Terms
Last updated 30 September 2026.
These terms cover this website, your use of the Draugr open-source software, and Draugr Server when we run it for you as a service. Where your organization has signed a separate agreement with us, that agreement prevails over this page.
The software
Draugr is licensed under the Apache License 2.0. That license governs your use of it, and its terms prevail over anything on this page. Two of its provisions are worth stating in plain words, because they matter:
There is no warranty. Draugr is provided "as is". We don't promise it is fit for any purpose, error-free, or that it will find anything in particular.
There is no liability. To the extent the law allows, neither Draugr nor its contributors are liable for any damages arising from your use of it, including a vulnerability it failed to find, a license obligation it failed to flag, or a build it failed or passed.
What a scan result means
A passing verdict means the controls you configured found nothing they were looking for. It is not a statement that your software is secure, compliant, or fit to ship. Draugr is silent about anything your descriptor doesn't declare, controls you didn't enable, and whatever the underlying third-party scanners miss.
License findings are information, not legal advice, and create no attorney–client relationship. Reports and SBOMs are a record of what was run, not a certification against any standard. The scope and disclaimer page sets this out in full.
Scanning responsibly
Some controls make requests to hosts you name, and the dast control actively probes them. In many jurisdictions that is lawful only against systems you own or have written permission to test. Obtaining that permission is your responsibility. Draugr scans what it is pointed at and cannot tell whether you were entitled to.
Third-party tools
Draugr runs external scanners rather than embedding them. When you use them you do so under their own licenses and terms, not ours. Some fetch data from third-party services while scanning. The integrations catalog names each tool and its license.
The hosted service
This section applies when you or your organization use Draugr Server as a service we run ("the service"), including during early access.
Early access
The service is in early access. It is provided "as is" and "as available", with no commitment to uptime, and the warranty and liability terms above apply to it as they do to the software. While it is in early access, its features, limits and plans may change, and charges may be introduced with notice.
How we run it
We choose the infrastructure the service runs on: the providers that host, store and deliver it, including its databases, object storage, networking, email and monitoring. We may change those providers, move the service and your organization's data between them, and change how the service is built, at any time and without your consent, as long as your data remains protected as these terms describe. Where your organization's data is held in a stated region, it stays in that region unless we tell you before moving it.
Changes to the service
We may migrate, restructure, re-architect or redesign the service, including its data model, its interfaces and its API; add, change or remove features; and change limits and plans. Where a change removes something your organization relies on, such as an API version or a feature of its plan, we will tell its owners in advance where we reasonably can. A migration can require maintenance or brief interruptions, which we keep short and announce where practical.
Your data
What your organization publishes to the service remains yours, and we use it only to provide the service to you. It is kept for the retention periods your plan states and removed after them; open findings and the audit trail are kept for as long as your organization exists. You can read your organization's data through the API at any time, including to keep a copy of it.
Ending the service, or your use of it
You can stop at any time. An organization's owner can close it, and its data is deleted after a waiting period of at least 90 days.
We may suspend or close an organization that breaks these terms, puts the service or other customers at risk, or does not pay charges that apply to it. Where the risk allows, we tell its owners first.
We may discontinue the service, in whole or in part, including by ending the project. We will give organization owners at least 30 days' notice where we reasonably can, and time to keep a copy of their data through the API, after which the data is deleted.
Deleted data may remain in backups for a limited period, no longer than 30 days, before it is gone from them too. The Draugr command-line software remains available under the Apache License 2.0 whatever happens to the service, so ending the service never stops you scanning.
This website
The site is provided as is, and may change or go offline without notice. Content here is documentation and opinion, not professional advice, legal, security, or otherwise. Don't use the site to break the law, attack it, or misrepresent your identity when contacting us.
"Draugr" and the Draugr mark are ours. The Apache-2.0 license covers the code; it does not grant trademark rights. You're welcome to say you use Draugr, and to write about it.
See Privacy for what the site collects.
Changes
If these change materially we'll update the date above, and for the service we tell organization owners by email before the change takes effect. Your continued use of the site or the service after that is your acceptance of the change; if you'd rather be told, ask at support@draugr.dev and we'll email you.