Terms of Service

1. Provider, scope and contract documents

1.1 Kernwatch is provided by Strandfors Oy, Teollisuuskatu 6, 64260 Kaskinen, Finland, Business ID 3542266-8, VAT number FI35422668, email info@kernwatch.com, phone +358 400 969396 (the "Provider", "we").

1.2 These Terms of Service (the "Terms") govern the use of the Kernwatch service, consisting of the web application, its interfaces (API) and the related public pages that it generates (the "Service"), by the business that creates or owns a Kernwatch workspace (the "Customer", "you").

1.3 The Service is offered exclusively to businesses, public bodies and other organisations acting for professional purposes. It is not offered to consumers. The person who accepts these Terms confirms that they act on behalf of the Customer and are authorised to bind it.

1.4 The Data Processing Agreement (the "DPA") is part of these Terms. By accepting these Terms, the Customer also concludes the DPA. The plan descriptions and prices on the pricing page at the time of ordering also form part of the contract. The Customer's own general terms and conditions do not apply, even if the Provider does not object to them.

1.5 Order of precedence: for the processing of personal data on the Customer's behalf, the DPA prevails; otherwise these Terms prevail over the pricing page.

2. Definitions

• Account: the personal login of one natural person to the Service.
• Workspace: the Customer's area in the Service, in which its products, releases, SBOMs, findings, reports, documents, contacts and members are kept. Each Workspace is separated from the Workspaces of other customers.
• User: a person with an Account who is a member of the Customer's Workspace, with one of the roles owner, admin, editor or viewer.
• Customer Data: all data that the Customer or its Users upload to or enter in the Workspace, and the results that the Service produces from it for the Customer (for example findings, triage decisions, report drafts and exports). Public vulnerability data from third-party sources is not Customer Data.
• Plan: the Free, Starter, Professional or Enterprise plan with the features and limits described on the pricing page and in the application.

3. Conclusion of the contract and Accounts

3.1 The contract is concluded when a person signs up for a new Workspace, accepts these Terms and confirms their email address with the code that the Service sends. A person who joins an existing Workspace through an invitation accepts these Terms for their own use of the Service; the contracting party for that Workspace remains the Customer that owns it.

3.2 Sign-up details must be accurate and kept up to date. Each Account is personal and may not be shared. Users must keep their passwords and the API keys the Customer creates confidential. The Customer is responsible for all use of the Service through its Users' Accounts and its API keys, and must inform the Provider without undue delay at info@kernwatch.com if it suspects unauthorised access.

3.3 The Workspace owner and admins manage members, roles, invitations, API keys, the Plan and billing. The Customer is responsible for giving Users only the roles they need and for removing Users who should no longer have access.

4. The Service

4.1 Depending on the Plan, the Service includes: management of SBOMs (software bills of materials) per product and release; monitoring of the components against public vulnerability sources (OSV, the CISA Known Exploited Vulnerabilities catalogue and the ENISA EU Vulnerability Database); triage of findings and VEX statements; a CRA reporting workflow with drafts, deadlines, sign-off and a record of the filing; an action inbox; a public vulnerability reporting (disclosure) page; published advisories including CSAF; technical documentation and the EU declaration of conformity; and contacts and user notices. The features and limits of each Plan are described on the pricing page and in the application.

4.2 Reporting to authorities. Kernwatch prepares drafts of notifications and keeps the deadlines and a record of what was filed. It has no connection to ENISA's single reporting platform or to any other authority and does not submit notifications. The Customer submits every notification itself and records the filing in the Service.

4.3 Notices to the Customer's customers and users. The Service sends a notice to the Customer's contacts only after the Customer has approved it in the Service. The Customer is responsible for the content, the recipients and its legal basis for contacting them.

4.4 Third-party vulnerability data. Vulnerability information comes from third-party sources and may be incomplete, delayed or incorrect. Whether a vulnerability is matched to a component depends on the quality of the SBOM, in particular the component identifiers. Checks run at the interval of the Plan (weekly on the Free plan, daily on paid Plans). The Provider does not guarantee that every relevant vulnerability is found, or that scores, exploitation status and other classifications taken from these sources are correct.

4.5 No legal advice. The Service is a tool. Information about the Cyber Resilience Act on the website and in the application is general information, not legal advice. The Customer remains solely responsible for complying with the Cyber Resilience Act and other laws, including its triage decisions and VEX statements, its assessments of risk and severity, meeting deadlines, the content and submission of notifications to ENISA, CSIRTs, market surveillance or other authorities, and everything it publishes through the Service (disclosure page, advisories, declarations of conformity).

4.6 Development and early access. The Service is in early access and is developed further continuously. The Provider may change, add or remove features, provided that the essential features of a paid Plan are not materially reduced during a period the Customer has already paid for. Material reductions are announced as described in section 17.

4.7 Availability. The Provider operates the Service with reasonable care and aims for high availability, but does not commit to a specific availability level unless agreed separately in writing. Maintenance that interrupts the Service is announced in advance where possible.

5. Plans, trial and prices

5.1 The Plans and their monthly prices (excluding VAT) are:

The further features of each Plan are described on the pricing page and in the application. The prices are early-access prices.

