Terms of sale and use

Last updated 2026-10-13

Version 1.1, 13 October 2026. These terms govern the use of Rustine and the purchase of its plans. They are terms of use for everyone, and terms of sale as soon as you pay. This is a translation: the French version prevails.

The essentials

• You only scan what is yours, or what its owner allowed you to test. Active tests require proof that you control the site.
• Rustine reads without changing anything and does not find everything: a good score is not a guarantee. Fixes are suggestions you apply at your own risk.
• Subscriptions renew automatically; you can cancel at any time, and your plan runs until the end of the paid period.
• If you are a consumer, you have 14 days to withdraw, with a refund minus what you already used.

Contents

1. Purpose, publisher and acceptance
2. Definitions
3. Your account
4. What you may scan
5. The service and its limits
6. Plans and prices
7. Payment, renewal and cancellation
8. Packs
9. Right of withdrawal (consumers)
10. Intellectual property
11. Personal data
12. Liability
13. Suspension, termination and account deletion
14. Changes to these terms
15. Complaints, governing law and disputes
16. Contact

1. Purpose, publisher and acceptance

Rustine is a service published by MBEN DEV, a French limited liability company (SARL) with a share capital of €1, registered at 60 rue François Ier, 75008 Paris, France (Paris Trade and Companies Register (RCS) 932 130 735 · SIRET 932 130 735 00016 · VAT number FR72 932 130 735), called "Rustine" or "we" in this document.

Rustine is an online security scanner: it scores a site, a server or a code repository out of 100, describes the issues it finds and offers their fix. The site rustine.io presents the service; the app app.rustine.io provides it.

You accept these terms by creating an account or starting a scan, and again with each payment. The version in force is always published at rustine.io/en/terms, with its date and number.

They apply to consumers (people acting outside their trade or profession) and to professionals (freelancers, agencies, companies). When a rule applies to only one of them, it says so.

2. Definitions

• User: the person who signs in to Rustine (you).
• Workspace: the space that holds your projects, your proofs and your subscription. A plan applies to a workspace.
• Project: what you call "my app" or "my client's site". It groups a site, repositories and servers; plans count projects.
• Target: a site, server or repository scanned within a project.
• Proof: the dated finding that your workspace controls a target: a DNS record, a file or a meta tag on the site, or the installation of Rustine's GitHub App on the repository.
• Scan: one run of Rustine's engine on a target. A quick scan only runs passive checks, what any visitor would see. A full audit adds active checks, always read-only, on what you have proven. An analysis is the scan of a code repository.
• Issue: what a check found, with a masked excerpt as evidence.
• Report: the state of a target after a scan (score out of 100, grade from A to F, issues and what could not be checked).
• Fix: the solution to an issue, in two forms: the prompt to paste into your coding agent, or the AI Fix, which Rustine writes with an artificial intelligence model (Solo and Pro plans).
• Scan authorization: the record kept for each full audit: who started it, on which verified proof and with which perimeter.
• Exclusion: a block on any scan of a domain, requested by its owner.
• Plan: Free, Solo or Pro. Pack: a batch of scans or fixes bought once.

3. Your account

Who can sign up. You must be of legal age and able to enter into a contract, or act for a business you have the authority to bind, and use an email address that is yours. You sign in with a code or link sent by email, with Google or with GitHub.

Two-factor authentication is mandatory. Rustine sees the flaws of your sites and the code of your repositories: a stolen account would hand over a list of doors to force. Two-factor authentication (an authenticator app or a passkey, plus ten recovery codes) is therefore required before the first sensitive action: proving a site, connecting GitHub or Supabase, paying, unlocking a fix, creating an API key or connecting an agent. Once enabled, it is asked at every sign-in.

Your credentials. Keep your authentication factors, recovery codes and API keys secret. If you think one has leaked, revoke it and write to security@rustine.io right away. If you lose both factors and your recovery codes, we check your identity by hand before giving access back: there is no self-service bypass.

What your agent does. Actions taken with an API key, or by your coding agent through the MCP server, are taken on behalf of your workspace as if you took them yourself: same rules, same quotas, same responsibility.

