Terms of Service
Effective 1 November 2026. ShipAudit Lab is a security audit service operated by ProbCapital ("ShipAudit Lab", "we"). By submitting a brief or ordering an audit you agree to these terms. Questions: security@probcapital.com.
1. What we do
We perform security audits of web applications: a free surface scan, and paid audits (Quick, Full and Deep) plus optional recurring Monitoring, as described in the pricing section of our site. Every paid report is verified by a second independent pass before delivery. An audit is a point-in-time assessment of the surface and scope agreed with you; it reduces risk but cannot guarantee that every vulnerability is found or that an application is completely secure.
2. Authorization and scope
You may only submit an application that you own, or that you hold written authorization to have tested. By submitting a brief you confirm this authorization. Testing is performed only within the scope agreed with you in the brief and follow-up messages. For authenticated tiers you provide the test accounts; you remain responsible for your own systems, backups and production data. We do not touch production data.
3. The free scan
The free scan runs read-only checks against the public surface of the address you submit. It does not log in and does not extract data. We keep the scan findings so we can show and deliver your results.
4. Fees, payment and delivery times
Prices are as listed in the pricing section of our site at the time of your brief. After reviewing your brief we email you a secure payment link; no charge is made before that. Delivery times stated in the pricing section of our site (for example, 3 days for a Quick Audit) run from receipt of payment, not from submission of the brief. Full and Deep audit timelines depend on scope and are agreed with you before testing begins.
5. Refunds and cancellation
- If we have not begun work on your audit, you may cancel for a full refund.
- If we are unable to complete an audit we have begun, we refund the part that was not delivered.
- Monitoring is billed monthly and may be cancelled at any time; it runs to the end of the current paid period and is not billed again. Partial periods are not refunded.
6. Retests
Full and Deep audits include one retest of the reported fixes within 30 days of report delivery. Retests cover the findings in the original report, not new features or new code areas.
7. Confidentiality
Your findings, reports and application details are treated as confidential. We do not publish or share your results, and we never copy secret values or your customers' data into reports — evidence is redacted.
8. Liability
To the maximum extent permitted by law, our total liability arising from a service is limited to the fees you paid for that service. We are not liable for indirect or consequential losses. Nothing in these terms limits liability that cannot be limited by law.
9. Acceptable use
Do not submit targets you do not own or are not authorized to test, and do not use our reports to misrepresent the security of an application. We may refuse or stop work on a target that appears unauthorized.
10. Governing law
These terms are governed by the laws of the State of Delaware, USA, without regard to conflict-of-law rules.
11. Changes
We may update these terms; the version in force when you submit a brief applies to that order.