5.2 Trial. A paid Plan chosen at sign-up starts with a free trial of 14 days. No payment card is needed for the trial. If the Customer pays by card during the trial, charging normally starts when the trial ends. If the trial ends without payment, nothing is charged and the Workspace becomes read-only (section 7.1).

5.3 Prices and taxes. Prices are in euros and exclude VAT. VAT and other taxes are added at checkout in accordance with applicable law.

5.4 Payment. Paid Plans are paid by card through Stripe Checkout, in advance for each billing period. The billing period is currently one month. The subscription renews automatically at the end of each billing period until it is cancelled. Card details are processed by the payment provider Stripe; the Provider does not receive or store card numbers. Invoices and receipts, the payment card and the subscription can be managed in the customer portal (Settings > Plan and billing > Manage subscription).

5.5 Changing Plans. The Workspace owner or an admin can move to another Plan at any time. Changes to a running subscription are made in the customer portal, which shows any price difference before the change is confirmed. The limits and features of the new Plan apply from the moment it takes effect.

5.6 Late payment. If a renewal payment fails, the payment provider may retry it. If the paid period ends and no payment has been received within 3 days, the Workspace becomes read-only (section 7.1).

6. Term, cancellation and termination

6.1 The contract runs for an indefinite period until it is terminated.

6.2 Cancelling a paid Plan. The Customer can cancel a paid subscription at any time in the customer portal or by email to info@kernwatch.com. The cancellation takes effect at the end of the current billing period; the paid Plan remains available until then. Fees already paid are not refunded, except as provided in section 13.3 or where mandatory law requires otherwise. After the end of the period, the Workspace becomes read-only until the owner pays again or switches to the Free plan.

6.3 Ending the contract. The Customer can end the contract at any time by email to info@kernwatch.com, or with a function in the Service where available; a running paid subscription ends as described in section 6.2. The Provider can end the contract for the Free plan with 30 days' notice, and for a paid Plan with 30 days' notice to the end of a billing period.

6.4 Termination for cause. Either party may terminate the contract with immediate effect if the other party materially breaches these Terms and does not remedy the breach within 14 days of a written notice, or if the other party becomes insolvent or enters bankruptcy or liquidation proceedings.

6.5 What happens to the Customer Data when the contract ends is set out in section 12.

7. Read-only mode and suspension

7.1 Read-only mode. When a trial ends without payment, or when a paid period has ended and no payment has been received within 3 days, the Workspace becomes read-only: the Customer Data is kept and remains visible, but no new changes can be made. The Workspace owner can end the read-only mode at any time by paying for a Plan or by switching to the Free plan.

7.2 Suspension. The Provider may suspend access to the Service in whole or in part if (a) the Customer uses the Service in breach of section 8 or of the law, (b) this is necessary to avert a security risk to the Service, to the Provider or to other customers, or (c) an authority or court requires it. The Provider limits the suspension to what is necessary, informs the Customer without undue delay, stating the reason where permitted, and lifts the suspension once the reason no longer applies.

8. Acceptable use

8.1 The Customer and its Users may use the Service only for lawful purposes and in accordance with these Terms. In particular they may not:

• attempt to access other customers' Workspaces or data, or to bypass access controls, Plan limits or rate limits;
• upload malware, or use the Service to attack, overload or scan other systems;
• test the security or load of the Service without the Provider's prior written consent (vulnerabilities in Kernwatch itself can be reported to info@kernwatch.com);
• resell the Service or make it available to third parties outside the Customer's organisation, except as Users of its Workspace, unless agreed in writing;
• publish through the Service content that infringes the rights of others or is unlawful.

8.2 The Customer is responsible for the Customer Data, including having the necessary rights to it, and for only entering personal data that it needs for its CRA work. The Service is not intended for special categories of personal data (Art. 9 GDPR); the Customer must not enter such data.

9. Customer Data and intellectual property

9.1 The Customer retains all rights to the Customer Data. It grants the Provider a non-exclusive right, limited to the term of the contract and the deletion period in section 12, to store and otherwise process the Customer Data only as far as necessary to provide, secure and support the Service and to comply with legal obligations.

9.2 All rights to the Service, its software, design and documentation remain with the Provider. For the term of the contract, the Customer receives a non-exclusive, non-transferable right to use the Service for its own business purposes in accordance with its Plan.

9.3 Content that the Customer publishes through the Service (for example its disclosure page, security.txt, advisories and CSAF documents, or documents shared by link) is published on the Customer's instruction and under its responsibility.

9.4 Public vulnerability data used by the Service remains subject to the terms of its sources.

9.5 The Provider may use suggestions and feedback about the Service freely and without obligation.

10. Data protection and security

10.1 The Provider processes the personal data of Account holders for sign-up, login, billing and communication about the Service as a controller, as described in the privacy policy.

10.2 Personal data in the Customer's Workspace is processed by the Provider on the Customer's behalf as a processor under the DPA. The technical and organisational measures are described in Annex 2 of the DPA.

