Check my site

Terms of Service

Version of 29 September 2026

These Terms govern the use of ShieldWave, a service that checks the security of websites. Chapter 14 applies only to Consumers and Sole traders with consumer rights, chapter 15 only to Business customers.

1. Who we are and how to reach us

1.1. ShieldWave is provided by Radosław Fedorczuk, trading as ENSOMEDIA Radosław Fedorczuk, ul. Chorwacka 33/42, 51-107 Wrocław, Poland, tax number (NIP) 8952195742, EU VAT number PL8952195742, business register number (REGON) 381626230, entered in the Polish Central Register and Information on Economic Activity (CEIDG). Below we call ourselves "ENSOMEDIA" or "we".

1.2. One contact for everything, in Polish or English:

1.3. These Terms are available free of charge before you conclude the contract, and you can save and print them.

2. Definitions

3. What ShieldWave is and what it is not

3.1. ShieldWave checks a Site from the outside: how it is built, protection in the browser (security headers), certificate and encryption, cookies, files left in the open, caching, and depending on the platform the WordPress configuration, plugins and themes, and at the full level (point 3.2) also forms, redirects and known weaknesses. We explain the results in plain language, with repair instructions and a ready message for the person who looks after the Site. Depending on the Plan, the Service also offers scheduled Checks with e-mail alerts, API keys, webhooks and a status badge (points 6.1 and 8.2).

3.2. A Check has two levels. The basic level reads what the server returns and looks for files often forgotten at common addresses; it sends no test inputs, makes no login attempts, does not scan ports and stops when the Site refuses it. The full level also sends test inputs to the Site's forms and addresses to see whether the Site refuses what it should refuse, and checks known weaknesses. We run the full level only for a domain whose control you have confirmed (point 5.3). The demonstration check and the free tools run the basic level or less.

3.3. A Check is not meant to change the Site's content, but it creates traffic, and test inputs may reach, for example, a contact form's inbox or the server logs. If the Site has an intrusion detection system, warn its host first.

3.4. ShieldWave is not a penetration test, an audit or a certification, and it does not guarantee that every weakness is found. It is not a PCI SSC Approved Scanning Vendor. This point describes what the service is and does not limit the rights in chapter 14.

3.5. The Plugin is separate software under the GPL licence, which governs its use. Its optional connections to ShieldWave are described in the Privacy Policy, on the page AI in ShieldWave and in the Plugin's description in the WordPress.org directory. Connecting the Plugin to an Account is part of the Service.

3.6. Technical requirements: an internet connection and a current browser (for example Chrome, Firefox, Safari or Edge) with JavaScript and cookies on; a working e-mail address; a PDF reader; for the API, an HTTP client and an API key; for the Plugin, a WordPress site meeting the Plugin's stated requirements. We check only publicly reachable Sites, not private or internal addresses. What the Service stores in your browser is set out in the Cookie Policy.

3.7. Using the internet carries risks, such as password phishing or malware. We never ask for your Account password.

3.8. You may not provide unlawful content to the Service, also not in logos, names or webhook addresses.

3.9. The demonstration check and the free tools are available without an Account and free of charge. By using them you conclude with us a contract for a service provided electronically on these Terms, which ends when you receive the result. Point 5.1 applies to the demonstration check. The free tools read only what a site shows to every visitor (certificate, DNS records, headers, cookies) and may be used on any public site.

4. Account

4.1. You must be 18 or older to open an Account. If you open it for an organisation, you confirm that you may act for it, and the organisation is then the party to the contract.

4.2. The contract for an Account is concluded at registration, after you accept these Terms, for an indefinite period. The Free Plan costs nothing.

4.3. Each person or organisation has one Account. On the Enterprise Plan you can invite a team of up to 10 people; you decide who gets access and can withdraw it at any time.

4.4. Keep your password and API keys safe and tell us without delay if you suspect unauthorised use of your Account. You are responsible for what the people you gave access do. We are liable for unauthorised use of your Account when it results from our breach of our duties, for example a security flaw in the Service.

4.5. Give true details, including a working e-mail address, and keep them current. We send messages about the contract to that address, including notices of changes to these Terms, of new subprocessors and of personal data breaches.

