Terms of Use

These Terms of Use regulate the contractual relationship between pwndr («we») and any individual or legal entity («User», «you») who accesses or uses the pwndr platform, available at pwndr.io.

Access and use of the service implies full and unconditional acceptance of these Terms. If you do not agree with any provision, you must refrain from using the service.

pwndr is a threat intelligence platform that allows users and organizations to check whether credentials associated with their domains have been exposed on public dark web sources, underground forums, cybercriminal Telegram channels, and paste sites.

The service includes:

• Free consultation of the number of exposed credentials associated with a domain.
• Viewing a partial sample of detected credentials (up to 5 records per type).
• Full access to the leaked credentials report, CSV export, and bulk record unlock, via single payment per domain.

pwndr depends on the availability and updates of the external sources it indexes. We do not guarantee that the index is complete or that it captures all existing leaks on the Internet.

The information provided by pwndr is exclusively informational and for early warning purposes. The User is solely responsible for validating and acting on such information. pwndr assumes no responsibility for decisions made based on the data provided.

pwndr does not access, breach, or extract information from any external computer systems. The indexed information comes from publications made by third parties on open or semi-public sources. pwndr's activity is strictly defensive and informational in nature, in accordance with Article 197 et seq. of the Spanish Penal Code and the EU legal framework for cybersecurity.

Full monitoring of a domain is contracted through a recurring monthly subscription whose amount depends on the number of leaked credentials for that domain: from €49.95 to €499.95 per month per domain (VAT included when applicable).

• Payment is processed securely through our payment provider. pwndr does not store credit card data.
• The subscription renews automatically each month until the user cancels it from their dashboard. Full access to the domain's credentials is maintained while the subscription is active.
• The price tier is determined by the number of leaked credentials for the domain at the time the subscription is activated.
• Cancellation takes effect at the end of the period already billed, with no refund of fractions of the current month, unless the service was not provided due to causes attributable to pwndr.
• Prices may vary. The applicable price is the one in effect at the time of contracting; any change affecting active subscriptions will be communicated in advance.

The User commits to:

• Using the service exclusively for legitimate defensive security purposes, protection of own assets or of organizations for which you are authorized.
• Not using the information obtained for unlawful activities, unauthorized system access, extortion, fraud, or any activity that causes harm to third parties.
• Not attempting to extract, scrape, or bulk download the pwndr index through unauthorized automated means.
• Providing truthful registration data and keeping it up to date.
• Querying only domains for which you have legitimacy (your own, of organizations you represent, or of clients who have authorized you under section 7).
• Notifying immediately of any unauthorized access to your account.

pwndr reserves the right to suspend or cancel accounts that breach these obligations, without prejudice to exercising applicable legal actions.

Reselling the service is permitted. The User may resell pwndr, embed it in their own services —for example as a managed security service provider (MSSP), consultancy, integrator or distributor— and deliver the reports, alerts and data obtained to their clients, including under their own brand and through the API or the MCP server. No prior authorization or additional agreement with pwndr is required.

Anyone reselling the service (the "Reseller") does so under the following conditions:

• End-client authorization. The Reseller may only monitor domains and email addresses of clients who have authorized it. For domains, ownership verification through a DNS record, which the client can complete itself, serves as proof of that authorization. For email addresses, the Reseller must hold the owner's express authorization and provide it if pwndr requests it. When the relationship with a client ends, the Reseller will remove that client's domains and email addresses.
• Relationship with clients. The Reseller sets its own prices and is solely responsible for its contractual relationship with its clients, invoicing, support and any warranties it offers. pwndr has no contractual relationship with the Reseller's clients and is not liable to them.
• Service pricing. Each monitored domain or email address requires its own subscription under the prices in section 5, whether it is used by the Reseller or by its client. Special terms for high-volume partners are agreed in writing.
• Data protection. The Reseller complies with data protection law in any processing carried out on behalf of its clients and signs with each of them the data processing agreement required by Article 28 GDPR. Plaintext credentials may only be delivered to the organization that owns the domain or email address, over a secure channel, and never to third parties. If the Reseller needs a data processing agreement with pwndr, it can request one at the contact address.
• Flow-down of obligations. The obligations in section 6 apply to the Reseller, who must pass them on to its clients and is liable to pwndr for their breaches.
• Account and tokens. Account credentials and API tokens belong to the Reseller and may not be handed to its clients. To give a client direct access, the client must open its own account.
• No open lookup service. Building a derived index from pwndr data, or offering a search service where third parties can query arbitrary domains or email addresses without the authorization described above, is not permitted.
• Use of the brand. The Reseller may state that it uses pwndr as a source or resell the service under its own brand, but may not present itself as pwndr or suggest an official partnership, certification or sponsorship that does not exist in writing.

pwndr may suspend the account of a Reseller that breaches these conditions, under the terms of section 6. For questions about reselling or partner terms, write to us at [email protected].

Access to the service requires creating an account. The User is responsible for maintaining the confidentiality of their login credentials and all activities conducted through their account.

pwndr will not be responsible for damages arising from unauthorized account use when the User has not notified such access within a reasonable period.

The User may request deletion of their account at any time by sending an email to [email protected]. Account deletion does not entitle a refund of payments already processed.

All intellectual property rights on the pwndr platform (including design, source code, trademark, indexing methodology, and results presentation) belong to pwndr or its licensors.

Access to the service does not grant the User any intellectual property rights over the platform. The User may download and use the reports obtained for their security purposes and, under section 7, deliver them to the clients they provide services to. Outside that case, the reports may not be published or redistributed.

The processing of User personal data is governed by our Privacy Policy, which is an integral part of these Terms. By accepting these Terms, the User confirms having read and accepted the Privacy Policy.

pwndr makes reasonable efforts to keep the service continuously available, but does not guarantee 100% availability. The service may be temporarily interrupted for maintenance, updates, or circumstances beyond our control.

Reports of already purchased domains are permanently recorded in the User's account and will remain accessible except for account cancellation or service termination, in which case at least 30 days' notice will be provided.

To the maximum extent permitted by applicable law, pwndr shall not be liable for:

• Damages arising from use or inability to use the service.
• Inaccuracy, incompleteness, or obsolescence of indexed credentials.
• Decisions made by the User based on the information provided.
• Loss of business, lost profits, loss of data, or indirect damages.
• Service interruptions caused by third parties, network failures, or force majeure events.

In no event shall pwndr's total liability to the User exceed the amount paid by the User in the twelve months preceding the damaging event.

pwndr may modify these Terms of Use at any time. Material changes will be communicated by email or notice in the service at least 15 days in advance. Continued use of the service after the changes take effect implies acceptance.

These Terms are governed by Spanish law. For the resolution of any dispute arising from these Terms, the parties submit to the Courts and Tribunals of the city of Madrid, with express waiver of any other jurisdiction that might apply.

For consumer users of the European Union, the European Commission provides an online dispute resolution platform accessible at ec.europa.eu/consumers/odr.

For any questions about these Terms, please contact us at [email protected].