Terms of Service
Last updated: 7 October 2026
Relationship to Layerd AI's other products. Test My WAF is Layerd AI's own platform. Its tests, scoring and benchmarks are produced by a documented methodology applied in the same way to every target and every WAF, CDN or vendor. Results are not adjusted, re-weighted, suppressed or influenced by Layerd AI's commercial products, its own detection technology, or any commercial relationship Layerd AI has with any vendor.
1. Agreement
By accessing or using the Platform you agree to these Terms, our Acceptable Use Policy and our Privacy Policy, which are incorporated by reference. If you use the Platform on behalf of an organisation, you confirm you are authorised to bind it. If you do not agree, do not use the Platform.
2. The service
The Platform lets you test the effectiveness of a web application firewall (WAF) or CDN on a domain you control. After you prove control of the domain via DNS, the Platform — from a real browser — sends categorized, non-destructive attack-shaped requests and known-CVE signature probes, performs read-only API- and origin-exposure checks, and assesses bot-management posture, then returns a report (block rate, per-category results, an A–F grade against a published baseline, and findings).
3. Authorisation — you may only scan domains you control
3.1 You may initiate a scan only against a domain (and its apex/www)
for which you have verified control through our DNS-verification step and for which you are
authorised to conduct security testing.
3.2 You warrant that every scan you run is authorised, and you are solely responsible for obtaining any necessary permissions. You must not use the Platform to test, attack, overload or probe any system you do not own or lack authorisation to test.
3.3 We require DNS-ownership verification before a scan runs and re-check it at run time. This is a control, not a substitute for your own authority to test. See the Acceptable Use Policy.
4. Acceptable use
Your use is governed by our Acceptable Use Policy. In short, you must not scan targets you are not authorised to test; attempt to cause damage, outages or data exfiltration; deliver working exploits; circumvent verification, rate limits or access controls; resell or scrape the Platform or build a competing dataset from it; or use it unlawfully. Payloads are deliberately detection-oriented and rate-limited and must not be weaponised.
5. Nature of results — important
5.1 Point-in-time and configuration-specific. A report reflects only what the target's WAF/edge did, for the specific requests sent, from our scanning source, at the time of the scan. Results can change with configuration, rulesets, routing, rate-limiting, IP reputation or vendor updates.
5.2 Signature recognition, not a vulnerability assessment. A "bypass" means a crafted request was not blocked; it does not mean the target is vulnerable or exploitable. CVE checks test whether a signature is recognised, not whether the target is affected. The Platform is not a penetration test, vulnerability scan, certification or audit, and must not be represented as one.
5.3 Not a verdict on any vendor. A report measures a specific deployment's configured behaviour. It is not, and must not be presented as, a general assessment, ranking, endorsement or criticism of any WAF/CDN product or vendor. Grades are relative to a published baseline (e.g. OWASP CRS Paranoia Level 2), are false-positive-adjusted, and are withheld where the measurement is confounded.
5.4 No warranty. The Platform and all reports are provided "as is" and "as available", without warranties of any kind (express or implied), including fitness for a particular purpose, accuracy, completeness, or that your systems are secure. Security testing is inherently incomplete; a good result is not an assurance of safety.
5.5 Your responsibility. You are responsible for how you interpret and act on reports and for your own security. Run against staging before production, and only when you intend to.
6. Reports, retrieval & email
6.1 Reports are retrievable by scan ID for 14 days, after which they and any stored PDFs are purged. Scan IDs are unguessable but act as access tokens — treat report links as confidential.
6.2 To receive the full report you may be asked for contact details; see the Privacy Policy for how Layerd AI uses them, including for sales follow-up. The full report may be emailed to the address you provide.
7. Intellectual property
The Platform, its methodology, payload corpus, scoring, report format, branding and content are owned by Layerd AI and protected by law. We grant you a limited, revocable, non-exclusive licence to use the Platform and to use reports for your own internal security purposes. You may share a report about your own domain. You may not use our materials to build or train a competing service or dataset.
8. Your use of results
If you reproduce or quote a report you must present it accurately and in context (point-in-time and configuration-specific, per section 5), identify "Test My WAF (operated by Layerd AI)" as the source, and not imply it is an independent certification or a general verdict on any vendor. You are responsible for your own compliance with advertising and comparative-marketing laws when you publish results.
9. Availability, changes & suspension
We may change, suspend, rate-limit or discontinue the Platform (or any feature) at any time, and may refuse or terminate access for suspected misuse or breach of these Terms or the Acceptable Use Policy.
10. Limitation of liability
10.1 Nothing in these Terms excludes or limits liability that cannot be excluded or limited by law (including death or personal injury caused by negligence, or fraud).
10.2 Subject to 10.1, the Platform is provided free of charge and without warranty; to the maximum extent permitted by law Layerd AI is not liable for any indirect, incidental, special or consequential loss, loss of profit, revenue, data, goodwill or business, or for any loss arising from your use of or reliance on the Platform or any report, or from any security incident.
10.3 Subject to 10.1, Layerd AI's total aggregate liability arising out of or in connection with the Platform is limited to £100.
10.4 You will indemnify Layerd AI against claims arising from your breach of sections 3 or 4 (unauthorised scans or misuse).
11. Governing law & jurisdiction
These Terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights you have as a consumer.
12. Changes to these Terms
We may update these Terms; the current version and its date are posted on this page. Continued use after changes take effect means you accept them.