Terms

Terms of service

The agreement under which Declara is provided. Two figures in it are for counsel to set and are marked as such; nothing else here is a placeholder.

1. Parties and acceptance

These terms are between the operator of Declara (“we”) and the organisation on whose behalf a workspace is created (“you”). The person who creates the workspace confirms that they are authorised to accept these terms for that organisation. They take effect when a workspace is created and apply to every member of it.

The legal entity providing the service is [entity to be named]. Until it is, no contract is formed on these terms, and the service is offered for evaluation.

2. The service, and what it is not

Declara keeps an inventory of what you ship, watches for components being actively exploited, computes the deadlines that follow from a decision you make, drafts the filings and keeps the record. It produces evidence, timelines and drafts.

It does not make you compliant, and it cannot. The manufacturer is the party responsible for reporting under Regulation (EU) 2024/2847, and that stays with you. It does not submit anything to any authority; a person you authorise does, on the authority’s own platform. Nothing in the service, on this site, or in any document it generates is legal advice.

3. Accounts, seats and access

You are responsible for who you invite and for what they do. Each plan carries a seat limit. Sign-in is by email link or single sign-on; a second factor is available to every account and may be required by a workspace owner. Keep API keys secret; a key is shown once and acts with the permissions you gave it.

4. Fees

Plans are monthly or annual, charged through Stripe, exclusive of VAT. The trial lasts 14 days and starts when an SBOM is first uploaded. The Readiness Pack is a one-time purchase. Prices are those on the pricing page at the time of purchase; we may change them with thirty days’ notice, and a change never applies to a period already paid for.

A failed payment gives 7 days of grace, during which the watch keeps running and reminders keep sending. After that the workspace becomes read-only until payment succeeds. Downgrading pauses products over the new limit rather than deleting them. Fees are not refundable except where the law requires.

5. Term and termination

The agreement runs for as long as you have a workspace. You may close it at any time from the settings; we may suspend or close it for non-payment after the grace period, or for a breach of section 7 that is not remedied within fourteen days of notice, or immediately where the breach is serious.

On closure you may export everything first. Working data is purged within thirty days. Case records and the audit chain are retained for seven years, because they are the evidence you may need to produce, as set out in the data processing agreement. An evidence pack already issued remains verifiable after closure.

6. Your data

It stays yours. You grant us the licence needed to run the service on it and no more. We process it as your processor under the data processing agreement, in the EU, with the sub-processors listed on the sub-processor page. We do not train models on it, sell it, or show one customer’s data to another.

7. Acceptable use

Use the service for your own products and those you are authorised to manage. Do not upload material you have no right to, attempt to reach another workspace’s data, probe or overload the service, or use it to send unsolicited mail. The free public tools are for checking your own products; automated bulk use of them is not permitted.

8. Availability and support

We run the service on infrastructure in the EU and monitor it continuously. Reminders are delivered at least once and de-duplicated. We do not promise an availability figure until there is a status page to show it against; when there is, it will be stated here. If the service is unavailable, your obligation does not pause, which is why every deadline is also visible in the evidence you can export, and why the record is designed to be verifiable without us.

9. Accuracy, warranties and disclaimer

Deadlines and scope verdicts are computed from the text of the Regulation and cited beside every rule so you can check them rather than trust them. Advisory data comes from public feeds, which are themselves incomplete: a component absent from them is not proof it is safe. Where a version cannot be compared with confidence, the service says so rather than guessing.

Beyond what this section states and what the law does not allow us to exclude, the service is provided as it is. We do not warrant that it is error-free, that it will detect every exploited vulnerability, or that a filing prepared with it will be accepted by any authority.

10. Limitation of liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.

Subject to that, neither party is liable to the other for indirect or consequential loss, loss of profit, loss of business, or for any fine or penalty imposed on you by an authority. Our total liability to you under or in connection with these terms, in any twelve-month period, is limited to [liability cap to be set by counsel].

11. Indemnity

You indemnify us against third-party claims arising from material you upload that you had no right to upload, or from your use of the service in breach of section 7.

12. Governing law and jurisdiction

These terms are governed by the law of [governing law to be set by counsel], and the courts of [jurisdiction to be set by counsel] have exclusive jurisdiction, without prejudice to any mandatory consumer or data-protection rights that apply regardless.

13. Changes

We may revise these terms. A material change is announced by email to workspace owners at least thirty days before it takes effect, and the date at the foot of this page moves when it does. Continuing to use the service after that date is acceptance; if you do not accept, close the workspace before it and section 5 applies.

14. General

These terms, with the data processing agreement and the privacy notice, are the whole agreement. If a provision is unenforceable the rest stands. Neither party may assign the agreement without the other’s consent, except to a successor of its business. Notices to you go to the workspace owners’ addresses; notices to us go to the address on the imprint, once published.

In effect from 2026-09-11. Earlier versions are available on request.