What this promises, and what it doesn’t

The agreement

By using sbomtriage, you accept these terms. Creating an account, or continuing past sign-in, means you accept them too. If you’re using it for an employer, you’re confirming that you may agree to them on your employer’s behalf.

The service is intended for business and professional use. You must be 18 or over to use it.

If you use the service for an organisation, the data processing terms form part of this agreement.

This deployment hasn’t declared an operating entity. Until it does, treat it as a pre-release instance run by an individual, not a company.

What the analysis is, and isn’t

sbomtriage matches the components you declare against published vulnerability data and ranks what it finds. That’s all it does, and the limits are real:

• It does not tell you whether vulnerable code is reachable or exploitable in your product. It has never seen your product, only a list of what you say is in it.
• A result is only as complete as the file you gave it. Components with no package identifier can’t be checked. They’re reported as unchecked and never described as safe.
• Advisory data comes from third parties, mainly OSV.dev. Anything published minutes ago, or in an ecosystem they don’t cover, won’t appear.
• A ranking is a recommendation about where to start. It isn’t a professional security assessment, a penetration test, an audit, or legal advice.
• Nothing here makes you compliant with the Cyber Resilience Act or anything else. The CRA material drafts wording for documentation you write and remain responsible for.

You stay responsible for security decisions about your own software. Don’t treat a clean report as proof that anything is safe.

Early access

The service is free while it’s in early access. Early access is granted in exchange for the profile answers you give. Agreeing to be contacted is optional and isn’t a condition of it. There’s no charge, no card on file and nothing to cancel.

• Features may change or be withdrawn. Email and Slack alerts only work where the operator has switched them on.
• Paid plans may arrive later. You’ll be told well in advance, and no payment can be taken from an account with no payment method on it.
• There’s no uptime commitment and no support commitment during early access. Both are best effort, from a small operation.

Using it fairly

• Upload inventories you’re entitled to analyse. A vendor SBOM you received is fine. Something you obtained without permission isn’t.
• When you upload a supplier’s SBOM, you confirm that doing so doesn’t breach any confidentiality obligation you owe.
• You may not use the service if you are subject to, or located in a country or region subject to, comprehensive EU, UN or US sanctions.
• Don’t use it to attack anybody, or to find targets to attack.
• Don’t try to access another account’s data, and don’t work around the limits or the rate limits.
• Don’t resell the service or pass it off as your own.
• Automated access is welcome through the documented CI client and the API, but scraping the interface isn’t.

Accounts that break these rules can be restricted or suspended, without advance notice where that’s needed. When the operator restricts or suspends an account, it sends the account holder a statement of the reasons, unless the law or the security of the service requires otherwise. Given the size of the operation, that’s likely to come as an email from a person, not an automated process.

Your content

What you upload stays yours. You grant only the permission needed to run the service: to read the file, extract the inventory, analyse it and show you the result. We claim no ownership, and the files themselves are never stored.

If you share a report or an export with someone else, you’re responsible for how it’s used. The operator owes no duty to anyone you share it with.

If you send ideas or feedback, the operator may use them freely, without any obligation to you.

No warranty, and the limit of liability

The service is provided as it is, with no warranty of any kind, express or implied, including fitness for a particular purpose and non-infringement. There’s no warranty that it will be uninterrupted or error-free, or that it will find every vulnerability in anything.

To the fullest extent the law allows, the operator is not liable for indirect, incidental, special, or consequential loss, including lost profits, lost data, or security incidents, arising from your use of the service. Otherwise, the operator’s total liability is limited to the greater of the amount you paid in the twelve months before the claim and €100.

Nothing in these terms limits or excludes liability for intent or gross negligence, for death or personal injury caused by negligence, for fraud, or for anything else that can’t lawfully be limited or excluded. If you’re a consumer, your statutory rights are unaffected.

Ending it

You can delete your account at any time, which removes everything we hold (backups kept by the database provider expire on its own schedule). The operator may withdraw the service, giving notice where it’s practical to do so.

Transfer of the agreement

The operator may transfer this agreement, and your account, to a company it controls or to a successor to the service. You’ll be told when that happens.

Changes, and the law that applies

These terms may change. Material changes will be announced at least 30 days before they take effect, on this page with a new date at the top and by email if you’ve given us one. If you don’t accept a change, you can delete your account before it takes effect. If you keep using the service after that, you accept the change.

Until an operating entity is declared, no governing law is declared either. That gap needs filling before the service is offered publicly.