the scanned environment, not even when that party introduced the Customer.

In addition to the Service, Hasecon also provides implementation, maintenance and development services around OpenKAT (such as on-premise installations and custom modules). If Hasecon carries out such work for the Customer or in the environment to which a Scan relates, Hasecon discloses that overlap in the Report. Hasecon does not issue security reports on scanned environments outside the Service.

In active verification scans in a supply-chain context, Hasecon does not carry out any remediation or management work in the verified environment. In the event of conflict between Hasecon's commercial interests and the independence of the Service, the independence of the Service prevails.

The full separation-of-duties policy is published on the website, see About Exposentry.

7. Domain validation and authorisation

The Customer may only have a domain scanned if it is the owner or the demonstrably authorised administrator of that domain.

Validation takes place before every Scan. The Customer demonstrates control over a domain by placing a DNS record, a file on the web server or a meta tag on the homepage, as provided by Hasecon. Active vulnerability tests (scan level 3 and higher) require both a DNS record and a file and, in the Ketenpartner plan, also the Customer's consent per domain, as described in the Acceptable Use Policy. Only after the Validation has succeeded is the OpenKAT scan configuration created and the Scan carried out. Without successful Validation, no Scan takes place.

The Customer warrants that it is entitled to scan (or have scanned) the specified domain and the underlying infrastructure, and that this Scan does not conflict with arrangements with third parties, including hosting, cloud or platform providers that may apply their own policy on security scans. The Customer is itself responsible for obtaining any consent required from such third parties.

Validation confirms technical control over a domain, but does not release the Customer from its own responsibility for the legal authority to have the Scan carried out. Misuse of the Service to scan domains without the required authorisation is prohibited and may lead to immediate termination of the account, without prejudice to the provisions of the Acceptable Use Policy.

8. Prices and payment

All prices are in euros and exclusive of VAT, unless stated otherwise. Payment is made through Mollie; the Customer can pay by iDEAL or credit card. Subscriptions are renewed automatically in accordance with Article 9, unless cancelled in time.

• Baseline scan: €495 (one-time payment)
• Ketenpartner: €249/month or €2,490/year
• NIS2 Monitoring: €495/month or €4,950/year
• NIS2 + Supply Chain: €795/month or €7,950/year

If the Customer takes out a yearly subscription within 60 days of paying for a Baseline scan, the amount paid for the Baseline scan is credited in full against the first yearly invoice. For customers with a subscription taken out before the introduction of the above plans, the rates and plan names agreed when the subscription was taken out continue to apply.

Hasecon may change prices for ongoing subscriptions, subject to a notice period of at least 30 days by email. A price change takes effect at the next renewal. If the Customer does not agree with a price increase, it may cancel the subscription with effect from the date on which the increase takes effect.

In the event of late payment, Hasecon may suspend access to the Service after the Customer has been given a reasonable period for performance.

9. Term and cancellation

A one-time Scan does not oblige the Customer to make any further purchase.

Subscriptions are entered into for the chosen period (month or year) and are then tacitly renewed each time for the same period. Because the Service is supplied exclusively to business customers, the consumer rules on tacit renewal do not apply; the Customer can nevertheless cancel the subscription at any time through the dashboard. After cancellation, the subscription remains active until the end of the period then current; amounts already paid for the current period are not refunded, except in the event of a failure in performance attributable to Hasecon (toerekenbare tekortkoming).

10. Intellectual property

All intellectual property rights in the Service (including the software layer, texts, designs, the house style and the report templates) are vested in Hasecon or its licensors. The Customer obtains a non-exclusive, non-transferable right of use for the duration of the subscription.

The rights in the underlying open-source OpenKAT components are vested in the respective rights holders under the applicable open-source licences; nothing in these terms limits the rights the Customer may derive from those licences.

The Reports are intended for use by the Customer; the Customer may use them internally and share them with its security advisers.

11. Liability

Hasecon's liability, on whatever legal basis, is limited per event and per year to the amount the Customer paid to Hasecon in the twelve months preceding the event that caused the damage.

Hasecon is not liable for indirect damage, including consequential damage, lost profits, lost savings, reputational damage, or damage resulting from vulnerabilities not being detected, not being detected in time or being detected incompletely.

The limitations in this article do not apply to damage resulting from intent or deliberate recklessness (opzet of bewuste roekeloosheid) on the part of Hasecon, nor to the extent that limitation would, in the specific case, be unacceptable according to standards of reasonableness and fairness (redelijkheid en billijkheid) or is precluded by mandatory law. For the one-time Scan, the liability is at least equal to the amount paid for that Scan.

12. Indemnification

The Customer indemnifies Hasecon against all claims by third parties relating to the Customer's use of the Service, including claims arising from scanning (or having scanned) domains or infrastructure for which the Customer was not, or not fully, authorised, or from acting in breach of arrangements with hosting or cloud providers.

13. Force majeure

In the event of force majeure (overmacht), Hasecon is not obliged to perform any obligation and is not liable for the resulting damage. Force majeure also includes: disruptions to the internet or telecommunications, power failures, disruptions or failures at suppliers and sub-processors (including the OpenKAT community, Mollie, the email provider, the authentication service and the hosting provider), cyberattacks, natural disasters, epidemics, government measures, and any other circumstance over which Hasecon cannot reasonably exercise any influence.

14. Processing of personal data

In performing the Service, Hasecon processes personal data. For account data, Hasecon acts as controller; for personal data contained in scan data, Hasecon acts as processor on behalf of the Customer. The latter processing is governed by the Data Processing Agreement (DPA). See also the Privacy Statement.

15. Applicable law and disputes

These Terms and Conditions and all agreements are governed by Dutch law. Disputes are submitted to the competent court in the district (arrondissement) in which Hasecon is established.

16. Amendments

Hasecon may amend these Terms and Conditions. Amendments are announced by email at least 30 days before they take effect. If the Customer does not agree with an amendment that materially worsens its position, it may cancel the subscription with effect from the date on which the amendment takes effect. If the Customer continues to use the Service after the date of the amendment, the Customer is deemed to have accepted the amended terms.