5. Permission to check a Site

5.1. You may order a Check only of a Site that is yours, or of one whose owner allowed you to check it. An agency or freelancer checking a client's Site needs that client's permission.

5.2. When you add a Site or order a Check, you state that you meet point 5.1. We record the statement with your Account, the domain, the time, where it was given, the IP address and the browser identification, and keep it as evidence for 3 years from the statement, also after the Account is deleted; the Privacy Policy gives the details.

5.3. We run the full level of a Check (point 3.2) only after a technical confirmation of control over the domain: a DNS record, a file, a meta tag or a connected Plugin. Until then Checks of that Site run at the basic level. We may also ask for proof of the owner's permission.

5.4. If you give login details for a Site, the Check may cover the part available after login. Give only login details you are allowed to use, and only for a test account that gives no access to real people's data.

5.5. It is forbidden to:

5.6. Checking other people's systems without permission can be a crime. Polish criminal law (Articles 267 to 269c of the Penal Code) and the corresponding laws of other countries punish, among other things, gaining access to an IT system without authorisation, breaking or getting around its safeguards, destroying or altering data, disrupting a system, and making or sharing tools for such acts.

5.7. If you breach this chapter, we may stop Checks of the Site concerned, and for a serious or repeated breach act under chapter 12. Where the law requires, we inform the authorities.

5.8. The owner of any Site, customer or not, can ask us to exclude their domain from all Checks: by e-mail to support@shieldwave.io from an address at that domain, or with another proof of control over the domain. We exclude the domain within 2 working days and keep it on our exclusion list. How our scanner identifies itself and how to report abuse is explained on the page The ShieldWave scanner and domain exclusion.

6. Plans, prices and payment

6.1. Plans and prices on the date of this version:

PlanPriceMain features
Free01 Site, 5 Checks a month, score and the 3 most urgent problems, history shown for 7 days
Pro49 zł / 12 EUR / 12 USD a month, or 490 zł / 120 EUR / 120 USD a yearup to 25 Sites, schedule, alerts, full Reports, PDF
Enterprise129 zł / 29 EUR / 29 USD a month, or 1290 zł / 290 EUR / 290 USD a yearunlimited Sites, Reports with your logo, team of up to 10 people, more mappings to laws and standards

One-off purchases, available on the Free Plan: a full Check of one Site for 39 zł / 9 EUR / 9 USD, and the full Report of a Check already made for 29 zł / 7 EUR / 7 USD.

6.2. The prices and Plan contents on the pricing page at the time of the order apply; the amounts in point 6.1 are the prices on the date of this version. Prices in other currencies are shown at checkout. The prices in point 6.1 include VAT. For a Business customer from another EU country who gives a valid EU VAT number we account for VAT as the law requires, including under the reverse charge; the checkout page shows the amount due before you confirm the order.

6.3. Payments are handled by Stripe (Stripe Payments Europe, Limited) on its own pages. We never see or store card numbers.

6.4. You choose a Plan or One-off purchase, go to Stripe's payment page and confirm the order. The contract is concluded at that confirmation. We send you a confirmation of the contract by e-mail, with these Terms, the withdrawal instruction and the model form, without delay and at the latest before the service begins.

6.5. The trial lasts 7 days and covers the Pro or Enterprise Plan, once per Account. It starts on Stripe's payment page, where you give a payment method. We charge nothing during the trial. When it ends, the subscription becomes paid and we charge the first period, unless you cancel before then. The price after the trial is shown on the payment page.

6.6. A monthly or yearly Plan renews for the same period until you cancel it. We charge in advance for each period.

6.7. You cancel in your Account, in the billing section (Stripe's customer portal), or by e-mail to support@shieldwave.io. Cancellation takes effect at the end of the paid period. After that your Account runs on the Free Plan, with its limits and retention periods, so download your data beforehand (point 11.4).

6.8. You can change Plan in your Account or by e-mail. We show the new price before you confirm.

6.9. We run the full Check of a One-off purchase after payment and make the Report available in your Account. We keep a Check with a bought Report for 90 days; download the Report within that time.

6.10. We refund money where the law or these Terms provide for it (chapters 11, 12, 14 and 17), to the payment method used for the purchase.

