This is the licence for NuajLens. It is one of two agreements you accept: this one, which covers everything specific to NuajLens, and the Nuaj Master Terms, which carry everything that is the same for every Nuaj product — the commercial terms, the liability limit, the obligations that attach to providing a service to third parties, and the general legal provisions.
Words defined in the Master Terms have the same meaning here.
By requesting access to NuajLens, downloading it, installing it, or using it, you agree to this Agreement and to the Master Terms.
NuajLens is free, and NuajLens is a scanner. Those two facts shape this Agreement more than anything else in it. Free means Nuaj owes you no support, no updates, and no continuity — section 6. A scanner means you point testing tooling at live infrastructure, which is lawful only with authority that you must hold and that Nuaj cannot verify — section 4. Read those two sections before the rest.
1. Parties and the Product
NuajLens is licensed by:
Nuaj Company Inc.
8250 Lawson Rd., Suite 201
Milton, Ontario L9T 5C6
Canada
General and legal enquiries: legal@nuaj.com
Security reports: security@nuaj.com
This is Nuaj's place of business and its address for notices, as stated in the Master Terms.
"NuajLens", the Product under this Agreement, consists of the Software — the NuajLens scanner, its console, the scan templates Nuaj supplies with it, and any related software Nuaj supplies in object-code form, together with any updates Nuaj chooses to make available. There is no Hosted Service, no Firmware, and no Appliance under this Agreement, and the provisions of the Master Terms that address hardware do not apply to NuajLens.
NuajLens runs entirely on your own systems. It has no licence key and makes no contact with Nuaj at runtime: it does not validate a licence, does not check for a version, does not send a heartbeat, and does not report what you scan or what it finds. Nuaj cannot tell whether any given copy is installed or running.
Two consequences follow from that, and both are yours to manage:
- Nuaj cannot reach your installation. There is no channel through which Nuaj can deliver a fix, disable a defective version, or warn you of a vulnerability in NuajLens itself. The only route Nuaj has to you is the contact address you gave when you requested access to the download portal. Keeping that address current, and checking for new releases, is your responsibility.
- Nuaj holds no record of your use. Nuaj cannot tell you what you scanned, cannot reconstruct a finding, and cannot recover your data. The Privacy Policy states this as a commitment rather than as an absence, and undertakes that a version of NuajLens which does contact Nuaj will be disclosed there before it is released.
2. Licence Grant
NuajLens is supplied free of charge. Subject to your compliance with this Agreement and the Master Terms, Nuaj grants you a non-exclusive, non-transferable, non-assignable, revocable licence, for as long as you comply with it, to install and run the Software on systems you own or control, or on systems belonging to a party you provide a service to, and to use it to scan assets you are authorised to scan under section 4.
The licence covers use for others. It permits both your own internal use and your use of NuajLens to deliver a service to End Customers, whether or not you charge for it — which, for a scanner, is the ordinary case rather than the exception. The obligations that come with doing so — flow-down, indemnity, no onward service level commitments, and the rest — are set out in Providing Services to Third Parties in the Master Terms and apply in full. The licence itself remains yours and may not be transferred, assigned, or resold as a licence.
No metering and no limits. NuajLens counts nothing and enforces no quota. There is no endpoint limit, no asset limit, and no scan limit under this Agreement.
Free of charge is not free of licence. Downloading the Software, or receiving a copy from anyone, grants you no rights in it. Your rights are only those granted above, and they end as described in section 8.
No redistribution. You may not redistribute the Software. Where you deliver a service with it, you run it — you do not supply it to your End Customer. An End Customer who wants their own copy must obtain it from Nuaj and accept this Agreement themselves.
3. Restrictions
Except to the extent a restriction is prohibited by applicable law, or expressly permitted by the licence of a third-party or open-source component, you may not:
- reverse engineer, decompile, disassemble, decrypt, or otherwise attempt to derive the source code, algorithms, structure, or internal design of the Software, or assist anyone else in doing so;
- copy the Software other than as required to install and back it up;
- modify, adapt, or create derivative works of it — save that you may write, edit, and run your own scan templates in the formats NuajLens supports, and a template you write is yours;
- distribute, publish, rent, lease, lend, sublicense, resell, or transfer the Software, or make it available to a third party other than as part of a service you provide under Providing Services to Third Parties in the Master Terms;
- remove, obscure, or alter any proprietary, copyright, licence, or product notice, Nuaj's identification of the Product, or the third-party attribution notice described in section 6;
- circumvent, disable, or interfere with any integrity, update, or security measure in the Software;
- use NuajLens to develop, train, or improve a competing product or service, or provide access to a competitor for that purpose.
How NuajLens may be used, against whose infrastructure, and for what purposes is governed by the Acceptable Use Policy, which applies to this Product as it does to every Nuaj product.
A breach of this section or of the Acceptable Use Policy is a material breach. Nuaj may act on it under Suspension and Termination in the Master Terms, and it terminates the licence granted above.
These restrictions survive the licence. The prohibitions on reverse engineering, on copying, and on transferring the Software continue to apply to any copy that remains in your possession after the licence ends, and ending the licence does not release you from them.
