Phylex Scan Terms of Service
1. The parties and the service
These Terms govern your use of Phylex Scan, an automated security scanning service for web applications provided by PT FOINIKS DIGITAL ("we") through its Phylex unit (Phoenix Stratos Secura). By creating an organization and ticking the acceptance box in the app, you ("the user") accept these Terms on behalf of yourself and the organization you represent.
2. Only for assets you are authorized to test
- You may only register and scan assets that you own or that you have written authorization to test.
- We require proof of ownership (a DNS TXT record or verification file) before the first scan and re-check it before every scan. If the proof disappears, scanning stops.
- You must not use the service to attack, disrupt, or access other people's systems without permission, or for any unlawful purpose, including under Indonesia's Electronic Information and Transactions Law (UU ITE).
- You are legally responsible for the consequences of registering an asset without authorization.
3. Nature of the scans
- Phylex Scan sends test requests to your assets. The Baseline profile is passive and uses safe templates; the Standard profile runs limited active testing. Destructive tests, denial of service, and brute force are never run, and request rates are limited.
- Even so, any test can add load or log entries to your systems. We recommend scanning a staging environment or scheduling scans outside peak hours.
- Port scans only run with your consent for each scan, and are skipped for IP addresses shared by CDN or cloud providers.
4. Results are not a guarantee of security
Phylex Scan results come from automated scanning and are not a substitute for manual penetration testing. Results may include false positives and do not guarantee that an asset is free of weaknesses, particularly business-logic flaws or issues that can only be tested after signing in. Decisions about fixes remain your responsibility.
5. Accounts and confidentiality
- Keep your account secure and tell us about any unauthorized access.
- Reports contain details of security weaknesses. Store them securely and share them only with authorized people. Every report download is logged.
6. Plans, trials, and payment
- Asset limits, scan counts, add-on tools, and features follow the plan shown in the app. Prices exclude VAT.
- The trial lasts 7 days for 1 asset on your work email domain, with watermarked reports. One trial per domain.
- Paid plans are invoiced per subscription period. If an invoice is not paid, we may downgrade the plan or suspend scheduled scans after giving notice.
- Payment is made in advance by QRIS, virtual account (processed by Xendit), or bank transfer, and is never charged automatically. Renewal, cancellation, and refunds follow the Pricing page.
7. Suspension and termination
We may suspend or terminate access if there are signs of abuse, scanning of assets without authorization, or a breach of these Terms. You can close your account at any time through a Support ticket. How we handle data after closure is described in the Privacy Policy.
8. Limitation of liability
To the extent permitted by law, we are not liable for indirect losses, lost profits, or service interruptions arising from your use of Phylex Scan or from weaknesses that were not detected. Our total liability is limited to the subscription fees you paid in the 3 (three) months before the event.
9. Changes
We may update these Terms. Significant changes will be announced by email or in the app, and the version of the Terms you accepted is recorded on your organization's account.
10. Governing law
These Terms are governed by the laws of the Republic of Indonesia. Disputes will first be settled amicably; failing that, through the South Jakarta District Court.
11. Contact
PT FOINIKS DIGITAL — Phylex
Jl. Kyai Maja No. 31C, Kebayoran Baru, South Jakarta 12120, Indonesia
Email: support@foiniks.com