Scanning agreement

Version 2.1. Effective [DATE].

This is the agreement you accept when you create an AirScan account. It is a binding contract. Read it before you agree to it.

AirScan is owned and operated by FusionAir, LLC, a Tennessee limited liability company ("FusionAir," "we," "us," "our"). "You" means the person creating the account and, if you are acting for a station, licensee, group, employer, or client, that organization as well.

1. What this agreement covers

This agreement governs your account, your use of the AirScan website and service, every scan you request, and the results we give you. It replaces any earlier version you accepted.

If you do not agree to all of it, do not create an account and do not request a scan.

2. Who may use AirScan

You may create an account and request scans only if all of the following are true:

You are at least 18 years old.
You are located in the United States and are requesting scans of a network located in the United States.
If you are acting for a station, licensee, employer, or client, you have authority to accept this agreement on its behalf and to authorize scanning of its network.
Neither you nor anyone acting through your account has been convicted of a computer-related or internet-related offense, including unauthorized access, computer fraud, or misuse of computer systems or data.
Your access to AirScan has not previously been terminated by us, or if it has, the reason for that termination has been resolved to our satisfaction.

We may refuse service, refuse to run a particular scan, or close an account at any time, for any reason or no reason.

3. Electronic records and signatures

You consent to do business with us electronically. You agree that clicking to accept this agreement, checking a box, or requesting a scan is your signature, has the same legal effect as a handwritten signature, and creates a binding agreement.

You agree that we may provide this agreement, changes to it, your scan records, and all notices to you in electronic form, and that an electronic record of your acceptance — including the version you accepted, the date and time, and the network address you accepted it from — is admissible evidence of that acceptance.

You may request a paper copy of any record by writing to us at the address in Section 26.

4. What the scan does

AirScan examines the public network address your browser is connecting from and reports what an outsider on the internet can see of it.

The scan:

Opens TCP connections to ports drawn from the AirScan port list. The current port list, and which ports are covered by each scan type we offer, are published at [URL] and form part of this agreement. We may change that list at any time.
Records which ports answer and which do not.
Reads what a responding service volunteers about itself — banners, service headers, and similar self-identifying information — and uses that to identify the software or device.
Flags equipment that is known to ship from the factory with default login credentials, and flags management interfaces that are reachable from the public internet.

A full scan can take several minutes.

The result is a description of exposure at one moment in time, from one vantage point. It is a snapshot, not monitoring.

5. What the scan does not do

AirScan does not:

Attempt to log in to any device. It does not guess, test, submit, or brute-force passwords or any other credential.
Exploit vulnerabilities.
Change any configuration, setting, text, audio, or state on any device.
Send traffic designed to disrupt, degrade, overload, or take down equipment.
Determine whether your network has already been breached. It reports exposure, not intrusion.
Scan any address other than the one you are connecting from.

Where AirScan reports that a device is known to ship with default credentials, that is a statement about that model of equipment, not a statement that we tested or confirmed the credentials on your device. We did not.

6. You must be on the network you want scanned

The address scanned is always the public address your browser is connecting from. There is no field to enter an address, and the service will not scan an address you supply.

To check a transmitter site, studio, STL endpoint, or any other location, go to a computer on that network and run the scan from there.

Shared and multi-tenant addresses. Many public addresses are shared by people and organizations who have nothing to do with each other — hotel and guest Wi-Fi, coffee shops, carrier-grade NAT, apartment and campus networks, shared web hosting, and colocation facilities. On a shared address, a scan you request may reach equipment belonging to someone else.

You are responsible for knowing whether the address you are connecting from is yours alone. If you are not certain that the public address belongs to the network you intend to check, do not run the scan.

You may not route around this. You may not use a VPN, proxy, tunnel, relay, jump host, remote desktop session, or any other method to make your session appear to originate from a network you do not control, for the purpose of having that network scanned. Doing so is a serious breach of this agreement and may be a crime.

