Terms, privacy and authorized use

The ShakerScan engine and client are licensed under AGPL-3.0 and provided as is, without warranty. They run on your infrastructure and send ShakerScan no telemetry.

The check at /check/ and shakerscan check are provided as is, may change or be withdrawn, and are rate-limited per IPv4 address or IPv6 /64: 30 requests a minute, 25 uncached checks an hour and 100 a day. Government and military targets are refused.

ShakerScan Enterprise is provided only under a signed agreement, which governs its use.

shakerscan.com is delivered through Cloudflare, which receives your IP address and request. The site loads no third-party analytics script.

A domain check sends the target, and any DKIM selector or path you give, to pub.shakerscan.com. Your IP address is sent to IPinfo to look up your country; the country is cached for 24 hours under a keyed pseudonym, not your IP. Results are cached for 10 minutes. Application logs are kept 7 days and contain no target, IP address, headers or bodies.

The connection check at connection.shakerscan.com reads your IP address, approximate location, TLS and HTTP details and the names (not values) of your request headers, and stores no per-visitor result. Its DNS test records the address of the resolver that looked up your test name and any client subnet (part of an address) it sent: the check shows it for about 10 minutes and the DNS query log keeps it for one day. Rate limits keep a keyed hash of your IPv4 address or IPv6 /64 for a few minutes. Its logs are kept 7 days without IP addresses. After these periods, deletion follows Amazon Web Services processing and can take a few days.

A saved connection report stays on your device. It leaves out your IP addresses and client subnet but keeps networks, location, resolver addresses and TLS fingerprints, so treat it as personal data when you share it.

Processors: Cloudflare (website delivery and DNS), Amazon Web Services in us-east-1 (the check services), IPinfo (country and network lookups) and Fastmail (email).

Only test systems you own or are explicitly authorized to test. You are responsible for the traffic ShakerScan sends on your behalf.

Security reports: security@shakerscan.com. Enterprise and licensing: sales@shakerscan.com.