Legal
Last updated: 23 September 2026
These Terms of Service (the “Terms”) govern your access to and use of Cravault (the “Service”), operated by [Operator legal entity — to be confirmed] (“Cravault”, “we”, “us”). By creating an account or using the Service you agree to these Terms. If you are using the Service on behalf of an organisation, you represent that you are authorised to bind that organisation.
Cravault monitors the software bills of materials (SBOMs) of your released products against public vulnerability data (such as CISA KEV, ENISA EUVD, OSV and EPSS), raises alerts when a component you ship is actively exploited, and generates draft reports, advisories and machine-readable exports to help you meet EU Cyber Resilience Act (CRA) Article 14 obligations.
Cravault is a tool, not a law firm or a filing agent. The materials it produces are drafts for your review. AI-generated narrative fields must be reviewed before use, and every fact is marked with its source. You are solely responsible for deciding what to submit, when and to whom, and for the accuracy and completeness of any regulatory filing. Nothing in the Service constitutes legal advice or a guarantee of compliance with the CRA or any other law.
You must provide accurate account information and keep your credentials and ingest tokens secure. You are responsible for all activity under your account and organisation. The Service is intended for business use and for users aged 16 or older. You may not share access in violation of your plan’s limits.
You retain all rights to the data you provide. Cravault ingests only the SBOM — the list of components and versions — never your source code. You grant us a limited licence to process, store and transform that data solely to provide the Service (monitoring, matching, generating documents, and retaining evidence). Our handling of personal data is described in the Privacy Policy.
You agree not to misuse the Service, including: attempting to breach or probe security without authorisation (see our disclosure policy instead), uploading unlawful content or data you have no right to share, disrupting the Service, reselling it without permission, or using it to violate the rights of others.
Paid plans are billed per product on a recurring basis. Payments are processed by Paddle as Merchant of Record — Paddle is the seller of record and issues your invoices and handles applicable taxes. Paid plans include a 14-day trial. Fees, cancellation and refunds are described in the Refund & Cancellation Policy.
We work to keep the Service available but do not guarantee uninterrupted operation. We may add, change or remove features. The Service depends on third-party vulnerability feeds and providers whose availability we do not control.
The Service is provided “as is” and “as available”, without warranties of any kind to the maximum extent permitted by law, including fitness for a particular purpose and that detection or generated documents will be complete, accurate or sufficient for any regulatory purpose.
To the maximum extent permitted by law, Cravault will not be liable for indirect, incidental, special or consequential damages, or for regulatory fines, lost profits or lost data. Our total liability for any claim relating to the Service is limited to the amount you paid us in the 12 months before the claim. Nothing limits liability that cannot be limited by law.
You may stop using the Service and cancel at any time. We may suspend or terminate access for breach of these Terms or non-payment. On termination you can export your data; the post-cancellation lifecycle (read-only period, optional Archive plan, deletion) is described in the Trust page.
We may update these Terms; we’ll post the revised version here and update the date above. Material changes will be communicated where reasonable. Continued use after changes take effect means you accept them.
These Terms are governed by [governing law / jurisdiction — to be confirmed], without regard to conflict-of-laws rules.
Questions about these Terms: hello@cravault.io.
See also the Privacy Policy and Refund & Cancellation Policy. Ready to start? Sign in.
