Terms of service

Please read these terms carefully, in particular sections 4 (what the service does not do), 6 to 9 (what its results are, the reporting clock, expert reviews and monitoring), 22 (warranties), 23 (limitation of liability) and 24 (your indemnity). They form a contract between you and us.

1. Who we are and who these terms apply to

1.1. Provetry (the “service”) is operated by Securissima, Kenmare, Ireland (“we”, “us”). These terms, together with the plan you choose and our privacy policy, are the whole agreement for your use of the service.

1.2. The service is provided only to businesses and professionals, for purposes relating to their trade, business or profession. It is not offered to consumers. By creating an account you confirm that you are not acting as a consumer.

1.3. If you accept these terms on behalf of an organisation, you confirm that you have the authority to bind it, and “you” means that organisation. You must be at least 18 years old.

1.4. You accept these terms when you create an account, start a trial or a paid plan, order an audit or an add-on, or use the service, whichever comes first.

2. Definitions

“CRA” means Regulation (EU) 2024/2847, the Cyber Resilience Act. “Workspace” means the account space in which your products, members and data are kept. “Product” means a product you describe in the service, and “release” one of its versions. “SBOM” means a software bill of materials. “Output” means any result produced by the service: SBOMs, component lists, vulnerability findings, scores, reachability results, exploitation status, readiness and scope results, reporting clocks, drafts of reports to authorities, documentation, conformity reports, disclosure policies, advisories, security packs, answers to questionnaires, audit reports, alerts and exports. “Your data” means the information you put into the service and the outputs produced for your workspace. “Integration” means a connection between the service and a third-party service (for example a code host, a continuous integration system, a ticket tracker or a messaging tool).

3. The service

3.1. The service helps manufacturers, importers and distributors of products with digital elements prepare for their obligations under the CRA. It builds SBOMs from the files you provide, checks the components they list against public vulnerability data, follows which vulnerabilities are known to be exploited, counts down the reporting deadlines of Article 14 of the CRA, and prepares drafts and documents for you to complete, check and use.

3.2. The features available depend on your plan, as described on the pricing page at the time you subscribe. The free check, the free tools and the guides on our website, and the free SBOM alerts, are provided without charge and may be limited, changed or withdrawn at any time; sections 4, 6, 22, 23 and 26 apply to them too.

4. What the service does not do

4.1. The service is a tool. It does not give legal advice, and it does not tell you whether you are a manufacturer, an importer or a distributor, which category a product belongs to, or which obligations apply to you; its scope and class check is an indication based on your answers. For questions of law, consult your own lawyer.

4.2. The service never submits anything to ENISA, a CSIRT, a market surveillance authority or any other authority on your behalf. You decide whether a vulnerability is actively exploited or an incident is severe, whether and when to report it, and what you report.

4.3. The service is not a notified body and does not carry out a conformity assessment. Its outputs do not show that a product meets the essential requirements of the CRA, do not entitle you to affix the CE marking, and do not replace an EU declaration of conformity drawn up and signed by you.

4.4. You remain solely responsible for your products, for their security, for your vulnerability handling, for your technical documentation, for your conformity assessment, and for everything you submit to an authority, publish or send to a customer.

5. Your account

5.1. You must give accurate information and keep it up to date. You are responsible for keeping your credentials, second factor, passkeys and API keys secret, for the members you invite and the roles you give them, and for everything done under your account.

5.2. Tell us at once at security@provetry.com if you believe your account has been compromised. We are not liable for loss caused by the use of your credentials or keys by anyone else, unless it results from our own breach of these terms.

6. What outputs are, and what they are not

6.1. Outputs depend on what you give the service. An SBOM lists only the components the service could read in the files you provided (lock files, manifests, container images, firmware or SBOMs made by other tools); components that are vendored, statically linked, copied into your code or missing from those files may not appear.

6.2. Vulnerability findings, severities, scores (such as CVSS and EPSS), fixed versions, end-of-support dates and exploitation status come from public sources run by others, such as OSV.dev, the CISA Known Exploited Vulnerabilities catalogue, the ENISA European Vulnerability Database, FIRST and endoflife.date. They can be incomplete, late or wrong, and a vulnerability can be exploited long before any source says so.

6.3. Reachability results (whether your code loads or calls a vulnerable package or function) are computed by our own analysis of the code you provide. They can miss a call or report one that does not happen. A suggestion that a vulnerability does not affect your product is only a suggestion: the decision, and any statement you publish about it (for example in a VEX document or an advisory), are yours.

6.4. Readiness views, scores and checklists show how the information in your workspace relates to some requirements of the CRA. They are indicators computed by our own method, which we may change, and not an assessment of compliance.

