Terms of Service

The Service is for business and professional use. By using it you confirm that you are using it for a business purpose, not as a consumer for personal, family or household purposes, and that you and everyone using it under your account are at least 18.

You are responsible for everything done under your organization’s accounts, including by your team members and by the client logins you create, and for keeping sign-in details secure. We recommend two-step sign-in for every account. Tell us promptly at [email protected] if you believe an account has been used without permission.

You may add a website, domain, server or other system (a monitored property) only if you own or control it, or its owner has authorized you to monitor and test it in the ways this section describes. You are responsible for getting and keeping that authorization — from your clients, and where needed from their hosting providers — and for showing it to us if we ask.

You authorize us, and confirm that each owner has authorized us, to do the following to monitored properties, on the schedules the Service uses or you set:

• request pages and files, and crawl the site and follow its links — including links to other sites, to see whether they still work;
• read sitemaps and robots.txt;
• query DNS, domain registration (RDAP) and blocklist services about it;
• open TLS connections to read its certificates;
• make requests that test whether files are publicly reachable, or whether code would run in a folder, without downloading those files’ contents;
• attempt connections to network ports on servers where you have installed our agent, at the address the agent reports from; and
• send its addresses to Google PageSpeed Insights, for the checks that use it.

These requests are ordinary, limited and identify themselves, but they create traffic and log entries, and security tools may flag them. You are responsible for their effects on the monitored side — including hosting or bandwidth charges, rate limiting, firewall rules and security alerts — and for telling anyone who needs to know.

If the owner of a monitored property asks us to stop, or we reasonably believe you are not authorized to monitor it, we may stop monitoring it, ask you for evidence of authorization, or suspend your account under Section 12.

The WordPress plugin, the server agent and @checkroost/next are software you install on your own systems. Where a component comes with an open-source licence — the plugin is licensed under GPL-2.0-or-later and @checkroost/next under MIT — that licence governs your rights to the software itself, and these Terms govern its use with the Service.

You decide whether to install them. The server agent runs with elevated privileges on the server you install it on, and the plugin runs inside your WordPress site. You are responsible for reviewing them, testing them where you need to, keeping backups of the systems you install them on, and removing them when you stop using the Service.

We sign releases so your systems can check that a release came from us. A signature shows where a release came from; it does not mean the release is free of defects. Updates are offered through WordPress’s updater and the agent’s update command, and whether and when they install depends on how you have configured your systems. Conflicts with other software, and any effect the software has on your systems, are subject to Sections 13 and 14.

You can connect accounts you hold with other providers — such as Kinsta, GoDaddy, Cloudflare, GitHub, SpinupWP, Google PageSpeed Insights and email providers — by giving us an API key or token. You authorize us to use it to read what the Service needs from that account, as the Service describes. Use the narrowest, read-only access the provider offers. You are responsible for the access a key grants and for revoking a key you no longer want us to hold.

Those providers, and the public sources the Service relies on — including WordPress.org, Wordfence Intelligence, OSV.dev, GitHub’s security advisories, the U.S. Cybersecurity and Infrastructure Security Agency’s catalogue of known exploited vulnerabilities, endoflife.date, the Node.js and Ubuntu projects, and domain registries — are not under our control. Your use of a provider is governed by its own terms. We are not responsible for their availability, accuracy, completeness or changes, and any of them may change or withdraw what it provides at any time, which may change or end a feature that depends on it.

The Service is a tool to help you notice problems with websites, servers and domains. It does not prevent problems, and it does not replace your own security, maintenance, backups and judgement.