4. What you may scan

This is the most important section. Scanning a system without its owner's consent can be a criminal offence: articles 323-1 and following of the French Criminal Code punish fraudulently accessing or remaining in a system, hindering its operation, tampering with its data, and the mere attempt. Rustine is built to run active tests only on what you have proven; the rules below complete that safeguard.

4.1 Only what is yours, or what you may test. You only scan sites, servers and repositories that you own or that their owner has authorized you to test. If you work for a client (freelancer, agency), you must have their consent, preferably in writing, and be able to show it. If your site runs on a host or platform (Vercel, Netlify, Supabase, Firebase…), you also follow its rules on security testing.

4.2 Quick scans. Anyone can run a quick scan on any domain: it only does what an ordinary visitor does (headers, certificate, DNS, public files, announced versions). For a site you have not proven, the report stays restricted (score, grade and number of issues, without saying which or where) and nothing sensitive is kept. You do not use it to find sites to attack.

4.3 Active checks require a valid proof. Full audits and all active checks only target what a valid proof covers, re-verified right before each audit. A proof is never inherited: proving a domain gives no right over the server it points to, nor over a subdomain hosted by a third party. If re-verification fails, the audit falls back to a quick scan. Leave the DNS record or verification file in place for as long as you want to audit.

4.4 Your statement, and false proofs. By setting up a proof and starting an audit, you state that you control the target or are authorized by its owner to test it. Obtaining a proof by fraud (a domain that is not yours, a file placed on a site you do not control, a flaw used to write to it) or lying about your authorization is your sole responsibility, civil and criminal, towards the target's owner and towards us. Each full audit leaves a scan authorization, which we may produce in case of a complaint or at the request of an authority.

4.5 Exclusion. A domain owner can ask not to be scanned any more (by writing to abuse@rustine.io). An exclusion blocks every scan of that domain, for every workspace, and is only lifted with a valid proof. You do not try to get around it (another name, the IP address directly, a redirect).

4.6 What is forbidden.

• Scanning, or having scanned, a system you have no right to test, or using Rustine to prepare an attack, including against a competitor.
• Using scan results to get into a system, extract data from it or disrupt it.
• Getting around quotas, ceilings or rate limits: creating several accounts or workspaces to stack free plans, switching networks or browsers to multiply scans without an account, automating the app outside the API and the MCP server.
• Reselling Rustine, its reports or its fixes as a service to third parties without the Agency plan (not open yet). Working for your own clients from your workspace remains allowed.
• Bulk-extracting the content of the site, the app or the API (scraping).
• Attacking Rustine itself: load testing, trying to reach another workspace's data, bypassing two-factor authentication. If you find a flaw in Rustine, report it to security@rustine.io (see security.txt).
• Using Rustine for an illegal activity or one that infringes the rights of others.

4.7 What we may do. In case of a breach, or of a use that puts a third party or the platform at risk, we may refuse or stop a scan, invalidate a proof, disable an API key, suspend or close your account (section 13), and answer requests from authorities and from a target's owner.

5. The service and its limits

5.1 An automated, read-only scanner. Its checks read without changing anything: GET, HEAD and OPTIONS requests, and a few bounded read requests. No form is submitted and no exploit payload is sent; a known vulnerability is detected from its version number, never by triggering it. Each scan has a budget of requests and time, published with its source address and identifier on rustine.io/en/scanner. Rustine never writes to your code, your repository or your site.

5.2 No guarantee of completeness. Rustine looks for a defined list of common issues: it does not find everything. A score of 100 or an A grade does not mean your site is safe, only that our checks found nothing at the time of the scan. What a scan could not check is shown in the report, and the score of a quick scan is capped at 80. Rustine is not a penetration test, nor a certified security audit (PASSI), nor legal advice. We are bound by an obligation of means (best efforts).

5.3 Information to check. A reported issue is information: it may be a false positive, and its severity is an estimate. You alone decide what to do about it.

5.4 Fixes are suggestions. A fix, prompt or AI Fix, proposes a change. The AI Fix is written by an artificial intelligence model (Claude, by Anthropic) and can be wrong. You review it, test it and apply it at your own risk, preferably on a copy and with a backup; Rustine never applies it for you.

