Legal
Licence terms (extract)
The points below are the ones people ask about before they order. They are an extract; the full licence terms are supplied with the order and take precedence.
1. What is licensed
Shelltrap is proprietary software of Panomity GmbH. What is delivered is:
- compiled, stripped Go binaries (the broker, the scanner worker and the CLI),
- the thin PHP upload adapter,
- the CyberPanel plugin (Python),
- the packaged configuration, systemd units, documentation and public keys.
No source code is delivered. There is no source escrow arrangement in the standard licence.
2. Scope of the licence
A licence entitles you to install and operate the software on one server, for an unlimited
number of domains, child domains and accounts on that server. The licence is bound at activation
to a server fingerprint derived from /etc/machine-id; the standard licence permits one
simultaneous activation.
Moving to another machine is explicitly permitted and supported: shelltrap license deactivate
releases the activation slot, and shelltrap license activate claims it on the new host.
3. What is not permitted
Reverse engineering, decompilation and disassembly beyond what mandatory statutory law permits; redistribution, sublicensing, renting or hosting the software as a service for third parties without a written agreement; removing or altering licence checks, signature verification or attribution notices; and passing signature generations on to third parties.
Where the software includes third-party rules under licences that require attribution, that attribution must remain visible. Shelltrap keeps author, source URI and licence with every finding and in notification mails for exactly this reason, and those notices may not be stripped.
4. Signature feeds and updates
Signature generations, updates and support are tied to an active licence. Without a valid licence token the feed service refuses delivery and the scanner does not scan. This is the commercial boundary of the product and it is enforced technically as well as contractually.
The software does not break when a licence lapses: the daemon keeps running, reports the state
unlicensed with a precise reason, and the upload gate answers allow with the reason
unlicensed. It fails visibly rather than dangerously.
5. Data, and what we do not receive
The software scans locally. No customer file, no file content and no sample is transmitted to Panomity. The only outbound connections are the licence check and the download of signed signature generations, both to our infrastructure in Germany. Sample submission requires an explicit, per-case release by an administrator, and telemetry code is not loaded without an opt-in. See the privacy statement for the exact fields.
6. Warranty and liability
Statutory warranty applies. Beyond that, we make no promise of a particular detection rate, and nobody in this industry honestly can. What the product promises is documented behaviour: that it reports what it scanned, reports what it could not scan, never presents an impaired scan as a clean one, and explains the reasoning behind every verdict.
The limitations of liability in the full licence terms apply. They do not limit liability for intent, gross negligence, injury to life, body or health, or under the Product Liability Act.
7. What a licence check cannot do
We would rather state this than have it discovered: an attacker with root on your server can patch any binary on it, including ours. No client-side licence check survives that, and we do not pretend otherwise. The commercial protection of this product rests on signatures, updates and support being reachable only with an active licence, and on the source code not being delivered.
8. Term and termination
The licence runs for as long as the subscription does. On termination, the right to use the software and to receive signature generations ends. Quarantined content and audit records on your server are yours: nothing in the software deletes them on expiry, and package removal preserves them as well.
This page is an extract for orientation. The complete licence terms are provided with the order and prevail in the event of any inconsistency. Questions before ordering: hallo@panomity.de .