Terms of service

Version 2026-10-26.3, dated 2026-10-26. Earlier versions are available on request. Your product record and workflow Attesly brings product records, component inventories, vulnerability findings, deadlines and document drafts into one workspace. Your team reviews the evidence and records its decisions. The agreed software functions, the reference library and each party’s responsibilities are set out below. 1. Parties and scope These terms govern the use of Attesly (the “Service”) provided by Neithra Technologies – Fabian Lorenz, Thaler Weg 2a, 51647 Gummersbach, Germany, email [email protected], VAT identification number DE338072244 (“we”). The Service is offered exclusively to businesses, public bodies and self-employed professionals acting in their trade or profession (§ 14 BGB); it is not offered to consumers (§ 13 BGB). When you place an online order or accept an individual offer you give your company’s name and seat and confirm that you act as a business and are authorised to accept these terms and the data processing agreement on its behalf. 2. Agreed service and responsibilities The Service is a documentation and workflow tool for obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act). It stores product data you enter, matches software components you upload against public vulnerability databases, computes deadlines and a readiness score from the data you enter, and generates document drafts from that data. Attesly supplies software for organising evidence and preparing decisions. Classification proposals, deadline computations, readiness scores, vulnerability matches and document drafts are work aids computed from your inputs. Your team checks their accuracy and suitability before use and remains responsible for the conformity assessment under Regulation (EU) 2024/2847, any required involvement of a notified body, and every declaration and submission. The agreed service covers these software functions; individual legal advice, legal representation and a particular regulatory outcome are outside that scope. Our responsibility for providing the functionality expressly agreed and the liability rules in section 6 remain unaffected. Subscriptions provide self-service software. Onboarding calls, written reviews, questionnaire work and audit-day support are not included; any additional technical service requires a separate written agreement. They do not include a legal assessment of your products, your classification, your reporting obligations or your conformity, and are not legal services within the meaning of § 2 RDG. Whether and what to report to an authority remains your decision. Content generated with AI (for example AI-expanded drafts, evaluations or suggestions) consists of non-binding proposals generated by a language model from the data in your record and may be wrong or incomplete. It is marked as an AI draft and contains no assessment by us; you review it on your own responsibility before using it. Drafts can also be generated from templates without a language model. 2a. Regulatory content and updates The Service contains a dated reference library: our structured reading of Regulation (EU) 2024/2847 and relevant acts, standards and guidance. Legal updates are not automatic. A version date alone does not establish that current official sources have been reviewed. The Service warns when no completed review is documented. Check current official sources before relying on classifications, routes or templates. The library owes a careful, dated reading of these sources, not a particular legal outcome. We do not owe that a development is reflected in the Service by a particular date, that the library is complete, or that an authority or court will share its reading. Where the library has not been reviewed for longer than 30 days, the Service shows a notice to that effect. Data from third-party sources (for example OSV.dev) is shown as received; we do not verify it. We may change the library at any time, in particular to reflect new legislation, standards or guidance. A change can alter classifications, routes, deadlines, readiness scores or document templates in your workspace. Documents you have already generated or saved are not changed retroactively. 3. Plans and payment Paid catalogue plans can be ordered online through Attesly’s separate plan-ordering area. Before the binding order, we display the chosen plan, the monthly net price, the VAT that applies to your country of establishment, the total of the first payment, the currency and the applicable payment terms. The contract is concluded by your expressly binding order and our confirmation. The button on the ordering page only opens the payment step; you place the binding order by confirming the payment in Stripe’s payment form, and the contract is concluded once that payment is confirmed. Individual services beyond the catalogue are agreed by a separate written offer. All plans are billed monthly in advance. Payment is made through Stripe by credit card with 3-D Secure, Apple Pay or Google Pay. All prices are net prices; VAT is added where it is due. Catalogue subscriptions carry no setup fee: the first invoice is the monthly net contribution for the first month before applicable VAT, and every following month is charged the same monthly contribution. Previously accepted individual offers keep their recorded fee conditions. Your workspace becomes accessible once the first payment is confirmed, usually within minutes. Until then only account verification, plan ordering and support are available. With the online order or acceptance of an individual offer you state your company’s billing address, the email address for invoices and — if your company is established in a member state of the European Union other than Germany — its VAT identification number. The monthly amount is charged to the payment method stored with Stripe at the start of each billing month (due date), and an invoice is issued for every charge as a receipt. The currency follows the country of establishment: euros for companies in the European Union, Switzerland, Liechtenstein, Norway and Iceland, pounds sterling for companies in the United Kingdom, US