5.5 Availability. We do our best to keep Rustine available and fast, without guaranteeing an uninterrupted service. It may stop for maintenance, an update or an outage at a provider (host, Google Cloud, GitHub, Supabase, Stripe…). To protect the platform and the scanned sites, shared ceilings may refuse a scan or an AI Fix for a while ("try again in a few minutes"); the prompt stays available. Rustine is in public beta: its features change, and we tell you before removing anything you pay for (section 14).

6. Plans and prices

6.1 Plans as of 13 October 2026. The up-to-date details are on the pricing page and in Settings → My plan; the ones that apply are those shown when you order.

• Free (€0): 1 project; 1 address per project; 10 quick scans a month; no full audit; 3 fixes given once per workspace; 30 days of history.
• Solo (€9 a month or €90 a year): 1 project included; 5 addresses per project; GitHub repository analysis; per project and per month, 30 quick scans, 30 full audits and 15 fixes; a 14-day MCP server trial, once per workspace; 1 year of history.
• Pro (€29 a month or €290 a year): 3 projects included; 20 addresses per project; GitHub repository analysis; per project and per month, 100 quick scans, 100 full audits and 30 fixes; the MCP server; an email alert when a newly published vulnerability hits a version you use; 2 years of history.

A yearly subscription costs ten months. An address is a site or a subdomain followed in a project (app.mysaas.com, api.mysaas.com…). A project holding more than its plan allows, after a move to a smaller plan, keeps them all and can still scan them; it just cannot add more. Analysing a GitHub repository does not use the scan quota; other limits apply (three repositories per project, grouped analyses).

6.2 Extra projects. Solo and Pro can add projects at €5 a month or €50 a year, on the subscription's rhythm; each brings its own quotas. Added during a period, it is billed pro rata. Removed, it stops being billed at the next renewal and the project becomes read-only.

6.3 Quotas. They run per one-month period, starting on your renewal day (the workspace's creation day on Free), even with a yearly subscription. Unused quota does not carry over. A fix is unlocked once per issue and stays yours as long as the issue exists: in both forms on Solo and Pro, as a prompt only on Free; an AI Fix that fails costs nothing. Packs top up the quotas (section 8).

6.4 Prices include VAT. Prices are in euros, all taxes included: the price shown is the price paid. Stripe computes the VAT for your country. If you are a business established in the European Union and give your VAT number, the invoice shows it and applies the reverse charge.

6.5 The launch price. The first 200 workspaces that subscribe during the public beta pay a launch price: Solo €7 a month or €70 a year, Pro €19 a month or €190 a year. The remaining seats are shown. This price is guaranteed for as long as your subscription runs, even if you move from Solo to Pro or from monthly to yearly, and even if the normal price goes up. It is lost when the subscription ends (a cancellation that reaches its end date, or a final payment failure); the cancellation email reminds you. It does not apply to extra projects or packs.

6.6 Price or plan changes. We may change prices and what plans include. For a running subscription, we tell you by email at least 30 days ahead; the new price applies from the first renewal after that notice. If you disagree, you can cancel at no cost before it applies. Your launch price does not change while your subscription runs.

6.7 Plans we give. We may give you a plan for free, for a set period (beta tester, goodwill). It ends on its date without charging you anything, and your workspace goes back to the plan you pay for, or to Free.

7. Payment, renewal and cancellation

7.1 Payment. You pay on the checkout page of Stripe, our payment provider, by card or another method it offers; we never see your card number. Subscriptions are paid in advance, for the month or the year. The invoice is issued in the name of MBEN DEV, sent by email and available in Settings → My plan.

7.2 Automatic renewal. A subscription is taken out for one month or one year. It renews automatically for the same length at each renewal date, at the price in force (section 6.6), until you cancel it.

7.3 What the law provides for consumers. If you are a consumer with a yearly subscription, we tell you by email, no earlier than three months and no later than one month before the end of the period, that you may choose not to renew it, and by which date. If we failed to do so, you may cancel free of charge at any time from the renewal date; we then refund, within thirty days, the part paid in advance for the remaining period, minus what you used until cancellation (articles L215-1 and following of the French Consumer Code). A monthly subscription can be cancelled at any time, effective at the end of the current month.