• Monitoring can miss things, and can report things that are not there. Checks run at intervals, not continuously. A failure is confirmed before it escalates, which delays some alerts by design. Alerts depend on email and other systems outside our control, and can be late, filtered as spam or lost. Every result depends on what could be reached and observed when the check ran.
• Scores and findings are automated assessments, not assurances. Security scores, vulnerability matches, exposed-file findings, server security readings and similar results are drawn from what can be observed and from third-party data. They are not a penetration test, a security audit, a certification or a guarantee that anything is secure, and the absence of a finding does not mean the absence of a problem. A score summarizes the checks we can make; it is not a measure of risk.
• The accessibility check is not a compliance determination. It is automated and finds only some accessibility problems. It does not determine whether a site complies with the Americans with Disabilities Act, Section 508, WCAG, EN 301 549 or any other law or standard.
• Nothing in the Service is professional advice. Not legal, compliance, insurance or security advice. If you share a score, report or finding with a client, an insurer, a regulator or anyone else, how you present it is your responsibility, and it is not a statement or warranty by us.
• Your systems remain yours to run. You remain responsible for your sites, servers, software, patching, backups, incident response, and the decisions you make using the Service. The Service is not a backup service: where it reports on backups a host makes, it neither makes nor keeps them.
• Not for high-risk use. Do not use the Service where a failure or delay could contribute to death, personal injury, or significant physical or environmental damage, or as the only monitoring of a system on which such outcomes depend.

You will not, and will not help or allow anyone else to:

• add a property you are not authorized to monitor under Section 2, or use the Service or the public tools to scan, probe, test, crawl or attack any system without its owner’s permission;
• use the Service for load testing or denial of service, or to send traffic meant to harm or overwhelm any system;
• access or try to access another customer’s data, get around any limit, access control or security measure, or test the Service’s security except as Section 9 allows;
• resell, sublicense or provide the Service to others except as Section 7 allows, or use it to build a competing product;
• reverse engineer the Service, except to the extent the law or an open-source licence for a component allows;
• extract data from the Service or the public tools in bulk by automated means;
• publish anything unlawful, infringing, deceptive or harmful on a status page, in a report or on the feedback board, or send email through the Service to anyone who has not agreed to receive it; or
• use the Service in breach of any law, including laws on spam, privacy, computer misuse, export control and sanctions.

You may use the Service to provide services to your own clients, including giving them client logins, status pages and reports that carry your branding.

Your clients are your customers, not ours. You are responsible for your agreements with them, for anything you promise them, for getting their authorization under Section 2, and for their use of the logins you give them. We have no contract with your clients and owe them no obligation. You will not make any promise, warranty or service commitment on our behalf.

Everyone who uses the Service through your account, including client logins, must follow these Terms, and you are responsible if they do not. We may suspend a login that breaks them.

Customer Data is the information you or your users put into the Service or that it collects for you: your monitored properties and their settings, check results, findings, reports, the keys you connect, and the details of people you add, such as team members, client logins, status-page subscribers and report recipients.

You own Customer Data. You give us permission to host, copy, process, transmit and display it to provide, maintain, secure, support and improve the Service, and as the law requires. We do not sell Customer Data. Our Privacy Policy describes how we handle personal information, and is part of these Terms.

You are responsible for Customer Data, for having the right to give it to us, and for having permission to contact the people whose addresses you add. Where we process personal information on your behalf, we do so on the instructions you give through the Service.

Do not put sensitive information into the Service — health information, payment card or bank account numbers, government identification numbers, or similar data that laws such as HIPAA or standards such as PCI DSS regulate — and do not point a check at anything that returns it. The only secrets the Service is meant to hold are the sign-in details and keys it asks for. It is not built to the standards that data requires, we are not your business associate under HIPAA, and Section 14 applies to any such data put into it regardless.

Data is kept as the Privacy Policy and the Service describe — individual check results, for example, for 14 days. Keep your own copies of anything you need: we are not responsible for data deleted as described, and any loss of Customer Data is subject to Section 14. When your account ends you may download your reports first; we may then delete Customer Data, and will delete it from our live systems within 90 days unless the law requires us to keep it. Backups expire on their normal cycle.

We use reasonable administrative, technical and physical safeguards designed to protect Customer Data. For example, the database itself keeps each organization’s data apart, traffic is encrypted in transit, keys you connect are encrypted at rest with a key held outside the database, and our software releases are signed. No system is perfectly secure, and we do not promise that the Service is free of vulnerabilities or that unauthorized access will never happen.

Security is shared. You are responsible for the security of your accounts, devices and sign-in details; the access you grant through keys you connect; your own systems and your clients’; and the servers and sites where you install our software.