6.5. Drafts of reports, documentation, conformity reports, disclosure policies, advisories, security packs and answers to questionnaires are prepared from what your workspace holds and from general texts. You must check, complete and correct them before you use, sign, publish or send them.

6.6. An output describes the information available at the time it was produced. It is not a guarantee, warranty or certification that a product is secure, free of vulnerabilities or compliant with any law or standard, and it is not a substitute for your own security work, a penetration test or professional advice.

6.7. You remain solely responsible for every decision you take, or do not take, on the basis of an output.

7. The reporting clock

7.1. The reporting clock counts down the deadlines of Article 14 of the CRA from the moment you enter as the one at which you became aware of an actively exploited vulnerability or a severe incident. Under the CRA, the deadlines run from your awareness, whether or not you used the service, and whether or not the service flagged anything.

7.2. Reminders and alerts are sent on a best-efforts basis. We do not guarantee that a reminder or an alert will be sent, delivered or received within any given time, or at all. The service must not be your only means of meeting a legal deadline.

8. Expert reviews: the CRA readiness audit and the Reviewed reports add-on

8.1. The CRA readiness audit is a gap report for one product, produced by the service from what your workspace holds for that product, then reviewed and signed off by a certified security professional before it is sent to you, usually within ten working days of the order. It is ordered and paid once, at the price shown when you order (€790 per product excluding VAT at the date of these terms), and the work starts on payment, at your request. If something is missing to produce it, we write to you, and the time to deliver runs again from your answer.

8.2. With the Reviewed reports add-on, paid monthly, each draft report to ENISA that you send for review is read and corrected by a certified security professional before you send it. Alerts and the reporting clock never wait for this review. If a review is not back in time for a legal deadline, you must submit your report yourself on time; the add-on does not move any deadline. The add-on ends when your paid plan ends.

8.3. Reviews are carried out with reasonable skill and care, on the information available in your workspace at the time and on what you tell us. They are a professional review of security evidence. They are not legal advice, an assessment by a notified body, a certification or an attestation of conformity, and section 4 applies to them.

8.4. An audit report is provided to you only. Section 10.2 applies to it.

9. Monitoring and alerts

9.1. Monitoring works on a best-efforts basis, at the frequency of your plan (every day on the paid plans, which are also alerted when new vulnerability records are published; every week on the free plan). A check can be incomplete when a source does not answer; the service says so and tries again. We do not guarantee that a vulnerability or an exploitation will be detected, nor that an alert will be sent, delivered or received within any given time, or at all.

9.2. The service is not designed to be your only means of detecting vulnerabilities or incidents, and must not be used as such where a failure could cause serious harm.

10. Shared documents, public pages and evidence

10.1. You decide what you publish or share through the service: security packs and their links, public pages, advisories, disclosure policies, security.txt files, conformity reports, VEX documents and answers to questionnaires. You are solely responsible for their content and for keeping them up to date. We may remove content that is unlawful or that infringes the rights of others.

10.2. No reliance by third parties. We provide outputs to you only. We accept no duty of care and no liability towards any buyer, customer, distributor, importer, authority, notified body, insurer, investor or other third party who receives or sees them, and you must not suggest otherwise. If a third party makes a claim against us based on such a document, section 24 applies.

10.3. The evidence journal records dated events in your workspace, and may be countersigned by an independent time-stamping authority. We take reasonable care to keep it intact, but we do not guarantee how a court or an authority will weigh it, nor the availability of the time-stamping authority, which is run by others.

11. Third-party services and your keys

11.1. Integrations depend on third-party services that we do not control, and on the tokens or keys you provide (for example a token for a private repository, a ticket tracker or a messaging webhook). Their terms apply between you and them. You are responsible for the access and permissions you give, and for revoking them when you stop using an integration.

11.2. The service relies on public data sets and services run by others (section 6.2). We are not responsible for their accuracy, availability or terms, and we may stop using any of them or use others.

12. Consultants and their clients

12.1. If you use the service for your own clients (for example on the Consultant plan), you are solely responsible to them: for having their permission to put their products and data into the service, for what you tell them, for how you present outputs (including under your own logo) and for the services you sell them. Your clients have no contract with us and no right against us.

12.2. You must not resell access to the service itself, or let anyone outside your organisation or your clients' workspaces use your account.

13. Plans, payment and cancellation

13.1. Paid plans are billed in advance, monthly or yearly, in euros. Prices exclude VAT, which is added where it applies. If you give a valid VAT number, the reverse-charge rules may apply, and you are responsible for its accuracy.

13.2. Plans are paid by card or SEPA direct debit. A business on a yearly plan may instead pay by bank transfer on invoice, within 30 days of the invoice date. If an invoice remains unpaid after its due date, the paid plan is suspended until it is paid, and we may end it 30 days after the due date.