[to be confirmed: reproduce here the full text of articles L215-1 to L215-3 and L241-3 of the French Consumer Code, as article L215-4 requires.]

7.4 Cancelling. You can cancel at any time, in a few clicks, in Settings → My plan, or in "Payment and invoices" (Stripe's portal). Cancellation takes effect at the end of the period already paid: you keep your plan until then and can change your mind before that date. A started period is not refunded, except where the law provides otherwise (sections 7.3 and 9) or in case of a failure on our side. You can also cancel by writing to hello@rustine.io.

7.5 What happens next. Your workspace goes back to Free, and nothing is deleted. You keep one active project, the one you choose; the others become read-only: reports, issues and fixes already unlocked stay readable, but no scan runs on them. The MCP server stops. History older than 30 days is hidden, not erased: it comes back if you subscribe again within twelve months. Pack credits are kept until they expire (section 8).

7.6 Failed payment. If a payment fails, we tell you by email and Stripe retries automatically; you keep your plan meanwhile, until the end of the paid period. Update your payment method in "Payment and invoices". If the payment never goes through, the subscription ends as in section 7.5, and the launch price is lost.

7.7 Changing plans. Changes are made in Settings → My plan, which shows the amount before you confirm:

• from Free to Solo or Pro: the month (or year) is charged the same day, which becomes your renewal date, and a new period opens with the plan's full quotas;
• from Solo to Pro: immediate, the difference is charged pro rata straight away, and quotas go up at once;
• from Pro to Solo, or from yearly to monthly: at the renewal date, with neither credit nor refund;
• from monthly to yearly: immediate, taking into account what remains of the paid month.

8. Packs

A Solo or Pro workspace that has used up its monthly quota can buy a pack, in a single payment:

• 50 scans: €5
• 250 scans: €19
• 10 fixes: €5
• 50 fixes: €19

One scan credit is worth a quick scan or a full audit. Credits are only used once the period's quota is used up, oldest first. Each pack is valid for 12 months from purchase, plan changes included; an expired credit is lost, with no refund. If your subscription ends, your credits are frozen and work again if you subscribe before they expire. The fixes given on the Free plan never draw on a pack. If a pack is refunded, only its unused part is taken back.

9. Right of withdrawal (consumers)

The period. If you are a consumer, you have fourteen days to withdraw, without giving a reason, from the day you subscribe or buy a pack.

The service starts at once. Rustine starts as soon as you pay: your quotas or credits are available immediately. By subscribing or buying a pack, you expressly ask for the service to start before the withdrawal period ends. As a result:

• if you withdraw, we refund what you paid, minus an amount proportionate to what was provided until your request (article L221-25 of the French Consumer Code): the elapsed part of the period for a subscription, the credits used for a pack;
• if the service was fully provided before the period ends, for example all of a pack's credits used, you acknowledge losing your right of withdrawal (article L221-28, 1°).

How. Write to hello@rustine.io with a clear statement of your decision, or use the form below. We refund you within fourteen days of receiving it, with the payment method you used, at no cost.

Professionals have no right of withdrawal.

Withdrawal form (fill in and send it back only if you want to withdraw):

To MBEN DEV, 60 rue François Ier, 75008 Paris, France, hello@rustine.io:

I hereby give notice that I withdraw from my contract for the provision of the following service:

Ordered on:
Name of consumer:
Address of consumer:
Signature of consumer (only if this form is notified on paper):
Date:

10. Intellectual property

Rustine. The software, the scan engine, the site, the app, their texts (explanations, prompt templates), the brand and the logos belong to MBEN DEV or its licensors. The engine partly reuses the open-source VICE engine, under the MIT licence, and uses open-source components under their own licences. You get a personal, non-exclusive and non-transferable right to use the service for the length of the contract.

Your content. What you give us (site addresses, repositories, account details) stays yours. You allow us to process it only to provide the service.

Your reports and fixes. The reports, issues and fixes produced for your workspace are yours to use without time limit, including after the contract ends: you may keep them, copy them, pass them on to your clients and apply the fixes in your code. You may not extract Rustine's texts from them to build a competing service or database.

