Terms of service and sale
Last updated: July 22, 2026 · Version 1.0
1. Publisher & purpose
CRAcheck (cracheck.eu) is published by Maël Barbe, sole trader registered under SIREN No. 993 780 485 (SIRET 99378048500013) (the “Publisher”). These Terms of Service and Sale (“Terms”) govern access to and use of the service. By creating an account or subscribing, you accept them without reservation. Any use constitutes acceptance.
2. Intended audience — strictly professional use
CRAcheck is intended EXCLUSIVELY for professionals (developers, software publishers, businesses). By using the service, you represent and warrant that you act in a professional capacity, in the course of your business, and not as a consumer. Consumer-protection provisions (including the 14-day right of withdrawal) do not apply.
3. Service description
CRAcheck helps software makers prepare their self-assessment against Regulation (EU) 2024/2847 (the “Cyber Resilience Act”). Depending on the plan, the service includes: dependency analysis and software bill of materials (SBOM) generation, an indicative score, document templates (EU declaration of conformity, technical documentation, disclosure policy), a task plan, an ENISA reporting-preparation assistant, a self-assessment attestation, a timestamped journal and email notifications. Features evolve and may change.
4. ESSENTIAL DISCLAIMER — nature of the service
CRAcheck is a SELF-ASSESSMENT SUPPORT tool. It is in no way: (a) legal advice; (b) a certification of conformity by a notified body or any authority; (c) a guarantee that your product is, will be, or will remain compliant with the Cyber Resilience Act or any other regulation; (d) a guarantee against any penalty, fine, audit or claim. The compliance of your products is your sole and entire responsibility. You remain solely responsible for verifying the accuracy, completeness and adequacy of any information, document or score provided, and for seeking qualified professional advice where necessary.
5. Score and vulnerability data
The CRA score is an educational indicator computed using the Publisher's own method; it does not prejudge your actual compliance or any authority's decision. Vulnerability data comes from public third-party sources (notably OSV.dev, GitHub Security Advisories, PyPA, RustSec). The Publisher does not control these sources and does not warrant their accuracy, completeness, availability, or the absence of unlisted vulnerabilities. The absence of a reported vulnerability does not mean the absence of a vulnerability.
6. Self-assessment attestation
The attestation generated by CRAcheck certifies only that a self-assessment was performed via the service, on a given date, with the stated score. It is NOT a notified-body certification, nor a guarantee of compliance, nor a document enforceable against an authority. It is issued under your responsibility, based on the information you provide and the state of your repository at issuance. You are solely responsible for how you use it, including sharing it with third parties.
7. Generated documents
The documents produced by the service are pre-filled TEMPLATES meant to save you time. They may contain fields to complete, approximations or inaccuracies. You must review, complete, correct and validate them before any use. The Publisher accepts no responsibility for their accuracy, formal compliance, legal sufficiency, or the consequences of their use.
8. ENISA reporting assistant
The assistant prepares documents and tracks indicative deadlines; it does NOT submit anything to authorities on your behalf. Actually filing reports (24h / 72h / 14 days) on the official platforms, within legal deadlines, is your sole responsibility. The timestamps provided evidence an action within the service, not a submission to an authority. The Publisher cannot be held liable for a missing, late, incomplete or erroneous report.
9. Account & repository access
Access is via GitHub or GitLab. The Publisher requests read access to the metadata and dependency manifests needed for the service; it does not access your code content beyond what is necessary. You are responsible for the security of your authentication account and the permissions you grant. You warrant that you hold the necessary rights over the repositories you connect.
10. Plans, pricing & payment
The free plan is available without a card, with limited features. The Pro plan is billed as a monthly subscription via Stripe (€25/month launch price, rising to €50/month from January 1, 2027; earlier subscribers keep their price as long as the subscription remains active). Prices are stated excluding taxes where applicable. The subscription has no commitment and is cancellable at any time; it ends at the close of the current period. Save for mandatory law, amounts paid are non-refundable pro rata.
11. Service availability
The service is provided “AS IS” and “AS AVAILABLE”, without warranty of availability, continuity, error-free operation or absence of interruption. The Publisher may suspend, modify or discontinue all or part of the service, including for maintenance, evolution or technical reasons, without incurring liability.
12. Limitation of liability
To the maximum extent permitted by law, the Publisher's total aggregate liability, all damages combined, is limited to the amount you actually paid for the subscription during the twelve (12) months preceding the triggering event. The Publisher shall in no event be liable for indirect or immaterial damages, including: loss of revenue, customers or data, fines, administrative or regulatory penalties, reputational harm, or any consequence of a non-compliance of your products. These limitations do not apply in case of gross negligence or wilful misconduct, nor to liabilities that cannot be excluded by law.
13. User warranty & indemnification
You shall indemnify and hold the Publisher harmless against any claim, action, demand or award from a third party (including your own customers, partners or an authority) arising from your use of the service, your products, the sharing of an attestation or document, or any breach by you of your legal obligations or of these Terms. You shall bear the financial consequences, including the Publisher's reasonable defence costs.
14. Intellectual property
You retain all rights over your code, data and the documents you generate; the Publisher claims no rights over them. The CRAcheck brand, name, logos, interface, code and scoring method remain the Publisher's exclusive property; no licence is granted beyond the right to use the service in accordance with these Terms.
15. Personal data
The processing of personal data is described in the Privacy Policy, which forms an integral part of these Terms. You may export or delete your data at any time from your account.
16. Termination & suspension
You may delete your account at any time. The Publisher may suspend or terminate your access, without notice, in case of breach of these Terms, abusive, fraudulent or unlawful use, or risk to the service or third parties. Termination gives no right to a refund, save for mandatory law.
17. Changes to the terms
The Publisher may amend these Terms to reflect the evolution of the service or of regulation. The applicable version is the one in force at the time of your use. In case of a substantial change, subscribers are informed; continued use constitutes acceptance.
18. Force majeure
The Publisher cannot be held liable for any failure resulting from force majeure or an event beyond its reasonable control, including failure of a third-party provider (hosting, payment, data sources), network outage or cyber-attack.
19. Governing law & jurisdiction
These Terms are governed by French law. Failing an amicable resolution, any dispute falls under the exclusive jurisdiction of the courts of the Publisher's domicile, including in case of multiple defendants or third-party proceedings.