General terms AxonScan

Version 1.2, 23 October 2026

1. Who we are and how these terms fit together

1.1. AxonScan is a service of Axon Factory, a trade name of M. de Jager Holding B.V., having its registered office at Kweeklust 7, 2203 ZB Noordwijk, the Netherlands, Chamber of Commerce 60613319. Questions go to support@axonfactory.ai.

1.2. Every order of AxonScan is governed by the General Terms and Conditions of Axon Factory, version 2.1 of 21 October 2026: Part A (general provisions) and Part D (digital products and document tools). You can find this version at www.axonfactory.ai/en/voorwaarden/v2-1.

1.3. This text contains the product terms for AxonScan, as referred to in articles A2.3 and D7 of the Axon Factory terms. They add to those terms. Where they conflict, this text prevails. Where we refer below to an article with a letter in front, such as A12, we mean that article of the Axon Factory terms.

1.4. "You" means the Client: the organisation that orders AxonScan. Capitalised words, such as Client, Agreement and In Writing, have the meaning given in A1. In addition: the Report is the PDF with findings, an indicative score and advice that AxonScan makes for a domain (a Document within the meaning of D1.1); the Delivery is the moment we mail you that a Report is ready; the Call is the introductory call of article 8; the Rescan is the scan of article 9.

2. For whom

AxonScan is only for businesses and organisations with a Dutch Chamber of Commerce (KVK) number, ordering in the course of their profession or business (A2.5 and D1.4). Not for consumers. The right of withdrawal that consumers have therefore does not apply.

3. What the scan is

AxonScan looks once and passively at what your website, your DNS and your e-mail settings show publicly, as any visitor can. We make a fixed, limited set of requests, never log in, never fill in forms and never try out vulnerabilities. You get a Report with the findings, an indicative score and advice for each point.

4. What the scan is not

The scan is a snapshot: not a penetration test, no guarantee, and not a judgement of your organisation's protection. The score is indicative: it helps you choose what to pick up first. A point we could not measure reliably is shown as "not measured" in the Report. Privacy indicators are technical observations, not a legal judgement and not legal advice (A12.4). Axon Factory undertakes to use its best efforts, not to achieve a result (A4.1).

5. Authorisation

5.1. With every order and every Rescan you confirm this text: "I am authorized, on behalf of the organization that owns [domain], to have a passive check carried out. I understand that AxonScan only requests what any visitor can see." That is the authorisation text you see when ordering (version auth-v2). If that text changes, it gets a new version.

5.2. We record your confirmation with the domain, the time, the version of the text and a pseudonymised (hashed) version of your IP address and e-mail address.

5.3. If your confirmation is not correct, you indemnify Axon Factory against third-party claims that follow from it. This comes on top of A5.2.

5.4. If the owner of a domain does not want AxonScan to scan it, they can exclude the domain on the AxonScan abuse page. The exclusion only counts after the link in a confirmation mail to an address on that domain has been used. If a domain is excluded before the scan starts, we do not scan it and we refund the full amount (article 11.4).

6. Price and payment

The price is € 49 excluding VAT (€ 59.29 including 21% VAT), once. You pay in advance through Mollie, Axon Factory's payment service provider (D1.2). The Agreement is concluded when you complete the order (A3.2). The invoice comes by e-mail from Axon Factory.

7. Delivery

7.1. After payment the scan starts. You get a mail when it begins and a mail with a download link as soon as the Report is ready.

7.2. The download link of each Report works for 60 days after the Delivery of that Report. After that we delete the Report and cannot deliver it again. So save it yourself (D5.2).

7.3. If a firewall (WAF) or another block on your side stops AxonScan/1.0, but your DNS and e-mail settings can be checked, you still get a Report: with the mail and DNS checks, the web parts as "not measured" and a lower coverage on the cover page. That Report counts as delivered. The remedy is to let AxonScan/1.0 through and use your free Rescan (article 9).

7.4. If the scan does not work at all, so there is no Report, we refund the full amount (article 11.4).

8. Money back after a call

8.1. If you book a 30-minute Call with Mischa de Jager about the results within 60 days of the Delivery of the first Report, we refund the full amount you paid for the order after the Call. The Call must be booked within those 60 days. It may take place later, but no later than 90 days after that Delivery.

8.2. You book the Call through the link in the mail and in the Report, with your order number. The Call comes with no strings attached: you do not have to buy anything afterwards.

8.3. You can reschedule the Call once, up to 24 hours in advance, through the confirmation of the appointment or by mailing support@axonfactory.ai. The new date may fall after the 60 days, but not after the final date of 8.1. If we reschedule the Call, that does not count and the final date moves along where needed. If we cannot offer a Call before that date, we refund anyway.

8.4. If you do not show up without notice, you can book a new Call once within 7 days, before the final date of 8.1. If you do not show up again, the offer lapses.

8.5. We refund within 14 days of the Call, through Mollie to the payment account you paid with. The refund goes through Axon Factory's invoicing (AxonHub) and you receive a credit note. You may keep the Report and the Rescan stays available. The offer applies once per order.