10.3 To check for vulnerabilities, the Service sends public vulnerability sources only identifiers of software components or vulnerabilities (such as package URLs, versions and CVE identifiers) - never personal data or the names of the Customer, its Workspace or its products.

11. Confidentiality

11.1 Each party keeps confidential the non-public information of the other party that it receives in connection with the contract, uses it only for the purposes of the contract and protects it with at least reasonable care. The Customer Data is confidential information of the Customer.

11.2 This does not apply to information that is or becomes publicly available without breach of this obligation, that the receiving party already had or developed independently, or that must be disclosed by law or by order of an authority or court; in the last case the disclosing party informs the other party where permitted. The obligation continues for three years after the end of the contract, and for Customer Data for as long as the Provider holds it.

12. Data at the end of the contract

12.1 Before the contract ends, the Customer can export Customer Data with the export functions of its Plan (for example SBOMs in CycloneDX format with VEX, and CSAF advisories). On request made before the end of the contract, the Provider provides the Customer Data in a common machine-readable format within 30 days.

12.2 The Provider deletes the Customer Data 7 days after the contract ends, unless the Customer has asked for its data under section 12.1 and has not yet received it, or the law requires the Provider to keep it. Records that the Provider must keep under accounting and tax law (for example invoices and payment records) are kept for the period required by law.

13. Warranty

13.1 The Provider provides the Service with reasonable care and skill and essentially as described in section 4 and on the pricing page.

13.2 The Free plan and trials are provided "as is", without any warranty, to the extent permitted by law.

13.3 The Customer should report defects to info@kernwatch.com. The Provider remedies material defects of a paid Plan within a reasonable time. If the Provider fails to remedy a material defect within a reasonable time after notice, the Customer may terminate the paid subscription and receives a refund of fees paid in advance for the period after the termination.

13.4 The Provider does not warrant that the Service finds every vulnerability, that the Customer's products or processes comply with the Cyber Resilience Act, or that authorities accept the Customer's notifications or documentation.

14. Liability

14.1 The Provider's total liability arising out of or in connection with the contract, including the DPA, is limited to the fees the Customer paid for the Service in the 12 months before the event giving rise to the claim. For the Free plan and trials, the Provider's liability is excluded to the extent permitted by law.

14.2 The Provider is not liable for indirect or consequential damage, including loss of profit, revenue or business, interruption of business, loss or corruption of data, fines or sanctions imposed on the Customer, or claims of third parties.

14.3 The limitations in sections 14.1 and 14.2 do not apply to damage caused intentionally or through gross negligence, or where liability cannot be limited under mandatory law. The liability of the parties towards data subjects under Art. 82 GDPR is not affected.

14.4 The Customer indemnifies the Provider against claims of third parties arising from the Customer Data, from content the Customer publishes through the Service, or from the Customer's use of the Service in breach of these Terms or of the law.

15. Force majeure

Neither party is liable for delay or failure caused by circumstances beyond its reasonable control that it could not reasonably have foreseen or avoided, such as natural disasters, war, pandemics, actions of authorities, general failures of the electricity supply or telecommunications networks, or failures of the systems of third-party providers on which the Service depends. Payment obligations are not affected.

16. Subcontractors

The Provider may use subcontractors to provide the Service and remains responsible for them as for its own performance. Subcontractors that process personal data on the Customer's behalf (sub-processors) are subject to the DPA and listed in its Annex 3.

17. Changes to these Terms and to prices

17.1 The Provider may change these Terms, the DPA and the prices. Changes are announced by email to the owners of Workspaces with a paid Plan at least 30 days before they take effect, and are published on this website; the announcement states the changes and the date they take effect. A price change applies to a running subscription from the first billing period that starts after that date.

17.2 If the Customer does not accept a change, it can cancel or end the contract before the change takes effect. If the Customer continues to use the Service after the change has taken effect, it accepts the change.

17.3 Changes that are required by law or by an authority, or that are only in the Customer's favour (such as new features or lower prices), may take effect earlier.

18. Final provisions

18.1 Notices. The Provider sends notices to the email address of the Workspace owner. The Customer sends notices to info@kernwatch.com. Email satisfies any written form required by these Terms.

18.2 Assignment. The Customer may assign the contract only with the Provider's consent. The Provider may assign the contract to a successor of its business or of the Service, informing the Customer in advance.

18.3 Language. These Terms and the DPA are drawn up in English. Any translation is for information only; the English version applies.

18.4 Severability. If a provision of these Terms is or becomes invalid, the other provisions remain valid. The parties replace the invalid provision with a valid one that comes as close as possible to its purpose.

18.5 Entire agreement. These Terms, the DPA and the pricing page at the time of ordering form the entire agreement on the Service, unless the parties have agreed otherwise in writing.

19. Governing law and disputes

19.1 The contract is governed by the laws of Finland, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

19.2 The parties will first try to settle disputes by negotiation. Disputes that cannot be settled are decided by the District Court of Ostrobothnia (Pohjanmaan käräjäoikeus) in Finland as the court of first instance.

20. Contact

Strandfors Oy (Kernwatch), Teollisuuskatu 6, 64260 Kaskinen, Finland · info@kernwatch.com · +358 400 969396