13.3. Plans renew automatically for the same period until cancelled. You may cancel at any time from your account: the plan stays active until the end of the paid period. Fees already paid are not refunded, in whole or in part, except where these terms or the law provide otherwise.

13.4. If a payment fails and is not settled after the reminders, we may move your workspace to the free plan, pause the features it no longer includes, or suspend it. Nothing is deleted at that stage.

13.5. We may change prices with at least 30 days' notice by e-mail. A new price applies from your next renewal after the notice period; if you do not accept it, you may cancel before that renewal.

13.6. Payments are processed by a payment provider. We do not store your card or bank details.

13.7. Trial. A workspace on the free plan may try the Pro plan once, for 14 days, free of charge and without payment details; each person can start only one trial. No contract for a paid plan arises from the trial. At its end, unless you have subscribed to a plan, the workspace returns to the free plan with its limits: your oldest product stays watched and the others are archived, without being deleted: an archived product is no longer watched, and its public pages and share links are paused; only the oldest owner remains a member of the workspace, the other members lose access to it, and their accounts are kept. You can end the trial early at any time.

13.8. Limits and storage. Each plan has limits, shown on the pricing page and in your account: products watched, releases kept per product, members, and room for the releases of your account (for example 100 MB on the free plan). When a limit is reached, the service refuses what would exceed it, such as a new release, until you make room (for example by deleting old releases) or choose a larger plan; nothing already stored is deleted because of it. To protect the service for every customer, it may also refuse new files for a while if its own storage runs short. Files you upload are read and then erased: the service keeps the SBOM it builds from them, not the files.

14. Acceptable use

You must not: break the law with the service; put into it code, data or files that you have no right to process, or malware; try to access other customers' data or to get around the plan limits, the rate limits or the security of the service; overload, probe, scan or attack the service itself (security research must follow our security policy); reverse engineer, copy or resell the hosted application; use the free SBOM alerts or the free tools to run a competing service or in bulk; send spam or misleading messages through it; or use outputs to mislead anyone, including an authority or a buyer.

15. Suspension and termination

15.1. We may suspend a workspace, immediately and without prior notice where needed, if you break these terms, if your use creates a risk for the service, for other customers or for third parties, or if we are required to by law. While a workspace is suspended, checks and alerts stop, nothing is deleted, and a paid subscription is set not to renew, so that no new billing period starts (an invoice already due may still be collected). When the suspension is lifted, the renewal is restored if the paid period is still running.

15.2. We may end these terms for a serious or repeated breach, with immediate effect, or for any reason with 60 days' notice. In the second case, we refund the unused part of a period you paid for in advance.

15.3. You may end these terms at any time by deleting your workspace. When the terms end, your access stops; we keep and delete your data as described in the privacy policy, and you may export it beforehand. A deleted workspace is erased for good 90 days later.

15.4. Sections 4, 6, 7, 8.3, 8.4, 10, 16, 17, 18 and 22 to 31 continue after these terms end.

16. Your data and ours

16.1. Your data remains yours, including your code, SBOMs and documents. You give us the right to host, process and display it as needed to provide, secure and improve the service.

16.2. We may use statistics drawn from the use of the service that are aggregated so that no customer, workspace, product or person can be identified. Public vulnerability data is not your data.

16.3. The service, its software, its method, its texts and its design belong to us or our licensors. These terms give you a limited, non-exclusive, non-transferable right to use the hosted service while you have an account. The open-source provetry-core tool is licensed separately under the AGPL-3.0; these terms do not restrict that licence.

16.4. If you send us suggestions or feedback, we may use them freely and without obligation.

17. Confidentiality

Each of us keeps confidential the non-public information received from the other in connection with the service, and uses it only for these terms, except where disclosure is required by law or the information becomes public through no fault of the recipient. The people who carry out expert reviews for us are bound by the same duty.

18. Data protection

Our privacy policy describes what we store and why. Where we process personal data on your behalf, we do so as your processor under a data processing agreement, available on request, and you are responsible for having a lawful basis for that processing.

19. Availability and changes to the service

19.1. We aim for continuous availability but do not guarantee it. The service may be interrupted for maintenance, updates, incidents, or reasons outside our control.

19.2. We may change, add or withdraw features. We will give reasonable notice before removing a feature that is central to a paid plan; if the change materially reduces what you paid for, you may cancel and we refund the unused part of the period paid in advance. If we withdraw the service entirely, we will give at least 60 days' notice and let you export your data.

19.3. Features marked as beta, preview or experimental are provided as they are, may change or stop without notice, and are excluded from any commitment.

