Rules of Engagement
What you're allowed to scan, what's off-limits, and what happens if the rules are broken.
Security scanning is powerful, so the rules around it need to be clear.
You can only scan what you own or are authorized to test
This is the core rule. Before running any scan on RiskShelter, you must be one of the following:
- The registered owner or technical administrator of the domain or system
- A security consultant or auditor holding a signed letter of authorization (LOA) from the domain owner that explicitly covers the scope of your assessment
Scanning third-party infrastructure, competitor domains, government systems, healthcare providers, or any target you do not control is prohibited.
What's not allowed
In addition to unauthorized targets, the following behaviors are strictly prohibited regardless of authorization:
- Using scan results to extort, blackmail, or coerce anyone
- Disclosing vulnerabilities publicly before coordinating with the affected organization
- Running denial-of-service (DoS/DDoS) payloads, destructive fuzzing, or automated exploit injection
Italian law applies
Unauthorized access to computer systems is a criminal offense under the Italian Penal Code:
- Art. 615-ter c.p.: Unauthorized access to protected computer systems (1 to 5 years imprisonment, up to 8 years for critical infrastructure)
- Art. 615-quater c.p.: Illegal acquisition or sharing of access credentials
- Art. 615-quinquies c.p.: Distribution of tools designed to damage or disrupt systems
- Art. 635-bis c.p.: Damage, alteration, or suppression of computer data or systems
Every scan is logged
RiskShelter maintains immutable audit logs of all scan requests: the user account, source IP, target domain, scan parameters, and timestamps. If unauthorized activity is reported or a legal request is received, those logs are provided to the relevant authorities (Polizia Postale, Guardia di Finanza, or judicial prosecutors).
Abusive accounts are permanently suspended with no refund.
If your domain was scanned without your consent
Contact [email protected] with the subject [ABUSE REPORT] - yourdomain.com. After verification, the domain will be added to our global exclusion blacklist. We'll investigate and provide forensic records to your legal counsel or law enforcement on request.