Version 1.0 · Last updated: 31 August 2026
Courtesy translation. The French version prevails. Previous versions are archived and available on request at [email protected].
These terms of use govern access to the stealed.io website and to the Platform published by STEALED SAS, a société par actions simplifiée with share capital of EUR 1,000, registered with the Nîmes trade register under number 102 765 344, with its registered office at 15 rue du Docteur Marcel Paulet, 30250 Sommières, France ("Stealed").
They are common to the direct and indirect channels. They govern access and use only. Service provision, its financial terms and the personal data regime are governed by the instruments listed in article 2.
These terms are binding on:
The User accepts these terms in their own name and on behalf of the organisation that authorised them. That acceptance creates no new obligation for that organisation and derogates from no provision of the instrument it has signed.
The contractual set comprises, depending on the channel, the special conditions or the order form, the service terms applicable to the customer or the partner, these terms and the common annexes, in particular the deed of mandate, the data processing agreement, the security policy, the service level agreement, the data use model, the acceptable use policy and the non-disclosure agreement.
In the event of contradiction, these terms yield to the other instruments of the contractual set. The deed of mandate prevails in all cases, whatever the form in which it is executed.
Capitalised terms have the meaning given to them by the applicable service terms. These terms add the following.
These terms are accepted by a positive action. The Visitor ticks the box referring to them before submitting a domain for diagnostic. The Self-service account holder and the User accept them before the account is created. Failing that, neither the diagnostic nor the account creation completes.
The text of these terms is permanently available on the Site, in a dated and numbered version. Every previous version is archived and provided on request at [email protected].
For each acceptance, Stealed records the version accepted, the date and time, the signatory's email address and the domain concerned. That record is retained for three years from account closure.
The Site and the Platform are intended solely for professionals acting for the purposes of their business. The Visitor, the account holder and the User declare that they act in that capacity and have authority to bind the organisation on whose behalf they act.
No subscription is open to a natural person acting for purposes outside their professional activity. The diagnostic is open only to email addresses attached to a professional domain name; consumer email addresses are refused. Stealed refuses or closes, without compensation, any account opened outside this framework.
The Site offers an exposure diagnostic on a domain name. That diagnostic grants no access to the corpus, is not a search engine and permits no free search. It covers only the domain submitted, excluding any named natural person.
The submitted domain is purged within twenty-four hours, unless an account is created within that period. The number of diagnostics is limited per domain and per connection origin. Every submission is logged.
The diagnostic constitutes neither the opening of named access, nor a lasting attachment of the domain, nor a service supply contract.
Submitting a domain constitutes a declaration by the Visitor that they are its legitimate owner or that they act under a documented mandate from the owner. That declaration is recorded and timestamped.
The Visitor indemnifies Stealed against any claim, action or judgment resulting from an inaccurate declaration, including defence costs incurred.
Before verification, the result is limited to aggregated indicators for the domain, namely an exposure score and volumes. No identity, no sample, no hostname and no password, even masked, is accessible at that stage.
The detailed result is sent only to an email address attached to the submitted domain, after control of that address is confirmed by a single-use link. It is limited to the masked sample of the Referenced state, under the conditions set out in the data use model.
The masked sample is not displayed where the number of distinct occurrences attached to the domain is below the threshold set in the data use model. Below that threshold, only aggregated indicators are returned.
A Visitor who has created no account is bound by no service terms. This article alone governs their situation; it ceases to apply as soon as an account is created.
The diagnostic is provided as is, for information only and with no undertaking as to results. Stealed does not warrant the completeness of the data, the absence of false positives, or the detection of every compromise. Its liability for the diagnostic is limited to direct and foreseeable damage and may not exceed one thousand euros, save for wilful misconduct, gross negligence, personal injury or breach of personal data protection obligations.
The diagnostic is governed by French law.
ANY DISPUTE RELATING TO THE DIAGNOSTIC FALLS WITHIN THE EXCLUSIVE JURISDICTION OF THE COMMERCIAL COURT OF NÎMES, INCLUDING IN SUMMARY PROCEEDINGS, WHERE THERE ARE MULTIPLE DEFENDANTS AND IN WARRANTY CLAIMS.