6.11. If the payment for the next period fails, we may limit your Account to Free Plan features until you pay, with no extra charge.

6.12. We issue invoices to Business customers, and to Consumers on request, including in the Polish national e-invoicing system (KSeF) where the law requires.

7. AI features

7.1. On Checks ordered from an Account, when the AI service is available, a language model:

At the basic level (point 3.2) AI only writes the texts of the Report: it does not review the severity of findings and does not suggest tests.

A second model checks the AI text against the Check data. In the Plugin, AI works only when the site's administrator has switched it on: it gives a second opinion on a file the scanner could not settle.

7.2. AI does not chat, makes no decisions about people and never edits, quarantines, deletes or blocks anything. The demonstration check and the free tools use no AI.

7.3. We mark AI text with a visible "AI" label. By 2 December 2026 we will add machine-readable marks. You may not remove AI marks from Reports, also not from Reports with your own logo.

7.4. AI text can be wrong. Check a repair instruction before you apply it, ideally on a copy of the Site first.

7.5. What data goes to our AI provider and for how long it is kept is described on the page AI in ShieldWave and in the Privacy Policy. AI features work on the results of Checks, so chapter 5 applies to them.

8. Mapping to laws and standards, status badge

8.1. The Service can show which areas of a law or standard (for example the GDPR, PCI DSS, ISO/IEC 27001 or NIS2) a finding relates to. This is for information. It is not an audit, a certificate, an attestation or legal advice. A result without findings does not mean compliance with any law or standard. We are not an Approved Scanning Vendor (ASV) of the PCI Security Standards Council, and our Checks do not replace the scans the PCI DSS standard requires. We use names of standards only to identify them and are not affiliated with the organisations that issue them.

8.2. The status badge is a statement about one Check of one Site on a given date. It is not a certificate, a seal or a guarantee of security. You may create and display a badge only for a Site whose domain you have confirmed you control (point 5.3). You may not alter it or present it as a certificate. We may switch off a badge used against these rules.

9. What belongs to whom

9.1. The Service, its software (except the Plugin under the GPL), design, texts and the name ShieldWave belong to ENSOMEDIA or our licensors. For the duration of the contract we give you a non-exclusive, non-transferable licence to use the Service for your own needs, and for an agency also to serve its clients. You may not copy or decompile the Service, except as the law allows.

9.2. What you put into the Service (names, logos, webhook addresses, settings, login details) remains yours. We use it only to provide the service, for example to put your logo on a Report. You confirm that you hold the rights to the logos and names you enter.

9.3. You may save, copy and pass on Reports without time limit, including to the Site's owner and to your clients. We make the results of a Check available only to the person who ordered it, their team members and the people they pass them to.

9.4. You may present Reports with your logo (Enterprise Plan) under your own brand. You may not remove AI marks from them or present a Report as an audit, a certificate or a penetration test.

10. Personal data

10.1. How we process personal data as controller (Accounts, payments, the demonstration check, the free tools, the Service and its analytics, security) is described in the Privacy Policy.

10.2. Checks can reveal data of other people published on a Site, for example names, e-mail addresses or WordPress author names. For Business customers and Sole traders with consumer rights we process such data as processor under the Data Processing Agreement, which is part of the contract and is concluded by accepting these Terms. It does not apply to a Consumer acting privately. For Sole traders with consumer rights it applies without the liability cap in point 15.3 and without the choice of court in point 15.9.

11. Availability, changes to the service, data export and moving to another provider

11.1. The Service runs around the clock, but maintenance breaks and outages happen; we announce planned breaks where possible. We do not guarantee a set percentage of availability; this does not affect point 14.6.

11.2. We may change the Service only for these reasons: security of the Service, customers or Sites; a change in the law or a decision of an authority or court; a change in the services of providers the Service depends on (for example hosting, payments, AI); fixing errors or performance and adapting to new versions of browsers and WordPress; development of the Service, including adding features or replacing a feature with an equivalent or better one. A change costs you nothing extra, and we explain it clearly.

11.3. If a change materially and negatively affects your access to or use of the service, we tell you by e-mail at least 30 days in advance. You may then end the contract free of charge within 30 days of the change, or of our notice if it came later, and we refund the unused part of the period. If a change must come sooner for security or legal reasons, we tell you without delay, and your right to end the contract remains.

