Legal
Last updated: September 2026
These Terms of Service ("Terms") govern access to and use of Drubix (the "Service"), provided by Drubix ("Drubix," "we," "us," or "our"). By creating an account, submitting a site for scanning, or otherwise using the Service, you agree to be bound by these Terms. If you're using the Service on behalf of an organization, you're agreeing on that organization's behalf, and "you" refers to that organization.
Drubix monitors Drupal websites for security advisories, configuration drift, and related risks, and provides findings, remediation guidance, alerts, and reports based on that monitoring. The Service includes:
You represent that you have the right and authority to have any site you submit to Drubix scanned or monitored — whether it's your own site or a client's. If you're an agency submitting a client's site, you're responsible for having whatever authorization your relationship with that client requires. Drubix is not a party to that relationship and is not responsible for verifying it.
Do not use the Service to scan or monitor a site you don't have authorization to assess. We reserve the right to suspend or terminate access if we reasonably believe the Service is being used to assess a site without proper authorization.
You're responsible for maintaining the confidentiality of your account credentials and for all activity under your account. Notify us promptly of any unauthorized use.
Passive, one-off scans may be offered free of charge, without requiring payment information. Free scans are provided on an "as available" basis, may be rate-limited, and may be modified or discontinued at any time.
Paid plans are billed on a recurring (monthly) basis. Payment processing, billing, invoicing, and related tax compliance are handled by Paddle.com Market Ltd. ("Paddle") as our authorized reseller and merchant of record — meaning Paddle, not Drubix, is the seller of record for your subscription. Your purchase is subject to Paddle's own terms and policies, including their refund policy, in addition to these Terms.
Subscriptions renew automatically until cancelled. You can cancel at any time; cancellation takes effect at the end of the current billing period, and no partial refunds are provided for the unused portion of a period unless required by law or Paddle's refund policy.
We may change pricing with notice; changes apply from your next renewal after the notice period.
Installing the Connector module on a Drupal site is optional and grants Drubix access to more detailed data than passive scanning alone (see our Privacy Policy for specifics). Installing the Connector constitutes your authorization for that data to be collected and processed as described there. You can uninstall the Connector at any time to stop this data collection going forward.
You agree not to:
Drubix is a monitoring and informational tool, not a penetration test, security audit, or warranty of any kind. Findings are based on available data (public advisories, scan results, connector reports) at the time they're generated, and may be incomplete, delayed, or inaccurate. Third-party data sources we rely on — including Drupal.org's security advisory feed and CISA's Known Exploited Vulnerabilities catalog — are outside our control, and we don't guarantee their accuracy or completeness.
Using Drubix does not guarantee that a site is secure, free of vulnerabilities, or will not be compromised. You remain solely responsible for the security of your (or your clients') Drupal sites.
The Service is provided "as is" and "as available." We don't guarantee uninterrupted or error-free operation, and we may perform maintenance, updates, or modifications that temporarily affect availability.
Drubix and its licensors own all rights, title, and interest in the Service, including its software, design, and branding. These Terms don't grant you any rights to our trademarks or branding. You retain ownership of the data about your own sites that you submit to the Service; you grant us a license to process that data solely to provide the Service to you.
To the maximum extent permitted by law, Drubix and its officers, employees, and affiliates will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or business opportunity, arising from your use of the Service — including, without limitation, damages arising from a security incident on a site monitored by Drubix. Our total liability for any claim arising from these Terms or the Service is limited to the amount you paid us in the twelve months preceding the claim.
You agree to indemnify and hold Drubix harmless from any claims, damages, or expenses arising from your breach of these Terms, your use of the Service, or your lack of authorization to have a site scanned or monitored.
You may stop using the Service and cancel your subscription at any time. We may suspend or terminate your access if you materially breach these Terms, including unauthorized scanning of a site, and we may discontinue the Service (or any part of it) with reasonable notice.
We may update these Terms from time to time. We'll post the updated version here with a new "Last updated" date; continued use of the Service after changes take effect constitutes acceptance of the revised Terms.
[Placeholder — specify the governing jurisdiction here once confirmed with a lawyer; commonly the law of the country where the operating company is registered.]
Questions about these Terms: hello@drubix.com.