dollars for companies in all other countries; each currency has its own price list. German companies are invoiced the net price plus German VAT. For a company established in another member state with a valid VAT identification number the reverse charge applies and the invoice carries the note “Steuerschuldnerschaft des Leistungsempfängers” together with both VAT identification numbers (§ 14a UStG). The reverse charge requires that the VAT identification number is confirmed in the EU VIES system at the time of the order; where it cannot be confirmed, nothing is charged and you can check the number or contact us. For a company established outside the European Union no German VAT is charged, because the place of supply is outside Germany, and each invoice carries the note “Not subject to German VAT – place of supply outside Germany (Sec. 3a (2) German VAT Act)”. Our VAT identification number is DE338072244. If a monthly charge does not succeed, editing and API access are suspended automatically three days after its due date until the payment has arrived. The suspension ends as soon as the payment has been received. During a suspension the record stays readable and exportable, and nothing is deleted; the obligation to pay remains. The selected plan description displayed before ordering and recorded with the order defines its product limit and software functions. Starter covers up to 5 products; Growth up to 20, Scale up to 50 and Enterprise up to 150. Team members are not priced per seat. All plans provide product records, SBOM import and vulnerability matching, incident deadline displays, six document templates, exports and optional public trust and vulnerability-intake pages. Growth, Scale and Enterprise add API access. Templates support the preparation of CRA records; they do not establish that all required evidence is complete for a particular product. AI-expanded document drafts are conditional on an explicitly enabled and budgeted document-AI service. That service is currently disabled; templates remain available. The separately enabled AI support dialog provides product assistance with consent and is not a document-generation service. Email support has no guaranteed response time. Requirements beyond 150 products or the published functions require an individual agreement. The pricing page and the frozen order summary state the monthly contribution and currency applicable to the order. 3a. Termination Plans can be terminated to the end of the billing month, unless the accepted offer states a longer term. Termination can be declared in text form to the contact address in the legal notice or through the form at /cancel, which is reachable without logging in. We confirm a termination by email. 4. Your content and data You retain all rights to the data you enter or upload. You grant us the right to process it solely to provide the Service. You are responsible for the accuracy of the data, for the lawfulness of uploading it, and for reviewing generated documents before use. Personal data is processed under the data processing agreement; section 7 applies to all content in your workspace. You keep your access credentials and API keys secret and inform us without delay if you suspect misuse. Where you need data outside the Service — for example exports, files handed to an authority or data passed on through an integration — you keep your own copy of it. Our own obligation to secure and back up the data held in the Service remains unaffected. 5. Availability and support We maintain the application and address reported faults within the scope of the agreed service. We strive for high availability; we announce maintenance in advance where possible. No particular availability percentage, monitoring interval or service credit is agreed unless expressly set out in the order. This does not exclude statutory remedies for a failure to provide the agreed service. Email support has no guaranteed response time. No incident response, on-call cover or deadline monitoring by the provider is included. The customer maintains its own responsible person and substitute for security cases and reporting deadlines. 6. Liability (1) We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the Product Liability Act (Produkthaftungsgesetz), for fraudulently concealed defects and to the extent of a guarantee we have expressly given. (2) In the event of a slightly negligent breach of an essential contractual obligation, our liability is limited to the damage that was foreseeable and typical for this type of contract at the time the contract was concluded. Essential contractual obligations are obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely. (3) Otherwise, liability for slight negligence is excluded. (4) These limitations also apply in favour of our vicarious agents and persons employed in performing our obligations. (5) Towards businesses, liability for lost profit and other indirect damage is excluded in the case of slight negligence, unless such damage is typical for this type of contract and foreseeable. (6) Strict liability for defects already present when the contract was concluded (Section 536a(1), first alternative, BGB) is excluded. (7) Claims under paragraph 2 become time-barred one year after the statutory start of the limitation period, unless paragraph 1 applies. Statutory rules on contributory fault (Section 254 BGB) remain unaffected. 7. Confidentiality All content you store in the workspace, including vulnerability reports and open Article 14 cases, is confidential. We use it only to provide the Service, disclose it only to the sub-processors listed in the data processing agreement, as legally required, or through public pages and links you expressly enable. Public product listing exposes the name and version independently of the trust-page setting. You are responsible for reviewing the content you authorise for publication. We never use it for marketing, benchmarking or model training. This obligation survives termination of the contract. 