8.6. This offer prevails over D4.3.

9. Rescan

Within 30 days of the Delivery of the first Report you can start one free Rescan of the same domain, confirming the text of article 5 again. Also after a refund. Per domain the limit is 1 scan per 24 hours and 3 per 30 days, the Rescan included. The Report of the Rescan has its own term of 60 days (article 7.2).

10. Mails about your order

10.1. Besides the mail at the start and the mail at the Delivery, we send exactly two reminders: on day 21 after the Delivery of the first Report about the Rescan, and on day 50 about the Call and the refund. The first only comes while the Rescan is still open, the second only if you have not booked a Call yet and nothing has been refunded.

10.2. Every reminder has a stop link. If you use it, you get no more reminders about this order. Your right to the Rescan and to the refund stays.

10.3. You only get news about Axon Factory's services if you choose that separately when ordering. That box is unticked by default and is separate from your order. If you tick it, we pass your e-mail address and company name on to Axon Factory's contact list and record when you chose it and which text you saw. You can unsubscribe at any time, in every news mail or through support@axonfactory.ai.

11. If it is wrong or does not work

11.1. If you think a finding is wrong, report it within 60 days of the Delivery of that Report to support@axonfactory.ai, stating what you think is wrong. This term replaces the 30 days of D4.2.

11.2. We check it and let you know within 10 working days what we will do: we correct the Report or give you an extra Rescan. If that does not solve it, we refund the full amount.

11.3. A lower coverage because of a firewall or block on your side (article 7.3) is not an error in the Report. The remedy for that is the Rescan.

11.4. If the scan itself does not work, so there is no Report, or the domain was excluded before the scan started (article 5.4), we refund the full amount without you having to do anything (D4.1).

12. The Report

12.1. The Report is intended for the Client. You may use it for your own business and share it with your staff, your advisers, whoever manages your website or mail, your insurer and your customers (D3.1 and D3.2).

12.2. Anyone who gets the Report through you cannot derive any rights from it against Axon Factory. You may not publish the Report or offer it as your own product (D3.3), and you only name Axon Factory in a publication with its permission In Writing.

12.3. The short summary at the top of the Report is written by a language model, based only on the codes and levels of the findings (A6). The findings themselves never come from the language model. The summary goes through an automatic check; if it does not pass, a fixed text is shown instead.

12.4. The texts, the rule set and the tool are Own Materials of Axon Factory and remain its property (A10.1 and D3.4).

13. Liability

13.1. A12 and D6 apply to AxonScan. Our liability is limited to direct damage (A12.2), up to at most € 49, the amount excluding VAT you paid for the order. That cap also applies once we have refunded the amount.

13.2. We are not liable for indirect damage (A12.3). That includes damage from third-party claims, also from anyone who got the Report through you. We are also not liable for damage because a vulnerability or setting is not in the Report, because a point is "not measured", or because you carry out advice without first having it assessed by whoever manages your website or mail.

13.3. These limitations do not apply in case of intent or deliberate recklessness of Axon Factory or its management (A12.5). Report damage In Writing as soon as possible; a claim lapses 12 months after you knew or should reasonably have known of the damage (A12.6).

14. Data and retention

14.1. We keep the Report, the evidence and the raw scan data for 60 days after the Delivery of each Report (besluit 12). This prevails over the 30 days of D5.1.

14.2. We delete your e-mail address as soon as there is nothing left to deliver for your order: 60 days after the last Delivery, and not while the Rescan is open. After that we only keep a pseudonymised (hashed) version.

14.3. We keep the order details and the recorded confirmation of article 5 for 12 months, an order that was not paid for 30 days. Invoices are kept for 7 years, as the law requires.

14.4. Axon Factory is the controller of this data (A11.4). More is in the AxonScan privacy statement.

15. Governing law and disputes

These terms and every order are governed by Dutch law; the Vienna Sales Convention (CISG) is excluded. We first try to resolve a dispute together. Failing that, disputes are decided exclusively by the competent court of the District Court of The Hague (A17).

16. New versions and language

A new version of these terms applies to orders placed afterwards (A16.1). We record the version you accepted with your order, and every version stays available for download. These terms exist in Dutch and English; in case of difference, the Dutch text prevails (A18.4).

17. Free preview

17.1. Axon Factory may offer a free preview. It is the same passive scan as in article 3, but you only see the indicative score, the number of findings per level and the titles of the two most important findings. A preview comes without a Report, without explanations and without advice, and you have no right to a Report. This article applies to anyone who requests a preview, also without an order.

17.2. A preview is a snapshot: not advice, no guarantee, and not a judgement of your organisation's protection. What article 4 says about the scan also applies to the preview.

17.3. For a preview you confirm the same authorisation text as for an order (article 5.1, version auth-v2). Articles 5.2 and 5.3 also apply to the preview.

17.4. Axon Factory may refuse or limit a preview without giving reasons, for example with a limit per domain, per e-mail address, per connection or per day. A preview counts towards the limit per domain of article 9.

17.5. If you order the Report for the same domain within 24 hours of the preview, with the same e-mail address, we use the scan of the preview instead of scanning again. The Report then shows the date of that scan.