7. Your authorization, and what you are promising us

By requesting a scan, you represent and warrant that:

You own the network you are connecting from, or you are authorized by its owner to have it scanned.
Your authorization comes from someone with actual authority to give it. Being physically present on a network, having been given the Wi-Fi password, or having been hired to work on the equipment is not by itself authorization to have the network scanned.
Where the network's internet service provider, transit provider, hosting provider, or landlord has an acceptable use policy that restricts scanning, you have their permission as well. Many providers prohibit scanning traffic regardless of who owns the target.
You are not requesting the scan for the purpose of finding a way into a network you do not control.

We may ask you at any time to provide proof of your authorization. If you do not provide it promptly, we may suspend or close your account and withhold results.

Every scan is recorded with your account, the address scanned, the time, and the source address the request came from.

8. Scanning broadcast equipment — please read this section

This scan reaches the control and management ports used by broadcast equipment. Depending on your plant, that can include EAS encoder/decoders, STL equipment, codecs, audio processors, automation systems, transmitter remote controls, RDS encoders, AoIP nodes, and any other device with a network management interface reachable from your public address.

AirScan only checks whether those ports are open and answering, and reads what the device volunteers about itself. It does not send any command to your equipment. It will never change your RDS text, your on-air audio, your transmitter settings, your alerting configuration, or any other device configuration. The finding is that a control port is reachable — not any change to your broadcast.

By requesting a scan you acknowledge that your broadcast control ports may be probed for whether they are open, and you confirm you are authorized to have this network scanned.

If you are not prepared to have your air chain probed, do not run the scan.

9. Scan traffic and its effects

A scan sends connection attempts to your equipment. This is ordinary traffic that any internet-facing address receives constantly, but it may:

appear in your logs;
set off intrusion detection or alerting systems;
generate notifications to you, your provider, or a monitoring vendor;
be blocked by your firewall.

A firewall blocking the scan is a good result and is reported as one.

Some older or poorly implemented equipment responds badly to any unexpected connection. A device may become slow, stop responding, drop its network interface, or require a restart.

You decide whether to scan equipment that is on air, and when. We recommend running your first scan at a time when a fault on a non-critical device would not put you off the air, and when someone is available to restart equipment if it becomes necessary.

10. Assumption of risk, release, and causation

(a) You assume the risk. You understand that connecting to equipment over a network carries risk, that broadcast equipment varies enormously in how well it handles unexpected connections, and that neither you nor we can know in advance how a particular device will respond. Knowing that, you choose to request the scan. You voluntarily and knowingly assume all risk of any disruption, malfunction, interruption, outage, dead air, data loss, alarm, or equipment failure arising from or occurring in connection with a scan you request.

(b) Release. TO THE FULLEST EXTENT PERMITTED BY LAW, YOU RELEASE, WAIVE, AND FOREVER DISCHARGE FUSIONAIR, LLC AND ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, CONTRACTORS, AND AGENTS FROM ANY AND ALL CLAIMS, DEMANDS, ACTIONS, AND CAUSES OF ACTION FOR ANY DISRUPTION, MALFUNCTION, INTERRUPTION, OUTAGE, DEAD AIR, LOSS OF DATA, OR DAMAGE TO OR FAILURE OF ANY EQUIPMENT, NETWORK, OR SYSTEM, ARISING FROM OR RELATING TO ANY SCAN REQUESTED THROUGH YOUR ACCOUNT, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR ANY OTHER THEORY. THIS RELEASE IS GIVEN IN EXCHANGE FOR ACCESS TO THE SERVICE AT NO CHARGE AND IS A CONDITION OF THAT ACCESS.

This release does not extend to our own fraud, willful misconduct, or gross negligence, or to any liability that cannot be released under applicable law.

(c) Causation is not presumed. Equipment fails for many reasons — age, heat, power events, firmware defects, memory leaks, unrelated network activity, other traffic on the internet, and ordinary wear. The fact that a device rebooted, locked up, dropped offline, or failed during or after a scan does not establish that the scan caused it, and no such causation will be presumed. If you assert that a scan caused a failure, the burden of proving that is yours, and you must prove it by direct evidence rather than by sequence in time alone.

