Terms of Service — PCI DSS products

The terms covering the PCI DSS remediation pack, the requirement 5.4.1 email add-on, and the requirement 11.6.1 evidence ledger.

Who you are contracting with

These terms govern the PCI DSS products of this service, operated by Toledo Technologies LLC, 2389 Main St STE 100, Glastonbury, Connecticut 06033. Payment is processed by Polar as merchant of record, and their terms apply to the transaction itself.

What these products are

Software that inspects a web page or a domain's public DNS records and reports what it observed, together with written remediation guidance. The evidence ledger additionally re-evaluates a payment page on a schedule and records each evaluation in a hash-chained history.

What they are not

They do not determine your PCI DSS compliance, do not replace a Qualified Security Assessor, and do not decide which self-assessment questionnaire applies to you — your acquiring bank sets your reporting obligations. Output is evidence for qualified human review. No result is a certification, a legal opinion, or a guarantee that any assessor or acquirer will reach the same view.

You must be authorized

You may only submit a page or domain you own or are authorized to have checked. Ongoing monitoring requires you to attest to that before it starts, because the service fetches the page repeatedly on a schedule. Submitting a third party's property without authority is a breach of these terms and may be unlawful where you are.

Limits of the checks

The free check reads served or pasted HTML; it does not inspect HTTP response headers or fetch referenced script bytes. Live evidence-ledger evaluations additionally fingerprint selected response headers and fetch referenced script contents. Neither path executes the page in a browser, so a script injected at runtime by another script is outside what they can see, and no automated check can decide whether a script is authorized — only you know that. A clean result means the checks performed found nothing, not that nothing is wrong.

Subscriptions and cancellation

The evidence ledger bills monthly through Polar until cancelled, and you can cancel at any time from Polar's customer portal. If monitoring stops producing evaluations for more than 7 days we cancel the subscription ourselves rather than continue billing for a service that is not running, and we record why.

Liability

To the extent permitted by law, liability is limited to the amount you paid for the product in question. Nothing here excludes liability that cannot lawfully be excluded.

These pages cover Tessera's PCI DSS products.