If we confirm that someone has gained unauthorized access to Customer Data in our systems, we will tell you without undue delay, and as the law requires, with what we know and what we are doing about it. We may ask you to replace keys you have connected. Telling you about an incident is not an admission of fault or liability.

We are not responsible for security incidents in your systems or your clients’ — including ones the Service did not detect or report — or in third-party services.

If you find a vulnerability in CheckRoost, report it to [email protected]. If you act in good faith, avoid harming people, systems or data, access or keep no one else’s data beyond the minimum needed to show the problem, and give us reasonable time to fix it before telling anyone else, we will not take legal action against you for that research.

Some parts of the Service are free, including the public tools. If you use a paid plan, you will pay its fees as stated when you subscribed or in an order you signed with us, plus any applicable taxes. Fees are billed in advance and are non-refundable except where these Terms or the law say otherwise. We may change fees from your next renewal with at least 30 days’ notice, and may suspend the Service while fees are overdue. Overdue amounts bear interest at 1% a month, or the highest rate the law allows if that is lower, from the due date until paid, and you will pay our reasonable costs of collecting them, including attorneys’ fees.

We may change, add or remove features. If we remove a material feature of a plan you pay for, we will try to give you reasonable notice. Features labelled beta, preview or early access are provided as they are, may be less reliable, and may change or end at any time.

There is no service-level commitment unless an order signed by us states one. We provide support by email at [email protected] on a reasonable-efforts basis.

You may stop using the Service at any time.

We may suspend all or part of the Service, immediately, if we reasonably believe that you or your users have broken these Terms; that your use poses a security risk or could harm us, other customers or anyone else; that a property owner has objected to being monitored; that fees are overdue; or that the law requires it. Where practical we will tell you first, and we will restore access once the reason is resolved.

We may end these Terms for any reason with 30 days’ notice, refunding fees you prepaid for the period after they end, or immediately if you materially break them.

When these Terms end, your right to use the Service ends, you will remove our software from your systems, and fees already owed remain payable. Sections 5, 8 and 12 to 21, and any other terms that by their nature should, survive.

Nothing in these Terms excludes or limits liability that the law does not allow to be excluded or limited — for example, for fraud, or for gross negligence or willful misconduct where the law does not permit it.

You will defend, indemnify and hold harmless us and our members, managers, employees and contractors against any claim, demand, loss, liability, damages, fine, penalty, cost or expense (including reasonable attorneys’ fees) arising out of or relating to:

• Customer Data;
• your monitored properties, including any claim that you were not authorized to monitor one;
• your clients and anyone using the Service through your account, and your agreements with them;
• anything you publish, and any email sent at your direction, through the Service;
• the keys and accounts you connect;
• your systems, and our software installed on them; or
• your breach of these Terms or of the law.

We will tell you promptly about a claim, let you control its defence, and give reasonable help at your expense. You may not settle a claim in a way that admits fault on our behalf or binds us without our written consent. We may take part with our own counsel at our own cost.

Each of us may receive information from the other that is not public and is marked confidential or should reasonably be understood to be — for us, including the non-public workings and security of the Service; for you, Customer Data. The one receiving it will use it only for the purposes of these Terms, protect it with reasonable care, and disclose it only to people who need it and are bound by similar duties, or as the law requires. This does not cover information that is or becomes public through no fault of the one receiving it, that it already knew, or that it developed independently.

We and our licensors own the Service, including its software, design, documentation and the CheckRoost name and logo. These Terms give you a limited, non-exclusive, non-transferable right to use the Service while they are in force, and transfer no ownership.

If you send us feedback or ideas, including on the feedback board, we may use them without restriction or payment. Requests and comments on the feedback board are seen by other customers’ teams, without your name, so do not post confidential information there.

The public tools, such as the WHOIS and CMS lookups, are free, need no account, are provided for information and as they are, and are rate limited. Sections 6, 13, 14 and 19 apply to anyone using them, with or without an account.

A status page shows what the customer who runs it chooses to publish, and that customer — not us — is responsible for its content and accuracy. Subscribing to a status page sends you email about it until you unsubscribe with the link in any message.