4. Your Representations — Authority to Scan
NuajLens sends traffic to systems in order to find weaknesses in them. Doing that to a system you are not authorised to test is unlawful in most jurisdictions, whatever your intent, and authorisation is not something a tool can supply. NuajLens is not a penetration-testing platform and is not a substitute for authorisation.
You represent and warrant, for every asset you register, scan, or otherwise direct NuajLens at, at the time you do so:
- that you own or operate that asset, or hold documented written authorisation from the party that does, covering the scanning you perform and the period in which you perform it;
- that the authorisation extends to the hosting provider, cloud platform, or network operator concerned, where their terms require their separate permission to test;
- that you have the legal authority to conduct that testing under applicable computer-misuse, unauthorised-access, telecommunications, and privacy law, in every jurisdiction the traffic touches;
- that you have made whatever disclosure, and obtained whatever consent, your arrangement with the asset's owner or the law requires; and
- that the scan is not directed at a person, entity, or system in a territory subject to comprehensive sanctions, or listed under an applicable sanctions or export-control programme, as described in Export Compliance and Sanctions in the Master Terms.
Nuaj has no relationship with the owner of an asset you scan, cannot obtain those authorisations for you, does not verify them, and — having no runtime contact with your installation — has no means of knowing what you scanned or when.
Indemnity. You will defend, indemnify, and hold harmless Nuaj, its affiliates, and their personnel against any claim, demand, proceeding, loss, damage, fine, penalty, or expense, including reasonable legal fees, arising out of or relating to a scan or other use of NuajLens that you were not authorised to perform, or that breached this section, the Acceptable Use Policy, or applicable law. This indemnity is in addition to any indemnity given under the Master Terms, is not subject to the cap in Limitation of Liability in the Master Terms, and survives termination of this Agreement.
You are also responsible for the security of the NuajLens installation and its console, for controlling who holds access to them, and for the confidentiality of the findings they produce — which describe, in operational detail, how to attack the systems they concern.
5. Nature and Limits of Scanning
A scan can break the thing it scans, and a clean report is not evidence of security. Both halves of that sentence are properties of vulnerability scanning as a discipline, not shortcomings peculiar to this product. Residual risk always remains, and it remains with you.
Specifically, and without limiting No Warranty in the Master Terms, you acknowledge that:
- Scanning is intrusive by nature. A scan may crash a service, exhaust processor, memory, connection, or file-descriptor limits on a device, fill logs and disks, lock out accounts through repeated authentication attempts, trip an intrusion-detection or anti-abuse system and cause you to be blocked, raise alerts and page people, and generate billable requests, traffic, or autoscaling on a metered platform. Choosing the scan window, the rate, the templates, and the change-control procedure around all of that is yours, not something the Product decides for you.
- Weaknesses will be missed. Detection rests on templates, version fingerprints, response signatures, and heuristics, all of which are incomplete and always trailing disclosure. An asset can be seriously vulnerable and report clean.
- Findings can be wrong. Fingerprinting misidentifies, back-ported patches make a version string misleading, and a template can match a condition that is not exploitable in your configuration. Verify a finding before acting on it: remediation applied to an unverified finding can itself cause an outage.
- A clean report is not a certification, an attestation, or a compliance artefact. It records what this version of NuajLens looked for, against those assets, on that date, and did not find.
- An asset never scanned produces no findings. Coverage gaps are silent, and an empty result is not an absent risk. The Product surfaces never-scanned assets as a number precisely so that this is visible; reading past it is your risk.
- Severity is an opinion. Severity labels and published scores are context-free. What a weakness is worth depends on exposure, compensating controls, and the value of what is behind it — all of which you know and the Product does not.
- NuajLens itself will contain defects, including security defects. It parses hostile output from the systems it scans, which is exactly the position an attacker would choose. Suspected vulnerabilities may be reported to security@nuaj.com under the Vulnerability Disclosure Policy published at nuaj.com/security. Because Nuaj has no channel to your installation, a fix reaches you only if you go and obtain it.
NuajLens is one instrument, not a security programme. It does not replace patching, asset management, configuration hardening, penetration testing by qualified people, monitoring, log retention, an incident response plan, or independent professional advice, and it does not by itself make you compliant with any law, regulation, or standard.
No statement in any marketing material, benchmark, demonstration, roadmap, or documentation is a warranty, a representation, or a guarantee of a security outcome.
Where you use NuajLens for an End Customer, this section describes what you are delivering to them, and you must not represent otherwise.
6. Free Software — Support, Updates, and Continuity
NuajLens is provided free of charge, and free means free. For the avoidance of doubt:
- No support commitment. Support in the Master Terms describes the support provided under a paid plan and does not apply to NuajLens. Nuaj may answer a question about NuajLens as a courtesy; doing so creates no obligation, no service level, and no course of dealing.
- No update obligation. Nuaj may publish updates, including security updates and new scan templates, and may stop doing so at any time. No support period applies to NuajLens, and the support-period commitment given for another Nuaj product does not extend to it.
