Terms of Service

Effective date: 28 October 2026

These terms are an agreement between 1001621100 Ontario Inc., an Ontario corporation operating as ShipAttest ("ShipAttest", "we") and the organisation that creates a ShipAttest workspace ("Customer", "you"). The person accepting them confirms that they may bind that organisation. If you only use the free command-line tool or GitHub Action, section 9 applies.

1. The service

ShipAttest is software that helps manufacturers meet obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It stores software bills of materials (SBOMs) for product releases, checks their components against public vulnerability sources, alerts you to actively exploited vulnerabilities, tracks the Article 14 reporting deadlines, drafts reports and documents, and keeps an audit trail.

2. Not legal advice; your responsibilities

  • •ShipAttest is a tool. It does not give legal advice, does not certify products, and does not submit anything to ENISA, CSIRTs or market surveillance authorities on your behalf.
  • •You remain responsible for complying with the Cyber Resilience Act and other laws, including deciding whether a vulnerability or incident is reportable, the content and timing of every notification, and conformity assessment.
  • •Vulnerability information comes from third-party sources (OSV, CISA's Known Exploited Vulnerabilities catalogue and ENISA's EU Vulnerability Database). They can be incomplete, late or wrong, and ShipAttest only knows the components in the SBOMs you upload. We do not guarantee that every vulnerability or exploitation is detected, or that alerts arrive within any reporting deadline.
  • •AI-generated suggestions and draft texts can be wrong. Review them before relying on them.

3. Accounts

  • •Give accurate information, and keep passwords, recovery codes and API tokens secret. You are responsible for activity under your workspace's accounts and tokens.
  • •Tell us promptly at dan@shipattest.com if you suspect unauthorised access.
  • •Workspace owners and admins decide who has access and can remove members.

4. Acceptable use

You must not use the service to break the law or infringe anyone's rights; upload malware, or content you have no right to upload; try to access other customers' data, or probe, scan or test the service's security without our written permission; overload the service or get around its limits; or resell the service without our agreement.

5. Your content

  • •"Customer Content" is what you or your users upload or create in the service, such as SBOMs, product details, code excerpts, decisions, report drafts and documents. You keep all rights to it.
  • •You let us host, process and display Customer Content as needed to provide and secure the service. This includes sending component identifiers to vulnerability databases and, when a user starts an AI feature, sending the relevant content to our AI provider.
  • •We process personal data in Customer Content as your processor under the Data Processing Agreement, which forms part of these terms.
  • •You are responsible for having the right to upload Customer Content.

6. Plans, fees and payment

  • •The Free plan costs nothing. We may change or end it with reasonable notice.
  • •Paid plans are billed in advance through our payment provider, Stripe, at the prices shown when you subscribe, plus applicable taxes. Subscriptions renew automatically until cancelled.
  • •You can cancel at any time under Billing; the plan stays active until the end of the paid period. Fees already paid are not refunded, except where the law requires.
  • •We may change prices with at least 30 days' notice, effective from your next billing period.
  • •If a payment fails, we may move the workspace to the Free plan after telling you.

7. Availability and changes

We work to keep the service available and secure, but there is no guaranteed uptime unless agreed in writing. We may change or improve features. We will not remove a core feature of a paid plan during a period you have paid for without refunding the rest of that period.

8. Security and confidentiality

We protect Customer Content with the measures described in the Data Processing Agreement and keep it confidential. We disclose it only to our personnel and sub-processors who need it to run the service, or where the law requires; in that case we tell you first unless the law forbids it.

9. The free command-line tool and GitHub Action

The ShipAttest CLI and GitHub Action are open source under the Apache License 2.0, which governs their use. Scans run on your own machine. The CLI sends component identifiers to OSV.dev and downloads public catalogues, and sends data to ShipAttest only when you run the upload command with an API token.

10. Suspension and termination

  • •You may stop using the service at any time and ask us at dan@shipattest.com to delete your workspace.
  • •We may suspend access where needed to prevent harm to the service or others, or for a serious breach of these terms, and will tell you why. Either party may end these terms for a material breach that is not fixed within 30 days of notice.
  • •After termination we delete Customer Content as described in the Data Processing Agreement. Before then you can export SBOMs, VEX documents, generated documents and the audit trail.

11. Warranties

The service is provided "as is" and "as available". To the extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

12. Limitation of liability

  • •Neither party is liable for indirect, incidental, special or consequential damages, for lost profits, revenue or data, or for fines or penalties imposed on the other party by any authority.
  • •Each party's total liability under these terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim, or EUR 100 if you only use the Free plan.
  • •These limits do not apply where the law does not allow liability to be limited, such as for fraud, gross negligence or wilful misconduct.

13. Changes to these terms

We may update these terms. For material changes we will email workspace owners at least 30 days before they take effect. Using the service after that date means you accept the updated terms.

14. General

  • •These terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, and the courts of the Province of Ontario sitting in Ottawa have exclusive jurisdiction, unless mandatory law gives you the right to sue elsewhere.
  • •Neither party may transfer these terms without the other's consent, except to an affiliate or to a successor of its business.
  • •If a provision is unenforceable, the rest stays in effect. Not enforcing a right is not a waiver of it.
  • •These terms, the Data Processing Agreement and any signed order form are the entire agreement on their subject.
  • •Contact: dan@shipattest.com.