8. Term, termination and continuity New plans are monthly, renew monthly and can be cancelled to the end of the billing month. Any separately agreed legacy annual contract follows its agreed term and notice period; new annual subscriptions are not offered. After the end of the contract your workspace content remains available for export for 60 days unless you instruct earlier deletion. Deletion is performed through an operator-reviewed process on a verified instruction, normally within 30 days, subject to applicable legal deadlines and specifically documented retention duties. After the export window we review and delete remaining workspace content within a further 30 days unless continued retention has a documented lawful basis. Archiving a workspace or deactivating a login neither cancels a subscription nor erases its data. Our own accounting evidence is retained separately only as legally required; invoices are generally retained for eight years under § 14b UStG, and other records follow their applicable category and legal exceptions. If we plan to discontinue the Service, we inform you as early as practicable and provide a reasonable opportunity to export your data. Existing contractual and statutory rights, including applicable notice periods, remain unaffected. Exports use open formats: CSV and JSON for data, Markdown for documents, which also print to PDF. If a login has already been deactivated, an authorised customer can request an operator-assisted export through the contact in the legal notice during the export window. Identity and authority are verified before any data is released. 9. Changes We propose changes to these terms with at least six weeks’ notice by email to the workspace owner, identifying the changes and their intended effective date. A change requires your express agreement; silence or continued use is not acceptance. Without agreement, the existing terms continue to apply. Individual agreements and mandatory law take precedence. Changes to the Service that reduce the core functionality of your plan entitle you to terminate at the effective date. 10. Governing law and place of jurisdiction German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). If the customer is a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the place of jurisdiction is Gummersbach, Germany, as far as legally permissible. Mandatory statutory places of jurisdiction remain unaffected. The choice of law and venue does not displace overriding mandatory law applicable to the particular case. No limitation, exclusion or shortened claim period in these terms applies where it is prohibited by that law. In particular, agreed service obligations and remedies that cannot lawfully be excluded remain intact; a loss is not excluded merely because it is described as indirect or consequential. These terms do not require arbitration or waive any non-waivable right to bring a claim. Business-only eligibility describes who may order; it does not remove statutory protections that also cover business purchasers, including applicable Australian consumer guarantees and small-business unfair-contract protections or New Zealand small-trade protections. No general contracting-out of those protections is agreed here. 11. Digital service, onboarding and refunds This service is ordered for business purposes. A contract genuinely concluded by a business customer does not carry the German statutory consumer distance-selling right of withdrawal; no waiver of that right is needed. The actual purpose of the transaction is decisive. Checking a business-customer box does not remove mandatory rights. Fees and due dates follow the confirmed order or accepted offer. A subscription pays for the agreed availability of the service during the billing period. Choosing not to use a properly provided service, or no longer needing it, does not by itself entitle you to a refund, subject to the money-back guarantee in section 11a. Ordinary cancellation stops future renewals at the agreed date; it does not make properly performed earlier services free of charge retrospectively. Catalogue plans carry no setup fee. A subscription does not include a personal onboarding call, legal review or custom work. Personal onboarding or custom work is owed and charged only where its scope and any separate price were expressly agreed before ordering. Agreed work actually performed remains payable following ordinary cancellation alone. Starting setup does not fully perform an ongoing subscription. Undelivered work, defects and valid termination for cause are assessed under the contract and applicable law; these terms do not exclude all refunds. Legal remedies for non-performance, defects, unauthorised or duplicate charges and mandatory local protections remain available, including for US customers. Rights against your bank, card issuer and payment provider are not waived. You may raise concerns with the contact in the legal notice; contacting us first is not a condition for statutory rights. A chargeback alone does not finally decide the underlying contractual claim; an entitlement that has validly been refunded will not be collected again. 11a. 30-day money-back guarantee In addition to section 11, Neithra Technologies gives this voluntary guarantee. If Attesly is not right for your business, the account owner can ask for a refund by a short email to [email protected] within 30 days of the first payment of your first subscription. We then refund that first payment in full; you do not need to give a reason. The guarantee applies once per business, to the first payment of its first subscription. It does not cover later renewal payments, additional plans or separately agreed work. The guarantee applies only as long as no AI usage costs have been incurred on the account, for example through AI-drafted documents or AI assistant answers within the workspace. Whether AI usage costs were incurred is determined from the account's AI usage record. Use of the free assistant on the public website before the purchase does not count. The refund goes back to the payment method you used, through Stripe, and we confirm it personally by email. With the refund the subscription ends; section 8 applies to your workspace content and its export. Refunds are never made automatically. Statutory rights and the remedies in section 11 remain unaffected.