(d) Preserve the evidence. If you believe a scan caused a problem, you must notify us in writing within seven (7) days and preserve the relevant device logs, firewall logs, and configuration. Failure to notify us and preserve that evidence within seven days waives any claim relating to the incident.

11. No duty to monitor, warn, or remediate

AirScan reports what a scan found. That is the whole of what we undertake to do.

We have no obligation to:

review, interpret, triage, prioritize, or act on any finding;
notify you, your licensee, your provider, or anyone else of any finding, whether or not we consider it serious;
follow up on a finding, confirm that you addressed it, or scan you again;
warn you of any exposure, vulnerability, threat, or incident we become aware of by any means;
protect, defend, secure, monitor, or maintain your network or equipment.

Running a scan does not make us your security provider, your consultant, your engineer of record, or your agent, and it does not create any duty of care beyond delivering the scan result. Securing your network is your responsibility.

If you want ongoing monitoring, remediation, or professional services, those are separate engagements under separate written agreements.

12. Availability, limits, and changes to the service

AirScan is provided on an as-available basis. We may change, limit, suspend, or discontinue any part of it at any time, with or without notice, including the port list, the scan types offered, the equipment we fingerprint, and the format of results.

We may impose and change limits on how often you can scan, how many scans you may run, and how many scans may run at once. We may queue, delay, decline, or abort any scan.

You may not access the service by automated means — scripts, bots, scrapers, or an API — without our prior written permission.

13. Your results

Results belong to you, and you may use them for your own purposes.

We keep your individual results confidential. We will not publish, sell, or disclose findings that identify you, your station, or your network, except: to you; as described in Section 20 (abuse); where you ask us to; or where we are required to by law.

You grant us a license to store, process, and analyze your scan results in order to run the service, improve detection, and produce statistics.

Aggregated and de-identified data. We may publish statistics and findings derived from scans across our user base, provided they do not identify you, your station, or your network — for example, the percentage of scanned networks with an exposed management interface. We may use your station's name in a case study, testimonial, or marketing material only with your written permission.

14. No warranty, and no certification of compliance

THE SERVICE AND ALL RESULTS ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, AND NON-INFRINGEMENT.

We do not warrant that the service will be available, uninterrupted, timely, secure, or error-free, or that results will be complete, accurate, or current.

A clean result does not mean your network is secure. Results may be incomplete or wrong. A scan can miss an exposed service, and it can report a service that is not actually exposed. Firewalls, rate limiting, upstream filtering, dynamic addressing, and equipment behavior can all change what a scan sees. An address that is clean today may be exposed tomorrow.

Nothing in the service is legal advice, engineering advice for your specific facility, or a certification of compliance with any rule. In particular, a scan result is not a certification of compliance with 47 CFR § 11.35, any other FCC rule, or any other legal or contractual obligation. Those obligations are yours, and determining whether you meet them is your responsibility and that of your own advisers. A scan is one input, and it examines only what is visible from outside your network.

15. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW, FUSIONAIR, LLC AND ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, CONTRACTORS, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, AIRTIME, ADVERTISING REVENUE, OR BUSINESS OPPORTUNITY, OR FOR ANY BUSINESS INTERRUPTION, DOWNTIME, DEAD AIR, OR EQUIPMENT FAILURE, ARISING OUT OF OR RELATING TO THE SERVICE OR ANY SCAN, WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE, AND EVEN IF WE HAVE BEEN ADVISED THAT SUCH DAMAGES ARE POSSIBLE.

OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) ONE HUNDRED U.S. DOLLARS ($100) OR (B) THE TOTAL AMOUNT YOU PAID US FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. THE SERVICE IS PROVIDED FREE OF CHARGE, AND THIS ALLOCATION OF RISK IS A CONDITION OF PROVIDING IT.

Nothing in this agreement limits liability that cannot be limited under applicable law. Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, so some of the above may not apply to you.