Statistics. We may publish aggregated, anonymous statistics (for example the number of issues found), which identify neither you nor your sites.

11. Personal data

How we handle your data is described in the privacy policy.

When Rustine scans your site or repository for you, it may see personal data of your own users (in an evidence excerpt, for example). For that data, we act on your behalf, only to provide the service; excerpts are masked and nothing sensitive is kept from a site you have not proven. You remain responsible for your site's data and your own obligations, such as notifying the data protection authority of a breach a scan revealed. [to be confirmed: data processing agreement (article 28 GDPR) to be attached to these terms.]

12. Liability

Yours. You are responsible for what you scan, for the authorizations and proofs you present, for applying fixes, for keeping your credentials safe and for your agent's actions. If you are a professional, you indemnify MBEN DEV against any third-party claim, in particular from a target's owner, caused by a scan started without authorization or on a false proof, including reasonable defence costs.

Ours. We are bound by an obligation of means. Rustine does not promise to find every issue (section 5): an issue not being reported is not, by itself, a breach. We are not liable for damage caused by a use contrary to these terms, by a change you or your agent applied, by the failure of a third-party service you use, or by force majeure (article 1218 of the French Civil Code).

Between professionals. Our liability is limited to direct and foreseeable damage caused by our fault; indirect damage (loss of revenue, customers, data, reputation) is excluded. It is capped at the total paid by your workspace during the twelve months before the event giving rise to it. These limits do not apply to gross negligence or wilful misconduct, nor to personal injury.

For consumers. These limits do not apply: our liability is assessed under general law. Nothing in these terms reduces your statutory rights, in particular the legal guarantee of conformity for digital content and services (articles L224-25-12 and following of the French Consumer Code).

13. Suspension, termination and account deletion

By you. You can stop at any time: cancel your subscription (section 7.4) and ask for your account to be deleted by writing to hello@rustine.io from your account's address. Deletion erases your account and, with it, the workspaces where you are the only member: projects, proofs, scans, issues, reports, pack credits, two-factor factors, API keys, GitHub and Supabase access, logged emails. Your subscription is cancelled at once, without a refund of the current period: if you want to use it to the end, cancel first and ask for deletion after the renewal date. Download your reports beforehand; they cannot be restored.

What remains, because the law or the safety of third parties requires it: the scan authorizations of your full audits, detached from your identity and kept for one year before being erased (they matter if a site owner complains about an audit); invoices, kept for ten years; the admin log line that records your deletion request.

By us. We may suspend your account immediately, without notice, when your use puts a third party or the platform at risk, or in case of a serious breach of section 4 (scanning without authorization, false proof, getting around an exclusion, an attack, an account farm). We tell you by email, with the reason, and you can reply. For any other breach, we send you a formal notice by email; if it is not remedied within fifteen days, we may suspend or terminate your account. If termination is due to your breach and you are a professional, the current period is not refunded; if you are a consumer, we refund the remaining part of the paid period.

End of the service. If we shut Rustine down, we tell you at least 30 days ahead, let you download your reports and refund the remaining part paid in advance.

14. Changes to these terms

We may change these terms. For a change that affects your rights, your plan or your price, we tell you by email at least 30 days before it applies; if you refuse it, you may cancel at no cost before that date, and we refund the remaining part of a yearly subscription. A wording fix or a new feature applies as soon as it is published. Each version carries its date and number.

15. Complaints, governing law and disputes

Complaints. If you disagree with us, write to hello@rustine.io first: we look for an amicable solution and answer within a month.

Governing law. These terms are governed by French law. The French version prevails; this English version is a translation. If you are a consumer living in another EU country, you keep the protection of your country's mandatory rules.

Courts. Failing an amicable solution, a consumer may bring the case, at their choice, before the court of the place where they lived when the contract was made or the court designated by general rules. Between professionals, the courts within the jurisdiction of the Paris Court of Appeal have sole jurisdiction.

16. Contact

• Questions, account, billing, withdrawal, complaints: hello@rustine.io.
• A flaw in Rustine: security@rustine.io.
• Stop being scanned, or report an abusive scan: abuse@rustine.io.
• By post: MBEN DEV, 60 rue François Ier, 75008 Paris, France.