Terms of use

CRAFT offers an experimental diagnostic from an SBOM (CycloneDX or SPDX JSON): extraction of components, matching against public vulnerabilities, display of a table of items to investigate.

The service is provided without an account, without consideration and without a service-level commitment.

You must have the capacity to contract. If you act for an organisation, you warrant that you are authorised to do so.

The publisher may interrupt, limit or modify the prototype at any time, in particular in the event of abuse, maintenance or product evolution.

You upload only files whose content you are authorised to communicate. An SBOM may reveal a product’s architecture: you assume that choice.

It is prohibited to send secrets, credentials, health data, or any unlawful content. The actual processing of the file is described in what happens to your SBOM.

It is prohibited:

• to circumvent size, rate or origin limits;
• to attack, aggressively probe or saturate the service;
• to present the results as a certificate of conformity, an audit or a regulatory notification;
• to use CRAFT to provide third parties with a competing white-label service, without written agreement.

Results are indicative. They may be incomplete, outdated or erroneous. A vulnerability absent from the table is not proof of the absence of risk. A vulnerability present is not proof of exploitability in your product.

CRAFT constitutes neither legal advice, nor a determination of the scope of application of the Cyber Resilience Act, nor a notification to authorities.

To the extent permitted by law, the publisher is not liable for damage related to use of the prototype, unavailability, an analysis error or a decision taken on the basis of the results.

This clause will be reviewed by a lawyer before the first paying customer. It is not intended to exclude public-policy provisions applicable to consumers.

The processing of personal data is described in the privacy policy.

These terms are governed by French law. The competent court is determined according to the applicable rules, including those protecting consumers.

Publisher: CRAFT, Experimental prototype.