1. Scope and status
These terms describe permitted use of the PlancKey website and free external observation service. PlancKey is a pre-registration project. The operator's full legal identity and applicable jurisdiction are not yet finalized, and these terms require legal review before commercial launch. They are not a substitute for a signed paid-service agreement.
Use the service only if you can lawfully accept applicable terms and have authority to act for the organization you represent. For supplier scans, you must have a legitimate due-diligence purpose (section 3). If you do not accept these terms, do not request a scan.
2. Acceptable use
Request observations only for domains you own or manage, domains you have permission to assess, or suppliers you assess under section 3. Do not submit internal or private-network targets, falsify authorization, bypass limits, automate abusive requests, resell access to scan sessions, or use the service to facilitate unlawful activity.
The free scan is not a penetration test. It obtains public observations through third-party providers and does not authorize intrusive testing or access to any third-party system. We may reject, limit or suspend requests to protect the service and others.
3. Supplier (third-party) scans
You may request a scan of a current or prospective supplier's public domain for legitimate vendor-risk, procurement or regulatory due-diligence purposes. A supplier scan uses only the same publicly available observations: public DNS records and a provider-run HTTPS assessment of the domain's public endpoints. It does not probe, log in to, or test beyond those observations.
You must not use supplier scans for harassment, competitive disparagement, public shaming, or to publish claims about a supplier's security. Results describe a moment in time and may be incomplete; give the supplier a fair opportunity to respond before relying on a finding in a contractual or procurement decision. Vendor name and criticality tier you enter are shown only in your browser session and are not stored by PlancKey.
The suggested action, checklist and questions in a supplier report are prompts for your own review, not a rating, audit opinion or statement that the supplier is insecure or non-compliant. Scanning a supplier does not give you, or PlancKey, any right to the supplier's systems or data.
4. What a scan establishes
Results reflect the public domain, endpoints and provider evidence available at the time of observation. Some findings may be cached, incomplete, stale or unavailable. A provider-reported supported algorithm does not establish that every client negotiates it.
The Q-Signal™ Index is a versioned, evidence-based indicator of observed post-quantum support. It is not a security certification, audit opinion, legal assessment, guarantee of quantum safety or proof of compliance with NIST guidance, CNSA 2.0, DORA, NIS2 or any other framework. Unverified evidence must not be interpreted as confirmed vulnerability or confirmed readiness.
Free scans do not establish the security of internal systems, code, all subdomains, mail encryption, VPNs or an entire certificate chain. Independently validate findings before making procurement, migration or compliance decisions.
5. Reports and intellectual property
You may download and share your report for internal planning, and with the scanned organization or supplier for legitimate due-diligence discussions. Do not publish a report about a domain you do not control. Preserve its date, scope, evidence limitations and attribution. Do not alter it to suggest certification, independent endorsement or broader coverage than the assessment provides.
PlancKey's original website content, presentation and scoring methodology remain subject to applicable intellectual-property rights. Third-party standards and content belong to their respective owners. No trademark registration or clearance is claimed for PlancKey or the Q-Signal™ Index.
6. Prices and paid engagements
The free external scan costs $0. Proposed monthly launch pricing is $99 for Starter and $299 for Growth, in USD and excluding applicable taxes. Enterprise, advisory and partner services are quoted individually. Paid plans are enquiry-based offers; there is no payment checkout, automatic subscription or charge triggered by a form submission.
Before any payment, a written agreement must identify the contracting operator, service scope, domain limits, integration availability, delivery schedule, total price, taxes, billing cycle, renewal, cancellation and refund terms. No recurring charge may begin without your express agreement. Features shown as proposed or on the roadmap are not guaranteed deliverables.
There is no paid commitment or cancellation fee associated with a free scan or demo request. For paid engagements, cancellation and refunds are governed by the agreed contract and mandatory law. Future price changes will not retroactively change an accepted fixed-price agreement.
7. Privacy and third parties
Our privacy notice explains submitted information and provider sharing. By requesting a scan, you instruct us to send the domain to the disclosed observation providers. This is not consent to unrelated marketing. Third-party providers control their services and may change, restrict or withdraw them.
8. Availability and limitations
The free service is provided on an “as available” basis. We do not promise uninterrupted access, a particular completion time, email delivery, perfect accuracy or detection of every cryptographic risk. Do not rely on it as your sole security control.
To the extent permitted by applicable law, no warranty of fitness for a particular purpose is offered for the free service. Nothing in these terms excludes non-excludable statutory rights, liability for fraud or any other liability that applicable law does not permit us to exclude. Paid-service warranties, liability allocations and service levels must be agreed separately.
9. Updates and disputes
We may update these terms prospectively and publish a revised date. If a dispute arises, contact us first through the form linked on this page. No exclusive court, governing-law jurisdiction or mandatory arbitration agreement is asserted until the operator and applicable law are confirmed; mandatory legal rights continue to apply.
