Terms of Service
Last updated: 2 October 2026
Subject
These terms govern use of Buteo, an external domain exposure auditing service provided by Magma-T, Unipessoal Lda, trading as DeltaCoders. By creating an account or using the service you accept these conditions.
You may only scan domains you control
This is the central condition and it admits no exception for convenience. Before any scan, the domain must be verified through a TXT record in DNS, a file placed at a well-known location, or a challenge sent to an email address associated with the domain. The engine refuses to scan an unverified domain, and that refusal is applied when the scan is requested and again when it runs. There is no way to bypass this verification from your account, whatever your role in the organisation.
What the service does and does not do
Buteo reads what a domain publishes and reports what it finds. It does not try credentials, hunt for unpublished files or paths, exploit weaknesses to confirm them, or interfere with the operation of the systems it audits. A problem is reported on the basis of what is observable, never demonstrated by exploiting it. The risk score assigned is an indicative heuristic intended to order priorities, and is neither a standardised scoring scheme nor a compliance opinion.
Acceptable use
You may not use the service to scan third-party infrastructure without authorisation, to bypass ownership verification, to deliberately overload anyone else's systems, or for any unlawful purpose. Breaching these rules allows us to suspend the account immediately. We maintain a list of domains excluded from scanning in response to abuse reports or opt-out requests, and that list prevails over any ownership verification.
Accounts and responsibility
You are responsible for the accuracy of the account details, for safeguarding credentials and for actions taken through the account. Each organisation defines the roles of its members and is responsible for that assignment.
Plans, limits and changes
Each plan defines the available modules and limits on domains, projects and seats. Limits are enforced at creation: at the limit, no more can be created. A downgrade never deletes or disables what already exists, it only refuses new creation until you are back under the limit. A plan change takes effect immediately.
Prices and payment
The prices in force are those published on the site or those in an accepted commercial proposal. Prices are shown before value added tax, which is added under the applicable Portuguese and European rules: Portuguese VAT at the rate of the customer's region in Portugal, reverse charge for businesses in another Member State with a valid VAT number, and no Portuguese VAT outside the European Union. Payments are processed by Stripe, by card, SEPA Direct Debit or Multibanco reference, and payment details do not pass through our systems. Each payment gives rise to an invoice-receipt issued by certified invoicing software and sent to the billing addresses given; a refund gives rise to a credit note.
Scan credits
Each scan consumes credits under the price list in force when it is requested, which takes into account the domain, the number of hosts scanned and the modules run. When a scan is requested an estimate is reserved; at the end the real amount is charged and the difference returned, and a scan that fails consumes no credits. Without available credits, new and scheduled scans wait, while a scan already running always finishes, the difference being taken from the next purchase. Credits included in the plan renew each month and do not carry over to the next month. Bought credits are valid for one year from purchase and are spent oldest first. Bought credits are not refundable and, if the subscription ends, remain available until they expire, including on the free plan; credits included in the plan end with it. The automatic top-up works only if you turn it on, buys the chosen pack on the saved payment method within the monthly limits you set, and can be turned off at any time.
Availability and limitation of liability
We aim to keep the service continuously available but do not guarantee uninterrupted operation, except where a service level agreement has been expressly contracted. The service identifies observable problems in a domain's external exposure and does not replace a full security audit, a penetration test or legal advice. Our liability is limited to the amount paid in the twelve months preceding the event giving rise to it, except where the law does not permit such a limitation.
Termination
You may terminate the subscription at any time. We may terminate provision in the event of a breach of these terms or non-payment. After termination, data is kept for the periods set out in the Privacy Policy and then deleted.
Governing law
These terms are governed by Portuguese law. The courts of Lisbon have jurisdiction over any dispute, with express waiver of any other, without prejudice to any rights consumers hold under mandatory rules.
Magma-T, Unipessoal Lda · VAT 509780342 ·support@buteo.pt
Rua Major João Luís de Moura, Piso 1, Esc. AE · 1685-253 Famões · Portugal