11.4. In your Account profile you can download your data as JSON: profile, Checks with results, monitored domains, availability monitoring results and notifications. You can download Reports as PDF. On request by e-mail we send your other data in a machine-readable format, for example Sites, schedules, notification rules, webhooks, branding and data of connected Plugins. Export is free.

11.5. You may at any time ask us to move your data to another provider or to erase it, with a notice period you choose of no more than 2 months. The move takes up to 30 days, after which you have at least 30 days to retrieve your data. We charge nothing for this. When the move is complete, the contract ends and we erase the data under the Privacy Policy. If the contract ends before the end of a paid period, we refund the unused full months.

11.6. All data you entered or the Service produced for your Account can be ported: profile, Sites, schedules, notification rules, webhooks, branding, Checks with results and Reports, monitoring results, notifications and data of connected Plugins. Only data on the internal functioning of the Service is excluded: technical logs, rate-limit counters, caches and webhook secrets. On request we support your move and give you the information it needs. When the retrieval period ends we erase all portable data; we keep only data the law requires us to keep, as the Privacy Policy describes. We store the Service's data at Google Cloud in the European Union (region europe-west1, Belgium); traffic passes through the network of Cloudflare, Inc. (USA), and AI analysis is done by a provider in the USA, as the list Subprocessors and recipients shows. The provider's encryption, our contracts with providers and our rule of disclosing data only under Union or Member State law protect it against access by authorities of third countries.

12. Suspension and ending the contract

12.1. You may end the contract at any time: cancel a paid Plan (point 6.7) or delete your Account.

12.2. You delete your Account in its profile, with your password, or by asking us by e-mail. Deletion is immediate and final: it erases the Account data, with the exceptions in the Privacy Policy, and ends the subscription at once, without a refund for the unused period unless one is due on another ground, such as withdrawal. To keep the Plan to the end of the period, cancel first and delete later.

12.3. We may suspend your Account or part of it, or end the contract, only for good reasons:

12.4. First we ask you by e-mail to stop or explain the breach within at least 7 days. Without such a request we may at once stop Checks of a Site or suspend the Account when the breach is obvious and endangers others (for example a report from the owner of a Site checked without permission, or an attack on the Service), or when the law requires it. A suspension covers only what is necessary. For a breach we end the contract with 30 days' notice, and for a serious or repeated breach without notice.

12.5. We inform you of every such decision by e-mail: what we did and for how long, the facts that led to it, the clause or law we rely on, and how to appeal. We decide an appeal sent to support@shieldwave.io within 14 days. You may also go to court, and a Consumer may use point 14.10.

12.6. When we end the contract, you have at least 30 days to retrieve your data (point 11.4), unless the law requires otherwise. We then delete the Account under the Privacy Policy.

12.7. When we suspend the Account or end the contract for reasons you are not responsible for, including when we end the Service, we refund the unused part of the period. Consumers and Sole traders with consumer rights also get this refund when we end the contract because of their breach. For Business customers, see point 15.7.

13. Reporting unlawful content, point of contact

13.1. Our single point of contact for authorities of the member states, the European Commission, the European Board for Digital Services and recipients of the service under Articles 11 and 12 of the Digital Services Act (Regulation (EU) 2022/2065) is support@shieldwave.io, in Polish and English.

13.2. Anyone can report content in the Service that they consider unlawful, for example a logo or name in a Report or the content of a public status badge page. Send the notice to support@shieldwave.io. It should contain:

13.3. We confirm receipt and decide on the notice diligently, objectively and without undue delay. A person decides, not an automated tool. We inform the notifier and the Customer concerned of the decision, with reasons as in point 12.5 and the ways to appeal.

13.4. If we become aware of content suggesting a crime that threatens people's life or safety, we will inform the competent authorities without delay.

14. Consumers and sole traders with consumer rights

14.1. This chapter applies to Consumers and Sole traders with consumer rights; in it, "you" means either of them. A Sole trader with consumer rights may state, at the latest when concluding the contract, for example by e-mail, whether the contract is of a professional nature for them. We do not make the contract depend on such a statement.