- No availability or continuity commitment. Nuaj may modify NuajLens, restrict its distribution, withdraw it, or begin charging for it or for a future version, at any time and without notice. A copy you already hold remains licensed under this Agreement for as long as you comply with it; obtaining a further copy, an update, or continued access to the download portal may not.
- No warranty of any kind. No Warranty in the Master Terms applies to NuajLens in full: it is provided "AS IS" and "AS AVAILABLE". No hardware warranty applies, because no hardware is supplied under this Agreement.
Obtaining updates is your responsibility. NuajLens does not check for updates and Nuaj cannot push one to you. Nuaj publishes releases and security advisories through the download portal and by email to the contact address held for your access grant.
Third-party and open-source components. NuajLens includes third-party software and a corpus of scan templates subject to their own licences. The Software ships an attribution notice listing those components and the licences that apply to them, and makes it available from the Product itself. To the extent one of those licences grants you rights broader than this Agreement, that licence governs for that component, and nothing here limits a right you hold under it.
7. Reports, Findings, and Third Parties
A NuajLens report describes exploitable weaknesses in identified systems. In the wrong hands it is an attack plan, and this Agreement treats it as one.
- What NuajLens produces is yours, and only yours. Findings, asset inventories, and reports are generated on your systems and stay there. Nuaj never receives them, cannot assist you in recovering them, and is not a processor of them — so the Data Processing Agreement has nothing to attach to for this Product.
- Distributing a report is your decision and your responsibility. Where you send a report to an End Customer or to anyone else, you are responsible for the lawfulness of that disclosure, for what you assert on the strength of it, and for satisfying yourself that the recipient is entitled to know about weaknesses in the systems it describes.
- Findings about a third party. Where a scan you were authorised to run discloses a weakness in infrastructure belonging to someone else — a shared host, a hosting provider, an upstream service, a customer's supplier — handling that disclosure lawfully and responsibly is your obligation. Nuaj's Vulnerability Disclosure Policy governs reports about Nuaj's own products and authorises nothing you do with a finding about a third party.
- Personal data in findings. A scan may incidentally surface personal data — in a response body, an error page, an exposed directory, or a misconfigured store. Where it does, that data is on your systems and you are the controller of it, with the obligations that follow.
8. Incorporation, Acceptance, and Precedence
This Agreement incorporates, and is to be read with:
- the Nuaj Master Terms;
- the Acceptable Use Policy; and
- the Privacy Policy.
Each of them is published, is linked from the screen on which you accept this Agreement, and may be read before you accept. Together with this Agreement they are the Documents. The Data Processing Agreement is incorporated into the Master Terms and applies wherever Nuaj processes personal data on your behalf; for NuajLens, Nuaj processes none.
Where they conflict, the order of precedence in The Agreement and Order of Precedence of the Master Terms governs: mandatory law first, then a signed agreement, then the Privacy Policy and the Data Processing Agreement on questions of personal data, then this Agreement, then the Acceptable Use Policy, then the Master Terms, then any other referenced policy.
Acceptance. You are asked to accept this Agreement at two points: when Nuaj grants your organization access to the download portal at download.nuaj.com, and on first use of the NuajLens console. Acceptance is recorded as described in Acceptance, Authority, and Records in the Master Terms — the accepting account, the date and time, the source IP address, the version, the language version displayed, and a cryptographic hash of the exact text accepted. Because NuajLens has no runtime contact with Nuaj, the console acceptance is recorded in your own installation; the record Nuaj holds is the one taken at the download grant. Where the version changes materially, the current version applies to a copy you obtain after that change, and to your continued use of a copy you already hold from the point at which the console asks you to accept it.
Term and termination. This Agreement applies from your first acceptance, download, or use of NuajLens and continues until terminated. You may terminate it at any time by ceasing all use and removing the Software from your systems. Nuaj may terminate the licence for a material breach of this Agreement or of the Acceptable Use Policy, and may withdraw your access to the download portal at any time. Nuaj has no means of disabling a copy you hold, so termination obliges you to stop using the Software and remove it; it does not act on the Software itself, and continuing to use it after termination is use without a licence.
Survival. Parties and the Product, Restrictions, Your Representations — Authority to Scan including the indemnity, Nature and Limits of Scanning, Reports, Findings, and Third Parties, and this section survive termination of this Agreement, together with the surviving provisions of the Master Terms.
Language. This Agreement was drafted in the English language, and the English version is the sole authoritative and legally binding version. Any translation is provided for convenience only and has no legal effect. A complete French-language version is published and available to you before you accept, from the language selector on this page. Where you accept after having been able to read the French version, the parties have expressly requested and agreed that this Agreement, together with all related documents and notices, be drafted in the English language, and that the English version govern. Les parties ont expressément demandé et convenu que la présente convention, ainsi que tous les documents et avis qui s'y rapportent, soient rédigés en langue anglaise. Nuaj records which language version was displayed to you at the time you accepted.
If you do not agree to these terms, do not download, install, or use NuajLens.