Effective Date: October 20, 2026
1. Who you are contracting with
This store is operated by THREATVECTOR LLC, a Florida limited liability company ("ThreatVector", "we", "us", "our"). ThreatVector LLC is the seller of record for every order placed on this store and is the party you are contracting with.
The TommyGun software and the QuickScan security scan library are developed, owned, sold and distributed by THREATVECTOR LLC, which also performs the reporting and cybersecurity customer service.
These Terms govern your use of this store, the TommyGun software, the QuickScan scan products, and the reports produced from them (together, the "Services").
2. Acceptance and eligibility
By creating an account, downloading TommyGun, purchasing a scan, or running a scan, you agree to these Terms. If you do not agree, do not use the Services.
You must be at least 18 years old and able to form a binding contract. If you accept these Terms for a company or other organisation, you represent that you are authorised to bind it, and "you" means that organisation.
3. Definitions
- Software — the TommyGun desktop application, its scan library, installers and updates.
- Scan Product — a security scan or bundle of scans purchased from this store.
- Scan Credit — one entitlement to run a Scan Product and receive a Report.
- Report — the written analysis delivered to you after a scan completes.
- Target — any computer, network, device, domain, website, email domain, account, code repository, cloud storage or data set that a scan is pointed at.
4. Licence to use the Software
The Software is free to download. Subject to these Terms, we grant you a personal, non-exclusive, non-transferable, revocable licence to install and use the Software on computers you own or control, solely to run Scan Products you have purchased.
You may not: modify, decompile, reverse engineer or create derivative works of the Software; remove or alter any proprietary notice; rent, lease, sell, sublicense or redistribute the Software; use it to build a competing product; or circumvent, disable or interfere with any licensing, entitlement or security mechanism in the Software or our systems.
The Software's local display of which products you own is a convenience feature, not a security control. Entitlement is enforced on our servers when results are submitted for analysis. Attempting to obtain Reports without a valid Scan Credit is a material breach of these Terms.
5. Scan Products, credits and expiry
- A purchase of a single Scan Product grants three Scan Credits for that product, intended as an initial scan, a follow-up after you have made fixes, and a final verification.
- A bundle or plan grants the number of runs stated on its own product page — for example, a Quarterly plan grants four scheduled runs across twelve months. Where a product page and this section differ, the product page controls.
- Credits expire one year after the first scan is run, whether or not all of them have been used.
- A credit is reserved when a scan starts and is consumed only when a Report is successfully delivered.
- If a scan fails because of a fault on our side, the credit is returned to you.
- If a scan fails because of something on your side — the Target was unreachable, the information you entered was wrong, required permissions were not granted, or you stopped the scan — the credit is consumed.
- Scan Credits have no cash value, cannot be transferred between customers or between products, and cannot be exchanged for money.
6. Authorisation to scan — your responsibility
This is the most important term in this agreement. Read it.
You may point a scan only at a Target that you own, or that you are expressly authorised in writing by its owner to test. You are solely responsible for confirming that authorisation before you start a scan.
Running a security scan against a system you do not own and are not authorised to test may be a criminal offence, including under the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030), the Florida Computer Crimes Act (Fla. Stat. ch. 815), and comparable laws in other states and countries. It may also breach your contract with your internet provider, your hosting provider, or your employer.
We do not verify, and cannot verify, whether you own a Target or hold permission to test it. By starting a scan you represent and warrant that you hold all necessary authorisation. You agree to defend, indemnify and hold harmless ThreatVector LLC against any claim, loss, liability, fine or expense (including reasonable legal fees) arising from a scan you ran without proper authorisation.
7. Acceptable use
You agree not to use the Services to: scan a Target you are not authorised to test; attempt to gain unauthorised access to any system; conduct a denial-of-service attack or any activity designed to degrade a system's availability; resell, white-label or provide scanning-as-a-service to third parties without our written agreement; violate any applicable law; or interfere with the integrity of our infrastructure, including our licensing service and report pipeline.
We may suspend or terminate your access immediately, without refund, if we reasonably believe you have breached this section or Section 6.
8. What the Services are — and are not
QuickScan is detection and advisory only. Scans observe and report. They do not exploit weaknesses, do not change settings on your systems, and leave nothing running behind them.
The Services are not:
- a penetration test performed by a human tester;
- a security audit, certification, attestation or compliance assessment;
- a guarantee that your systems are secure, or that all weaknesses have been found;
- antivirus, endpoint protection, monitoring, or incident response;
- legal, regulatory, insurance or financial advice.
An automated scan is a strong, low-cost first pass. It is not a substitute for a full assessment. Where a Report maps findings to a security framework such as the NIST Cybersecurity Framework, that mapping is an aid to understanding and is not an audit or a certification of compliance.
9. Reports
Reports are produced by an automated pipeline with AI-assisted analysis under human-defined review protocols. Every Report states this on its cover.
Reports are provided for your own use. You own the Report we deliver to you and may share it with your advisers, insurers, partners or clients. You may not resell Reports, present them as your own independent assessment of a third party, or represent that a Report constitutes a certification.
Reports may contain errors, may not identify every weakness, and may include findings that turn out not to apply to your circumstances. Each Report includes a coverage section stating what ran, what could not run, and what was skipped. Read it. You are responsible for deciding what action to take, and for taking it.
ThreatVector LLC holds no financial interest in any third-party product or service named in a remediation recommendation; recommendations are made on technical merit only.
10. Orders, pricing and renewals
Prices are shown in US dollars and may change at any time; the price shown at checkout applies to that order. We may correct pricing errors and cancel affected orders with a full refund.