20. Security

We protect the service and your data with measures appropriate to the risk, described on our security page and in our privacy policy. No system is perfectly secure, and we cannot guarantee that unauthorised access will never happen. We will tell you without undue delay of a personal data breach that affects your data, as the law requires.

21. Changes in the law

The CRA, its implementing and delegated acts, harmonised standards and the guidance of authorities may change or be clarified after an output was produced. Outputs follow the texts we know of at the time; we update the service in a reasonable time, but we do not guarantee that it reflects every change as soon as it is published.

22. Warranties

22.1. We will provide the service, and expert reviews, with reasonable skill and care. Apart from that, and to the fullest extent permitted by law, the service and all outputs are provided “as is” and “as available”, and all other warranties, conditions and terms, express or implied, including any as to merchantable quality, fitness for a particular purpose, accuracy, completeness, or uninterrupted or error-free operation, are excluded.

22.2. You acknowledge that you have not relied on any statement, promise or representation that is not set out in these terms, and that the exclusions and limits in these terms are fair and reasonable given the price of the service, the fact that its outputs depend on what you provide and on public sources run by others, and the fact that you control your own products.

23. Limitation of liability

23.1. What we do not limit. Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by law.

23.2. Losses we are not liable for. Subject to 23.1, we are not liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

• loss of profit, revenue, business, contracts, customers, goodwill or anticipated savings;
• loss or corruption of data, or the cost of restoring it;
• indirect, special or consequential loss;
• loss arising from a vulnerability, an exploitation, a security incident or any other harm affecting your products, your systems, your customers or their users, including one that an output did not detect, detected late, or described wrongly;
• loss arising from a report to an authority that was not made, made late or made wrongly, or from a decision about whether a vulnerability is exploited or an incident severe;
• fines, penalties or sanctions, corrective measures, withdrawals or recalls of products, the cost of regulatory proceedings, and increased insurance premiums or refused insurance cover;
• loss arising from an integration or a third-party service or data source (section 11), from a document you published or shared (section 10), or from a decision taken on the basis of an output;
• claims by third parties, including your clients, your buyers and anyone who received an output.

23.3. Our maximum liability. Subject to 23.1, our total liability arising out of or in connection with the service and these terms, for all claims together, is limited to the fees you actually paid us for the service in the twelve months before the event giving rise to the first claim. If you have paid nothing in that period, it is limited to €100.

23.4. These limits also apply to our contractors, to the professionals who carry out expert reviews for us and to anyone acting for us, who may rely on this section.

24. Your indemnity

You will indemnify us and hold us harmless against any claim, loss, liability, fine, cost and expense (including reasonable legal fees) arising from: your breach of these terms; code, data or files you put into the service without the right to do so; a report, statement, advisory, declaration or other document you submitted, published or sent; content you published through the service; the use of an output by you or by anyone to whom you gave it; or a claim by one of your clients or buyers.

25. Time limit for claims

To the extent permitted by law, any claim against us must be notified to us in writing within six months of the date on which you became aware, or ought reasonably to have become aware, of its grounds, and in any case no later than twelve months after the event giving rise to it.

26. Events outside our control

We are not liable for any failure or delay caused by events outside our reasonable control, including failures of hosting, network, DNS, e-mail or payment providers, of public vulnerability data sources, of time-stamping authorities, cyber attacks, power cuts, strikes, natural disasters, pandemics and acts of public authorities.

27. Transfer

We may transfer these terms, and all our rights and obligations under them, to a company we control or set up to carry on the service (including an Irish limited company formed for that purpose), or to a buyer of all or part of our business. We will tell you by e-mail; your rights under these terms are not reduced by the transfer. You may not transfer these terms without our written consent.

28. Changes to these terms

We may change these terms. We will notify you by e-mail at least 30 days before a material change takes effect. If you do not accept it, you may cancel before it takes effect, and we refund the unused part of a period paid in advance. Continued use after that date is acceptance. Changes needed for legal or security reasons may take effect sooner.

29. Notices

We send notices to the e-mail address of your workspace owner. You send notices to hello@provetry.com. A notice by e-mail is received when sent, unless the sender is told that it was not delivered.

30. Governing law and courts

These terms and any dispute or claim arising out of or in connection with them (including non-contractual ones) are governed by the laws of Ireland. The courts of Ireland have exclusive jurisdiction.

31. General

If any part of these terms is found invalid or unenforceable, it is limited to the extent necessary and the rest remains in force. A failure or delay to enforce a right is not a waiver of it. Nothing in these terms creates a partnership, agency or employment relationship, and no third party may enforce them. These terms are written in English; any translation is provided for information, and the English version prevails.

32. Contact

Securissima, Kenmare, Ireland — hello@provetry.com