That jurisdiction clause applies only where all parties have contracted as traders, in accordance with Article 48 of the French Code of Civil Procedure. Failing that, ordinary rules of jurisdiction apply.
Before the account is created, the Self-service account holder accepts electronically the service terms applicable to the customer, their common annexes and these terms, which they acknowledge having received in their dated and numbered version. From that acceptance, they are a customer within the meaning of those terms.
The financial terms, commitment period and termination arrangements are set out in the special conditions or the order form accepted at subscription. Where online subscription is open, they are set out in the sales terms published on the Site, which then serve as special conditions.
Subscription requires execution of the deed of mandate under article 11 and verification of domain ownership under article 12. Until both conditions are met, the account remains limited to aggregated indicators.
Access to data attached to a domain requires a deed of mandate. In self-service, that deed is executed electronically.
The deed is formed by an acceptance separate from that of the service terms and of these terms, bearing on its own text and listing the domains concerned. It is timestamped, named and logged, and meets the requirements of Articles 1366 and 1367 of the French Civil Code.
Any inaccurate declaration of ownership constitutes a material breach, sanctioned under the applicable service terms.
No named access is opened on a domain whose ownership has not been verified by a record in the domain name zone.
Verification is renewed on a change of domain owner, on expiry of the period set by Stealed and, in any event, before any cleartext disclosure is opened.
Control of an email address attached to the domain does not amount to ownership verification. It opens only the title II diagnostic.
The account is named. Sharing it is prohibited.
The account holder and the User are responsible for the confidentiality of their credentials and for actions performed from their account, unless they establish a compromise not arising from a failing on their part and which they reported to Stealed without delay after discovering it.
Strong authentication is enabled on every account with named access. API keys are scope-restricted and revocable at any time.
The account holder keeps its list of Users up to date and revokes without delay the access of persons who have left or changed roles.
Permitted purposes, prohibited uses, keyword rules and duties of care are set out in the acceptable use policy, whose provisions apply in full to the Visitor, the account holder, its Users, its staff and its subcontractors.
The extent of disclosure, the access states, the password regime and the conditions of any cleartext disclosure are set out in the data use model. These terms restate none of its provisions.
The processing carried out is described in the privacy policy, which constitutes the information required by Articles 13 and 14 of Regulation (EU) 2016/679. Collection arrangements are described in the collection policy. The use of trackers is described in the cookie policy, pursuant to Article 82 of French Act No. 78-17 of 6 January 1978.
The split of roles between controller and processor is set out in the data processing agreement. These terms do not derogate from it.
Addresses collected through the diagnostic are used for prospecting only under the conditions of Article L. 34-5 of the French Postal and Electronic Communications Code, each message including a simple and free means of objection.
Stealed may amend these terms. Any amendment is published in a dated and numbered version.
A substantial amendment is notified in writing thirty days before it takes effect. An amendment is substantial where it affects the extent of access, the account holder's obligations or the conditions of the diagnostic. An account holder who refuses it may close their account without compensation during that period. Failing closure within that period, the amendment becomes binding on them.
No amendment applies to facts predating its entry into force.
The parties agree that the logs kept by Stealed constitute evidence between them of connections, acceptances, ownership declarations, ownership verifications and actions performed on the Platform, unless proven otherwise.
This agreement is entered into under Article 1356 of the French Civil Code. It establishes no irrebuttable presumption and leaves each party free to adduce evidence to the contrary by any means. Logs are retained for twelve months and provided to the account holder on reasoned request, as regards their own data.
These terms restate no provision of the service terms or of the common annexes. Intellectual property, confidentiality, liability, warranties, force majeure, suspension, duration, termination, governing law and jurisdiction are governed by the applicable service terms, whether those of the customer or those of the partner.
By way of exception, article 9 alone governs the situation of the Visitor, who is bound by none of those terms.
If a provision of these terms is deemed unwritten or declared void, the others remain applicable. These terms are drafted in French; in the event of translation, the French version prevails.