(a) Talk to us first. Most disagreements can be settled by talking. Before starting an arbitration or a court case, the party with the claim must send the other a written notice describing it and the remedy sought — to us at [email protected] and by mail to the address in Section 22, and to you at your organization owner’s email address. We will both try in good faith to resolve it for 60 days. Any time limit for bringing the claim is paused during those 60 days.

(b) Binding arbitration. If it is not resolved, any dispute, claim or controversy arising out of or relating to these Terms or the Service — including their formation, interpretation, validity or scope — will be resolved by final and binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator. This includes any claim against our members, managers, employees or contractors, who may enforce this section. The arbitration will be held in Chautauqua County, New York, or by videoconference if the arbitrator allows, and a claim for less than US $25,000 may be decided on written submissions alone. Each party pays its own attorneys’ fees and costs unless the arbitrator decides the law requires otherwise. The arbitration and its outcome are confidential except as needed to enforce an award or as the law requires. Judgment on the award may be entered in any court with jurisdiction.

(c) Exceptions. Either of us may bring an individual claim in small claims court in Chautauqua County, New York, if it qualifies, and either of us may ask a court for temporary or injunctive relief to stop unauthorized use of the Service, infringement or misuse of intellectual property, or a breach of Section 6 or 16.

(f) Law and courts. The law of the State of New York governs these Terms, without regard to its conflict-of-laws rules, except that the Federal Arbitration Act governs paragraphs (b) to (d). The United Nations Convention on Contracts for the International Sale of Goods does not apply. Any matter not subject to arbitration will be heard only in the state courts in Chautauqua County, New York, or the United States District Court for the Western District of New York, and each of us consents to their jurisdiction.

(g) Time limit. Any claim arising out of or relating to these Terms or the Service, including against any of the people paragraph (b) names, must be brought within one year after it arises, or it is permanently barred.

We may change these Terms. For a material change we will give at least 30 days’ notice by email or in the Service, and we may ask you to agree again before you continue; a change needed for legal reasons, or covering only a new feature, may take effect sooner. If you do not agree, stop using the Service before the change takes effect. Using it afterwards means you accept the changed Terms. A change to Section 19 does not apply to a dispute either of us has already given notice of.

• Events beyond our control. We are not liable for any delay or failure caused by events beyond our reasonable control, including failures of hosting, network, DNS, email or other third-party providers; disruptions of the internet; attacks on our systems, such as denial of service, despite reasonable safeguards; acts of government; natural disasters; epidemics; and labor disputes.
• Export and sanctions. You confirm that you are not located in, or acting for anyone in, a country or region under comprehensive U.S. sanctions, and are not on a U.S. government list of restricted parties.
• Notices. We may give you notice by email to your organization’s owner or in the Service. Notices to us go to [email protected], and legal notices also by mail to the address in Section 22. You agree that electronic notices and agreements satisfy any requirement that they be in writing or signed, and that ticking the box to agree to these Terms is your signature.
• Assignment. You may not assign or transfer these Terms without our written consent. We may assign them to an affiliate, or as part of a merger, acquisition or sale of all or substantially all of our business or of the Service.
• Entire agreement. These Terms, the Privacy Policy and any order you sign with us are the whole agreement between us about the Service, and replace any earlier agreement or understanding about it. A signed order prevails over these Terms where they conflict. Terms in your purchase orders or other documents do not apply.
• Other services from us. If you also have an agreement with us for other services — such as web design, hosting or maintenance from Xplicit Tech Solutions — these Terms do not amend or replace it. That agreement governs those services and these Terms govern the Service; where a signed agreement expressly covers the Service and conflicts with these Terms, the signed agreement prevails.
• Everything else. If a court or arbitrator holds any part of these Terms unenforceable, it will be enforced to the greatest extent allowed and the rest remains in force. Not enforcing a term is not a waiver of it. We are independent parties; nothing here creates a partnership, agency or employment. No one else, including your clients, has rights under these Terms. Headings are for convenience, and “including” means “including without limitation”.

Xplicit Coding LLC, doing business as Xplicit Tech Solutions, 6799 Main St, Cherry Creek, NY 14723.
Questions about these Terms: [email protected].
Security: [email protected].