14.2. You may withdraw from a contract concluded online within 14 days of its conclusion, without giving a reason. This applies to a paid Plan, a trial and a One-off purchase. It is enough to send a statement before the period ends, for example by e-mail to support@shieldwave.io; you may, but need not, use the model form in Annex 2. The instruction on withdrawal is in Annex 1. We confirm receipt of your statement by e-mail.

14.3. For a trial, the 14 days run from its start, because that is when the contract is concluded. If you cancel during the trial, you pay nothing.

14.4. After withdrawal we refund all payments without undue delay, at the latest within 14 days of receiving your statement, by the same payment method and at no cost to you. If at purchase you asked us to start the service before the withdrawal period ends, you pay an amount in proportion to the service provided until withdrawal; the free trial does not count toward it. Without such a request we refund everything. After withdrawal your Account runs on the Free Plan, unless you ask us to delete it.

14.5. If, when making a One-off purchase, you stated that you request performance before the withdrawal period ends and acknowledged that you lose the right of withdrawal once the service is fully performed, and we have fully performed the Check or made the Report available, you have no right to withdraw from that purchase (Article 38(1)(1) and (13) of the Polish Consumer Rights Act). Without that statement, the right of withdrawal applies under point 14.4.

14.6. We are responsible for the service conforming to the contract (the description in these Terms and on the pricing page at the time of the order, and what you can reasonably expect): for a Plan throughout its provision, for a One-off purchase for non-conformity existing at supply that appears within 2 years. We supply the updates needed for this, including security updates. If the service does not conform, you may ask us to fix it; if that is impossible, fails or takes too long, or the non-conformity is serious, you may ask for a price reduction or withdraw (not for a minor non-conformity). We charge nothing for the time of non-conformity and refund amounts due within 14 days.

14.7. You can make a complaint by e-mail to support@shieldwave.io or by post to the address in point 1.2. Please give your user name or Account e-mail, a description of the problem with the date, and what you ask for. We answer within 14 days of receipt, by e-mail or on another durable medium. If we do not answer within that time, the complaint is deemed accepted.

14.8. We apply a new price to a running subscription only from the next period and only with your active agreement. We tell you about it by e-mail at least 30 days before the current period ends. Without your agreement the subscription does not renew, and after the paid period your Account moves to the Free Plan.

14.9. Changes to these Terms that materially worsen your position on a paid Plan apply to you only with your active agreement; without it, the Plan ends with the paid period. Other changes follow chapter 17.

14.10. A Consumer may use out-of-court ways of dealing with complaints and pursuing claims, for example by turning to the Lower Silesian Voivodeship Inspector of Trade Inspection in Wrocław (Dolnośląski Wojewódzki Inspektor Inspekcji Handlowej) or to a consumer ombudsman (rzecznik konsumentów); list of bodies: https://polubowne.uokik.gov.pl. If the dispute remains unresolved after a complaint, we will tell the Consumer by e-mail or on another durable medium whether we agree to take part in such a procedure.

14.11. The contract is governed by Polish law. This choice of law does not deprive a Consumer of the protection given by the mandatory provisions of the law of the country of their habitual residence. Disputes are decided by the court competent under the general rules; a Consumer living in another EU country may also sue us in the courts of their place of residence.

14.12. We are liable to you under the general rules of law, and these Terms do not limit that liability. Chapters 3, 7 and 8 only describe what the service is.

15. Business customers only

15.1. This chapter applies only to Business customers and prevails over the common chapters.

15.2. A Business customer has no right of withdrawal.

15.3. Our total liability to a Business customer is limited to the fees the customer paid us in the 12 months before the event that caused the damage. We are not liable for lost profits. Neither limit applies to damage caused intentionally or by gross negligence, or to liability that the law does not allow to be limited.

15.4. If a third party brings a claim against us because of a Check you ordered in breach of chapter 5, you will compensate us for the damage and the reasonable costs of defence, provided that we tell you about the claim without delay and let you take part in the defence. We will not settle at your expense without your consent.

15.5. We announce changes of prices or of these Terms by e-mail at least 30 days in advance. Until the change takes effect you may end the contract with effect on that date, and we refund the unused part of the period. Otherwise the change applies from the stated date, and a new price from the next billing period.