16. Indemnification

You agree to defend, indemnify, and hold harmless FusionAir, LLC and its members, managers, officers, employees, contractors, and agents from and against any claim, demand, action, damage, loss, liability, cost, or expense, including reasonable attorneys' fees, arising out of or relating to:

your use or misuse of the service;
your breach of this agreement;
your breach of any law, regulation, or third-party acceptable use policy;
any scan requested through your account, including any claim by a third party that the scan constituted unauthorized access to, interference with, or damage to their network, systems, equipment, or data;
any representation you made under Section 7 that turns out to be untrue;
your use of, or reliance on, any scan result;
your failure to act on any finding.

We may assume the exclusive defense and control of any matter subject to indemnification by you, at your expense, and you agree to cooperate with that defense.

17. Acceptable use

You may not:

request a scan of a network you do not own or are not authorized to have scanned;
disguise or relay your connection to cause a third party's network to be scanned (Section 6);
use the service, or any result from it, to attack, gain unauthorized access to, or interfere with any network or system;
resell, sublicense, or provide the service to others as if it were your own;
circumvent or attempt to circumvent any limit, restriction, queue, or security measure;
probe, scan, attack, overload, or reverse engineer AirScan itself or the systems it runs on;
provide false, incomplete, or misleading information at signup or when attesting to authorization;
share account credentials, or allow anyone to use your account who has not read and agreed to this agreement.

18. Information we collect and how we use it

We collect and store:

the name, station or company, call sign, telephone number, and email address you provide;
the network addresses you scan;
the scan results;
the date, time, and source address of each scan;
the date, time, source address, and version of this agreement at the moment you accepted it.

We use this information to run the service, show you your scan history, show what you agreed to, investigate abuse, improve detection, and contact you as described in Section 21.

We do not sell your personal information. We do not rent, trade, or license it. We do not share it with any third party for that third party's own marketing or commercial purposes. Your information is used by FusionAir, LLC, for FusionAir's own internal purposes, and for nothing else.

The only parties outside FusionAir who touch your information are the service providers we use to operate the service — such as our hosting provider and our email delivery provider — who process it on our behalf, under contract, and only as needed to deliver the service.

We may also disclose information where required by law, as described in Section 20.

19. Security of stored information

We take reasonable measures to protect the information we store, including your scan results.

No system is perfectly secure, and we do not warrant or guarantee that information stored by us cannot be accessed, disclosed, altered, or destroyed by unauthorized parties. You accept that risk as a condition of using a free service, and our liability for any such event is subject to Sections 15 and 16.

If you do not want your exposure findings stored by a third party, do not use this service.

20. Abuse, investigation, and disclosure

Requesting a scan of a network you do not own or control may violate the federal Computer Fraud and Abuse Act, Tennessee computer-offense law, and the computer-misuse laws of other states.

If we believe an account has been used that way, we may disable it without notice, withhold or delete results, and disclose the associated records — account details, the address scanned, timestamps, and source addresses — to the affected party, to the relevant internet service or hosting provider, and to law enforcement.

We may also disclose information where we are required to by law, subpoena, or court order, or where we believe disclosure is necessary to protect our rights, our systems, or the safety of others.

21. Communications, marketing, and your consent

(a) Service communications. By creating an account, you agree that FusionAir, LLC may contact you at the email address and telephone number you provide about your account, your scans, your results, and any exposure, security, or compliance matter we believe affects you or your station — including following up about work to address what a scan found. These are service communications, not promotional messages, and you cannot opt out of them while your account is open. If you do not want them, close your account.

(b) Marketing email. You also agree that FusionAir, LLC may send you email about its products, services, tools, training, and offerings. Every such email will identify us, include our postal address, and include a working unsubscribe link. If you unsubscribe, we will stop sending promotional email within ten (10) business days. You will still receive the service communications described in (a).

(c) Marketing calls and text messages. We will not use an automatic telephone dialing system, an artificial or prerecorded voice, or text messaging to send you promotional messages unless you have separately opted in to that at signup or afterward. If you do opt in: you consent to receive marketing calls and texts at the number you provided, including calls placed with an autodialer or a prerecorded or artificial voice; message and data rates may apply; message frequency varies; you may reply STOP to stop and HELP for help.

