Snapshot terms

1.About these terms

These terms apply when you request a free Cybersecurity Snapshot (“snapshot”) from Anthrasec Limited, a company registered in England and Wales under company number 17472650, with its office at Hill House, High Street, Uxbridge, England UB8 1JT(“Anthrasec”, “we”, “us”).

“You” means the person who sends the request and the organisation they act for. By ticking the two boxes on the request form and sending it, you agree to these terms. That is your written consent, and we email you a copy.

These terms are version 2026-10-04. We save the version you agreed to with your request.

2.What a snapshot is

A snapshot is a free, one-off look at what can be seen about your organisation from the public internet, for the domain you give us. The checks are outside-in and passive. We use:

• public records, such as DNS, certificate transparency logs and published internet-wide scan data; and
• what your public websites and servers show to any visitor, using ordinary requests of the kind a web browser makes.

From those we report on:

• subdomains, including forgotten test, staging and campaign sites;
• email spoofing protection (SPF, DKIM and DMARC records);
• login pages and remote access services that are open to the internet;
• software versions that your systems disclose; and
• problems with certificates on your public sites.

You receive a written report, which we aim to send within 48 hours, and the offer of a 30-minute call to go through it.

3.What we will not do

When carrying out a snapshot we will not:

• log in to any system, guess or test passwords, or try to get past any login page or access control;
• exploit any weakness, or attempt to, even to confirm that it is real;
• run scans or tests designed to stress, slow or disrupt your systems, or that are likely to;
• access, copy or change any data that is not already public;
• use social engineering, such as phishing or phoning your staff;
• check any domain other than the one you named and the subdomains of it that appear in public records; or
• start any check before we hold your consent under these terms.

If we come across something that looks seriously wrong, we will stop looking further at it and tell you. We will not investigate it by going beyond the limits above.

4.Your authorisation and consent

When you send the form, you make these two statements:

• “I confirm that I am authorised, by the organisation that owns or controls this domain, to request these checks on it.”
• “I have read and agree to the Snapshot terms, and I consent to Anthrasec running the passive, outside-in checks they describe on this domain.”

By making them you confirm that:

• the domain belongs to, or is controlled by, the organisation you act for;
• you have that organisation's authority to ask for the checks and to agree to these terms on its behalf; and
• the details you give us are accurate.

You give us permission to carry out the checks described in section 2 on that domain. So far as any of those checks needs authorisation under the Computer Misuse Act 1990, you give that authorisation, within the limits in section 3.

We may ask for evidence of your authority, for example where your email address is not at the domain you want checked. We will not start until we are satisfied, and we may decline any request without giving a reason.

Parts of your public footprint may be hosted by other companies, such as a cloud or website provider. Our checks stay within what those services show publicly, so they do not need that provider's permission. If you know of a restriction in your contract with a provider that would prevent even these checks, tell us before we start.

5.What a snapshot is not

A snapshot is not a penetration test, a vulnerability scan of your internal systems, an audit or a certification. It does not show that you meet any standard, such as Cyber Essentials or ISO 27001, and you must not present it as doing so.

It shows what we could see from outside on the day we looked. It will not find every weakness, and a report with few or no findings does not mean your systems are secure. What you do about the findings is your decision.

6.Your report and confidentiality

We send the report only to the work email address on the request, and we treat the findings as confidential. We will not share them with anyone outside Anthrasec, publish them, or use them to describe your organisation in our marketing.

We may use findings in a form that cannot identify you, for example counting how often a kind of problem appears across all snapshots.

We may disclose information where the law requires us to. If that happens we will tell you first, where we are allowed to.

The report is yours to use and share inside your organisation and with your advisers and suppliers.

7.How we use personal data

Anthrasec Limited is the controller of the personal data described here, under the UK General Data Protection Regulation and the Data Protection Act 2018. Our privacy policy also applies; this section explains what is specific to snapshots.

What we collect. From the form: your name, role, work email address, company and the domain to check, together with a record of the two statements you agreed to, the version of these terms, the date and time, and the type of browser used. From the checks: technical information about your organisation's public systems. That is mostly not personal data, but public records can include it, for example a named contact in a DNS or certificate record.

Why, and our lawful basis. We use this information to check your authority, carry out the snapshot, send you the report and arrange the call. We rely on our legitimate interests, and yours, in providing the service you asked for. We keep the record of your consent because we have a legitimate interest in being able to show that the checks were authorised, and to establish or defend legal claims.

No marketing. We do not add you to our newsletter or any marketing list because you asked for a snapshot, and we do not sell or share your details for marketing.

Who processes it for us. Our website host stores the request, Resend delivers our emails and Microsoft 365 holds our mailboxes and files. They act on our instructions under contract. Where information is processed outside the UK, it is protected as described in International transfers in our privacy policy.

Your rights. You can ask for a copy of your personal data, have it corrected or deleted, and object to how we use it. Write to privacy@anthrasec.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

8.How long we keep information

• Findings and the report: 12 months after we send the report, then deleted. If you become a client, they are kept under your client agreement instead.
• Your request and the record of your consent: 6 years after the snapshot, as evidence that the checks were authorised.
• Requests we don't carry out (for example because authority could not be confirmed, or you cancelled before we started): deleted within 30 days, apart from a minimal note that the request was made and closed.

9.Changing your mind

You can withdraw your consent at any time by replying to the confirmation email or writing to reach@anthrasec.com. If we have not started, nothing will be run. If we have, we will stop.

You can also ask us to delete the findings and report at any time, and we will do so within 30 days. We keep the record of your consent for the period in section 8, because it is our evidence that checks already run were authorised.

10.Cost and obligations

The snapshot is free. Asking for one does not commit you to buy anything from us, and it does not create an ongoing contract for services.

The number of free snapshots is limited. We accept requests in the order we receive them, and if no slot is free we will tell you and, if you wish, keep your request on a waiting list.

We aim to send the report within 48 hours of your request. Where we need to confirm your authority first, the 48 hours run from when that is done. Requests made at a weekend or on a bank holiday are treated as made on the next working day.

11.Our responsibility to you

We carry out snapshots with reasonable skill and care, and within the limits in section 3. Because the service is free, limited in scope and based only on public information, we give no warranty that the report is complete or free from error.

So far as the law allows, we are not responsible for loss that arises from you relying on the report, from a weakness the snapshot did not identify, or from changes you make as a result of it. We are not responsible for loss of profit, business or data, or for indirect loss.

Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited or excluded by law.

You are responsible for the statements you make in section 4. If we carry out checks because you told us you were authorised when you were not, you agree to cover the reasonable costs and losses that causes us.

12.Changes and governing law

We may update these terms. The version in place when you send your request applies to that request, and the version number at the top of this page shows which is current.

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

13.Contact us

Questions about a snapshot: reach@anthrasec.com. Questions about personal data: privacy@anthrasec.com. You can also write to Anthrasec Limited, Hill House, High Street, Uxbridge, England UB8 1JT.