15.6. We handle complaints as in point 14.7, but if we do not answer within the time limit, the complaint is not deemed accepted.

15.7. When we end the contract because of your serious breach of chapter 5, we do not refund the current period.

15.8. The Data Processing Agreement is part of the contract. An agency confirms that it has its client's permission for the Check and a basis to entrust the data to us.

15.9. Disputes are decided by the common courts competent for Wrocław.

16. Sanctions

16.1. We do not provide the service to persons and entities subject to sanctions of the European Union or Poland, or to entities they control, or where providing it would break such sanctions. By concluding the contract you confirm that you are not such a person or entity.

16.2. If it turns out that providing the service would break sanctions, we refuse it or end the contract with immediate effect. We refund fees to the extent the sanctions rules allow.

17. Changes to these Terms, language versions, final provisions

17.1. We may change these Terms for good reasons: a change in the law or a decision of an authority or court, a change of the Service under point 11.2, new services or Plans, security, removing ambiguities or errors, a change of our details.

17.2. We announce changes by e-mail and in the Service at least 30 days before they take effect; only changes in your favour or required by law may take effect sooner. If you do not accept a change, you may end the contract free of charge before it takes effect, and we refund the unused part of the period. Special rules are in points 14.8, 14.9 and 15.5.

17.3. For contracts concluded before 29 September 2026, this version replaces the Terms of February 2026 30 days after we notify you by e-mail or, where the Account has no e-mail address, by a notice in the Service at login, under points 14.9 and 15.5. Provisions more favourable to you apply at once.

17.4. We publish these Terms in Polish and English with the same content. A contract concluded in the Polish version of the Service is governed by the Polish version, and a contract concluded in any other language by the English version, unless we publish these Terms with the same version date in the language of the contract. If the versions differ, a Consumer may rely on the one more favourable to them.

17.5. The contract consists of these Terms and the description of the chosen Plan or One-off purchase at the time of the order, and for Business customers and Sole traders with consumer rights also the Data Processing Agreement. The Privacy Policy and the Cookie Policy are information, not part of the contract. This does not exclude information given to a Consumer before the contract.

17.6. We may transfer the contract to a legal successor of our business or to a buyer of the Service if we tell you by e-mail at least 30 days in advance. You may then end the contract free of charge, and we refund the unused part of the period. You may transfer the contract to someone else with our consent.

17.7. Nothing in these Terms excludes liability for damage caused intentionally or liability for damage caused by a dangerous or defective product that the law does not allow to be excluded, including the rules implementing Directive (EU) 2024/2853.

17.8. If a provision turns out to be invalid or ineffective, the rest remains in force.

17.9. These Terms apply from 29 September 2026.

Annex 1: instruction on withdrawal

This instruction applies to Consumers and Sole traders with consumer rights. The exception for One-off purchases is in point 14.5.

Right of withdrawal

You have the right to withdraw from this contract within 14 days without giving any reason.

The withdrawal period will expire after 14 days from the day of the conclusion of the contract.

To exercise the right of withdrawal, you must inform us (ENSOMEDIA Radosław Fedorczuk, ul. Chorwacka 33/42, 51-107 Wrocław, Poland, e-mail: support@shieldwave.io) of your decision to withdraw from this contract by an unequivocal statement (e.g. a letter sent by post or e-mail). You may use the attached model withdrawal form, but it is not obligatory.

To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal

If you withdraw from this contract, we shall reimburse to you all payments received from you without undue delay and in any event not later than 14 days from the day on which we are informed about your decision to withdraw from this contract. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested to begin the performance of services during the withdrawal period, you shall pay us an amount which is in proportion to what has been provided until you have communicated us your withdrawal from this contract, in comparison with the full coverage of the contract.

Annex 2: model withdrawal form

MODEL WITHDRAWAL FORM

(complete and return this form only if you wish to withdraw from the contract)

To: ENSOMEDIA Radosław Fedorczuk, ul. Chorwacka 33/42, 51-107 Wrocław, Poland, e-mail: support@shieldwave.io

I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service (*): ...

Ordered on (*): ...

Name of consumer(s): ...

Address of consumer(s): ...

Signature of consumer(s) (only if this form is notified on paper): ...

Date: ...

(*) Delete as appropriate.

Change history