Nothing we sell auto-renews. Every product on this store is a one-time purchase, including the Quarterly plans. A Quarterly plan is a prepaid package of four scheduled runs across twelve months — not a subscription. You are charged once, there is nothing to cancel, and you will not be charged again unless you place a new order.
If we ever introduce auto-renewing plans, we will disclose the renewal price and interval clearly before you buy, obtain your express consent to recurring charges, and provide a cancellation method no harder to use than the sign-up was.
11. Refunds for digital products
This section governs digital products only — Scan Products, bundles and plans. Our Refund Policy restates this section.
- Because a Scan Product is delivered and consumed immediately, all digital sales are final once a Scan Credit has been drawn.
- If no credit has been drawn against a purchase, contact us within 14 days of purchase and we will refund it.
- If a scan fails through our fault, the remedy is the return of the credit, not a cash refund.
- If we cannot deliver a Report at all for reasons within our control, we will refund the amount paid for that product.
- Refunding an order revokes the entitlement associated with it. Scans already run and Reports already delivered are not undone, and remain subject to these Terms.
Nothing in this section limits rights you have under applicable consumer protection law that cannot be waived by agreement.
12. Your data
To produce a Report we must receive the results your scan collects. Before any scan starts, the Software shows you a consent screen describing what it will look at and what will leave your machine. Nothing is transmitted until you agree, and you can stop a scan at any point before it completes.
Values you enter that are marked sensitive are masked in the interface and are deliberately kept out of the technical log. We do not ask for, and you should not enter, passwords to systems we are not scanning on your behalf.
We use your data to run the scan, produce and deliver your Report, operate entitlements and billing, provide support, and improve the accuracy of our detection rules. Our Privacy Policy describes collection, use and disclosure in full and forms part of these Terms.
You may ask us for a copy of your personal information, ask us to correct it, ask us to delete it, or ask us to delete your account. Your Data and Privacy Requests explains how to ask, what we delete, what we keep and why, and how long we take. On request we remove your personal information from our live systems and delete device credentials, while retaining the financial and entitlement records we are required to keep. Copies held in our system backups are deleted on a rolling 90-day cycle, in every location where we store backups.
13. Accounts and devices
You sign in through your browser using the account you purchased with. The Software does not store your store password. You are responsible for keeping your account credentials secure and for all activity under your account.
Entitlements are tied to your account and paired to the devices you authorise. We may limit the number of devices or report recipients associated with a purchase to prevent sharing of entitlements.
14. Intellectual property
ThreatVector LLC owns all right, title and interest in the Software, the QuickScan library, the report engine, the "ThreatVector" and "Tommy Gun" names and logos, and this store's content. Nothing in these Terms transfers ownership of anything to you. All rights not expressly granted are reserved.
If you send us feedback or suggestions, we may use them without obligation or compensation to you.
15. Third-party services
The Services depend on third parties including Shopify (store and checkout), Cloudflare (infrastructure) and Google (email delivery), and some scans query public third-party data sources. We are not responsible for those services' availability, accuracy or acts. Your use of them is subject to their own terms.
16. Disclaimer of warranties
To the fullest extent permitted by law, the Services are provided "as is" and "as available", without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or uninterrupted or error-free operation.
We do not warrant that the Services will detect every vulnerability, that findings will be free of false positives or false negatives, or that following a Report's recommendations will prevent a security incident.
17. Limitation of liability
To the fullest extent permitted by law, neither ThreatVector LLC nor its members, officers or agents will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data, goodwill, or business interruption, arising out of or relating to the Services — whether in contract, tort (including negligence), strict liability or otherwise, and even if advised of the possibility.
Our total aggregate liability arising out of or relating to the Services will not exceed the greater of (a) the total amount you paid us in the twelve months before the event giving rise to the claim, or (b) one hundred US dollars (US$100).
You acknowledge that the price of the Services reflects this allocation of risk, and that we would not offer the Services on these terms without it.
Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages. Where that is the case, the exclusions and limitations above apply to the fullest extent permitted, and nothing here excludes liability for fraud, or for death or personal injury caused by negligence.
18. Indemnification
You agree to defend, indemnify and hold harmless ThreatVector LLC from any claim, demand, loss, liability, fine or expense (including reasonable legal fees) arising from: your use of the Services; your breach of these Terms; your scanning of any Target without authorisation; or your violation of any law or third-party right.
19. Suspension and termination
You may stop using the Services at any time. We may suspend or terminate your access, with or without notice, if you breach these Terms, if we are required to by law, or if continuing would expose us to legal or security risk.
On termination your licence to the Software ends and unused Scan Credits are forfeited, except where termination is our fault, in which case we will refund the unused portion. Sections 6, 9, 14, 16, 17, 18 and 20 survive termination.
20. Governing law and disputes
These Terms are governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. You and we agree to the exclusive jurisdiction and venue of the state and federal courts serving Osceola County, Florida, and each waive any objection to that venue.
Any claim must be brought within one year after it arises, or it is permanently barred, to the extent this limit is enforceable where you live.
21. General
These Terms, together with the Privacy Policy and the Refund Policy, are the entire agreement between you and us about the Services. If any provision is held unenforceable, the rest remains in force. Our failure to enforce a provision is not a waiver of it. You may not assign these Terms; we may assign them to a successor or affiliate.
We may update these Terms. We will change the Effective Date above and, where the change is material, give notice through the store or by email. Continuing to use the Services after a change means you accept it.
22. Contact
Questions about these Terms, the TommyGun software, a Report, or a security finding:
ThreatVector LLC
Email: service@threatvector.network