Preview · Version 2026-09-22-preview
Assessment rules and data notice
For business onboarding and the private sandbox. Final commercial documents require legal review before launch.
Business pilot status
This is a business-only pilot. Customer scanning and real payments are disabled. These preview rules describe sandbox onboarding; they are not finalized commercial terms. The operator’s legal business details and the final agreement must be completed before customer sales open.
Authority and exact scope
Only an authorized business representative may submit a website. DNS verification shows control of a record; it does not prove legal permission to test. You must have permission from the asset owner and any hosting or other service provider whose permission is required. Authorization applies only to the exact HTTPS hostname entered. It does not extend to other subdomains, third-party services or private networks.
Testing boundaries
The current runnable target is Protego’s disposable Invoice Lab, containing fictional data. Customer-domain verification performs DNS lookups only. A future customer scan requires a fresh scope review, valid DNS control, operator approval and applicable commercial terms. Denial-of-service activity, social engineering, persistence, destructive actions and testing unrelated systems are outside the service scope. Automated active testing can affect applications; production suitability must be reviewed before launch.
Results and limitations
Reports contain automated findings and recorded evidence, not a guarantee that a system is secure. Findings may be incomplete or incorrect and require human review. A partial scan must not be presented as a completed assessment. The sample report contains fictional data and is not a certification or proof of performance.
Data used by this pilot
Protego processes account identifiers, submitted hostnames, DNS challenges, business authorization records, sandbox order references, scan status and report files. Testing may produce sensitive evidence. Do not submit production credentials or personal data to this pilot. Account and website data use Protego’s existing authentication and hosting services. AWS runs scan jobs and stores reports in the United States; the configured Bedrock model uses a US inference profile. Paddle processes sandbox payments. Resend is used for email notifications.
Retention and access
Sandbox report objects have a 30-day storage lifecycle. Signed download links expire after 60 seconds; downloaded copies remain with the recipient. Account, authorization, order and audit records have separate retention requirements and are not covered by the report lifecycle. The final privacy notice must specify those periods, deletion procedures and applicable cross-border safeguards before commercial launch. Reports are restricted to their account owner.
Requests and questions
Contact contact@protego.me for access, correction, deletion or pilot questions. Do not email passwords or sensitive vulnerability evidence. Commercial pricing, cancellation and refund handling, service limits, privacy terms and the final legal operator disclosure are pending launch review. No real payment is collected in the sandbox.