(d) Consent is not a condition. Your consent under (c) is not a condition of creating an account, running a scan, or receiving results, and it is not a condition of purchasing anything from us.

(e) Withdrawing consent. You may tell us to stop contacting you by any reasonable means — replying STOP to a text, clicking unsubscribe, replying to an email, telling us on the phone, or writing to us at the address below. We do not require you to use any particular method. We will honor any reasonable request within ten (10) business days, and we may send you one message confirming it. A request to stop applies across calls and texts, not only to the channel you used to make it.

(f) Your responsibility for the number you give us. If you give us a telephone number, you represent that you are the subscriber or customary user of that number and are authorized to receive calls and texts at it. Tell us promptly if the number changes or is no longer yours.

Contact for all of the above: [CONTACT EMAIL] — [POSTAL ADDRESS] — [PHONE]

22. How long we keep your information

We keep your account details, scan records, and agreement records for as long as your account exists and for as long as we reasonably need them for the purposes in this agreement, including defending legal claims.

You may ask us to close your account and delete your information, and we will do so within a reasonable time, except where we are required or permitted to retain records — including records of agreement, abuse investigations, and information needed to resolve a dispute.

23. Suspension and termination

You may close your account at any time.

We may suspend or terminate your account and your access to the service at any time, with or without notice, including if we believe you have breached this agreement, if you do not provide proof of authorization when asked, if an account has been inactive for twelve months, if required by a legal authority, or if we believe suspension is necessary to protect the service, our business, or a third party.

On termination, your right to use the service ends immediately. Sections 7, 10, 11, 13, 14, 15, 16, 18, 19, 20, 21, 22, 25, and 26 survive.

24. Changes to this agreement

We may change this agreement at any time. The current version, with its version number and effective date, will always be posted at [URL].

If we make a material change, we will notify you by email at your account address or by a notice in the service before it takes effect. If you continue to use the service, or request a scan, after a change takes effect, you accept the changed agreement. If you do not accept it, close your account.

We keep a record of which version you accepted, and when.

25. Disputes, governing law, and venue

Informal resolution first. Before filing anything, contact us at [CONTACT EMAIL] and give us thirty (30) days to resolve the matter.

Governing law. This agreement, and any dispute arising out of or relating to it or to the service, is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules.

Venue. You and FusionAir, LLC agree to the exclusive jurisdiction and venue of the state and federal courts located in Rutherford County, Tennessee, and the United States District Court for the Middle District of Tennessee, and each party waives any objection to that venue, including any objection based on inconvenient forum.

Jury trial waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY WAIVES ANY RIGHT TO A TRIAL BY JURY.

Class action waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, OR REPRESENTATIVE PROCEEDING.

Time limit. Any claim arising out of or relating to the service must be filed within one (1) year after it arose, or it is permanently barred, to the extent permitted by law.

26. General

Entire agreement. This agreement, together with the published port list, is the entire agreement between you and FusionAir, LLC about the service, and replaces any prior understanding, representation, or statement about it.

Severability. If any provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed, and the rest remains in force. In particular, if any part of Section 10 or Section 15 is held unenforceable, the remainder of those sections continues to apply to the fullest extent permitted.

No waiver. Our failure to enforce any provision is not a waiver of it.

Assignment and successors. You may not assign this agreement or your account without our written consent. We may assign this agreement, and transfer the information described in Section 18 including your account and your communication preferences, in connection with a merger, acquisition, reorganization, change of entity, or sale of all or substantially all of our assets. This agreement binds and benefits each party's permitted successors and assigns.

Force majeure. We are not liable for any failure or delay caused by events beyond our reasonable control.

Notices. We may give you notice by email to your account address, and that notice is effective when sent. You give us notice at the address below.

Relationship. Nothing here creates a partnership, joint venture, employment, or agency relationship. We are not your engineer of record, your consultant, or your security provider, and we do not assume responsibility for your facility or your network.

Headings. Headings are for convenience and do not affect interpretation.

Contact. FusionAir, LLC [POSTAL ADDRESS] [CONTACT EMAIL] [PHONE]