Terms of use
These govern use of this website and the exposure scan. A separate written agreement governs any paid service, and where the two conflict, that agreement wins.
Effective 2026-09-07 · HumanAudit Inc., a Delaware C-Corporation
The service
HumanAudit provides a read-only assessment that inventories non-human identities with access to systems you authorise us to connect to, and produces a report identifying the accountable owner for each where one can be resolved.
What the scan is, and is not
It is not a penetration test, a security audit, a certification, or a legal or regulatory compliance opinion. HumanAudit Inc. is not an accredited certification body, not a QSA, not an accounting firm and not a law firm. Nothing we produce constitutes legal, regulatory or accounting advice, and it does not certify compliance with PCI DSS, ISO/IEC 27001, SOC 2 or any other framework.
Where our report maps findings to a control, that mapping is our good-faith interpretation offered to help your own team and your own assessor. Your auditor, assessor or regulator decides what satisfies a control. We may be wrong about scope or applicability, and our control reference is explicit about where those judgements are contestable.
Completeness
The scan reports what the connected sources expose through their APIs. It cannot see systems you have not connected, and some sources do not expose last-use data for every identity type. An absence of findings is not evidence of an absence of risk, and we will say so in the report rather than letting a clean result imply more than it should.
Your responsibilities
- You confirm you are authorised to grant the access you grant. If you are not, do not connect.
- You remain responsible for your own security decisions. We provide information; acting on it is yours.
- You will not use the service to assess systems you do not own or have written permission to assess.
Your data and your report
You retain all rights in your data. We claim no ownership over it and we do not use it to train models. The report is yours to keep, share internally and use however you wish, including if you never become a customer.
We may use aggregated, de-identified statistics derived from scans in published research — for example a distribution of how many identities lack an accountable owner — in a form that cannot identify you or your organisation. You can opt out of that by telling us, and it will not affect the service you receive.
Availability
The service is provided as-is and without a service-level commitment unless a separate signed agreement provides one. We are an early-stage company and we may change, suspend or discontinue features. Where a change affects you materially we will tell you.
Limitation of liability
To the maximum extent permitted by law, HumanAudit Inc. is not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, arising from use of this website or the free exposure scan. For the free scan our total aggregate liability is limited to one hundred United States dollars. Nothing here excludes liability that cannot lawfully be excluded, including for fraud, wilful misconduct, or death or personal injury caused by negligence.
Intellectual property
The content of this website, including our research, is owned by HumanAudit Inc. You may quote and cite it with attribution and a link — we would like you to. You may not republish it wholesale as your own.
Governing law
These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law rules. Where mandatory consumer or data-protection law in your jurisdiction gives you stronger rights, those rights are unaffected.