Preview · Version 2026-09-30-beta
Assessment rules and data notice
For business onboarding and the private sandbox. Final commercial documents require legal review before launch.
Business pilot status
This is a business-only pilot. Free website scans require an active tester campaign and operator approval of the exact hostname. Real payments are disabled. These pilot rules are not finalized commercial terms. The operator’s legal business details and the final agreement must be completed before customer sales open.
Authority and exact scope
Only an authorized business representative may submit a website. DNS verification shows control of a record; it does not prove legal permission to test. You must have permission from the asset owner and any hosting or other service provider whose permission is required. Authorization applies only to the exact HTTPS hostname entered. It does not extend to other subdomains, third-party services or private networks.
Testing boundaries
The training lab uses fictional data. Free website scans require fresh scope authorization, DNS ownership verification and operator approval. DNS verification alone performs DNS lookups and does not start a scan. Denial-of-service activity, social engineering, persistence, destructive actions and testing unrelated systems are outside the service scope. Automated active testing can affect applications; production suitability must be reviewed before launch.
Results and limitations
Reports contain automated findings and recorded evidence, not a guarantee that a system is secure. Findings may be incomplete or incorrect and require human review. A partial scan must not be presented as a completed assessment. The sample report contains fictional data and is not a certification or proof of performance.
Data used by this pilot
Protego processes account identifiers, submitted hostnames, DNS challenges, business authorization records, sandbox order references, scan status and report files. Testing may produce sensitive evidence. Do not submit production credentials or personal data to this pilot. Account and website data use Protego’s existing authentication and hosting services. AWS runs scan jobs and stores reports in the United States; the configured Bedrock model uses a US inference profile. Legacy payment integrations are test-only; no payment provider currently accepts live payments for this service. Resend is used for email notifications.
Retention and access
Sandbox report objects have a 30-day storage lifecycle. Signed download links expire after 60 seconds; downloaded copies remain with the recipient. Account, authorization, order and audit records have separate retention requirements and are not covered by the report lifecycle. The final privacy notice must specify those periods, deletion procedures and applicable cross-border safeguards before commercial launch. Reports are restricted to their account owner.
Requests and questions
Contact contact@protego.me for access, correction, deletion or pilot questions. Do not email passwords or sensitive vulnerability evidence. Commercial pricing, cancellation and refund handling, service limits, privacy terms and the final legal operator disclosure are pending launch review. No real payment is collected in the sandbox.