Nobody is clean.

Scan your domain with EchelonGraph. If we report it clean and you can show us something we missed, you get EchelonGraph free.

Entries open 20 August 2026 and run for 60 days, closing 19 October 2026.

Checking whether entries are open…

Why we are doing this

Every scanner vendor says they find more. It is an unfalsifiable claim, and the industry is full of it. This is the version with a cost attached: if our scanner tells you your domain is clean and it is wrong, that mistake is worth something to you.

We are not betting that our scanner is perfect. We are betting that it is honest about what it checked — which is why a scan that could not complete a check does not report that check as clean, and cannot be claimed against as though it did.

How it works

  1. Scan your domain. Free, no account, and repeatable — start here.
  2. If it comes back clean, open a claim against that scan, within 30 days of it completing.
  3. Prove you control the domain — a DNS TXT record, a file on the site, or an HTTP response header. Whichever you prefer.
  4. Show us what we missed. A person reads every claim that gets this far and writes a reason either way.

What you get

EchelonGraph free for the tenant you nominate — the tiers and features generally available on 20 August 2026, at the capacity limits published for those tiers on that date.

The exact tier and feature matrix is published as the tier appendix when entries open on 20 August. We are not publishing capacity numbers before then, because the grant is defined against what exists on the start date and a figure quoted early is a figure that can be contradicted by the snapshot. The appendix is captured from all three of our own sources independently and content-hashed — including anywhere they disagree.

The grant runs to the legal entity that proved control of the scanned domain, and covers only that entity’s estate — not parents, subsidiaries, affiliates, other domains you did not scan, other brands, or anything you acquire afterwards. It is non-transferable and does not survive a change of control.

Eligibility

  • The domain resolves publicly, serves HTTPS, and returns a real application — not a parked page, a registrar holding page or a bare redirect.
  • It is your organisation’s primary domain, not a throwaway subdomain.
  • You prove control of it, by any of the three methods we accept.
  • The scan completed every check it reports on. A check that errored or timed out is reported as not assessed, and a scan carrying one is not claimable as clean.
  • One grant per domain. Where two people claim the same domain, the first verified ownership proof takes precedence.

What we reserve, and what we do not

We do not reserve a right to withdraw a grant once it is made. An offer hedged that broadly is not a bet, and we would rather publish one that means something.

What we do reserve is narrower, and it is the whole of it:

  • The grant covers what exists on the start date. Products, add-ons and separately priced modules built later are not automatically included.
  • We may stop accepting new entries at any time. Entries already validated are honoured.
  • Entries pause automatically if our own scanner stops discriminating — the banner above says so when it happens.
  • A genuinely independent entity, with its own security organisation and infrastructure, may be granted a separate attempt at our discretion.

If EchelonGraph ever ceases to operate the product, no plan continues — that applies to paying customers and challenge winners alike, and we would rather state it than let it be discovered.

Questions

What do I get if I win?

EchelonGraph free for the tenant you nominate, covering the tiers and features generally available on 20 August 2026, at the capacity limits published for those tiers on that date. The exact tier and feature matrix is published as the tier appendix at /challenge/appendix when entries open. Products, add-ons and separately priced modules built after that date are not included.

Who does the grant cover?

The legal entity that proved control of the scanned domain, and only that entity's estate. It does not extend to parent companies, subsidiaries, affiliates or sister companies however wholly owned, to other domains you own that were not scanned, to other brands or trading names, or to entities acquired after the grant is made. The grant is also non-transferable and does not survive an acquisition or change of control.

How many times can I enter?

One grant per domain. The domain must be your organisation's primary domain, resolve publicly, serve HTTPS and return a real application — a parked page, registrar holding page or bare redirect is not an eligible target. Where the first verified ownership proof arrives first, that claim takes precedence.

How long do I have to claim after a scan?

30 days from the completion of the scan you are claiming against. Scans are free and instantly repeatable, so if you miss the window you can run a new scan and claim against that one instead.

Can you withdraw a grant after you have made it?

No. We do not reserve a general right to withdraw a grant already made. What we do reserve is narrower and stated plainly: the grant covers what existed on the start date rather than everything we build later, and we may stop accepting new entries at any time. Entries already validated are honoured.

What happens if your scanner breaks during the challenge?

Entries pause automatically. A scanner that reports everything clean because it is broken would turn every scan into a payout claim, so the challenge suspends itself if our own canary stops discriminating, and this page says so rather than looking like an outage.

Who decides whether I have won?

A person, every time, with a written reason. Nothing is auto-rejected. Claims are adjudicated against a durable, content-hashed record of the scan as it stood — not against a re-run — so what you claimed on is what gets read.

What do you do with my scan data?

Scan and finding data are retained for 90 days on the free tier, which is what our privacy policy already commits to and three times the 30-day claim window. We need a contact email so we have a way to tell you the outcome.

Start with a scan.

It is free, it needs no account, and you can run it as many times as you like. If it comes back clean, the claim form is one click from the result.

Scan a domain

This page states the terms of the challenge. Where it describes what our scanner checks or how a claim is decided, those statements describe the system as built — see our privacy policy for how scan data is retained, and terms of service for everything else.