Terms of service

For Firmline CRA during the early-access beta. Last updated 3 October 2026.

Who these terms are between

These terms are between FIRMLINE PC, trading as Firmline, THIMATON KATOCHIS 60, 41335, LARISA, GREECE (“Firmline”, “we”), and the organisation that uses Firmline CRA (“you”). The person who accepts them confirms they may do so for the organisation. The data processing agreement is part of these terms.

What Firmline CRA does, and what it doesn’t

Firmline CRA helps you run your vulnerability-handling and reporting obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It keeps your products and support periods, checks your SBOMs against public vulnerability databases, records your decisions and their reasons, tracks the Article 14 deadlines, drafts what to enter on ENISA’s Single Reporting Platform, publishes your security advisories and exports your evidence.

It doesn’t make you compliant with the CRA, and it isn’t legal advice. You decide whether a vulnerability or incident has to be reported and what to report, and you submit reports on ENISA’s platform yourself. Matching relies on public sources (OSV.dev, NVD and CISA’s Known Exploited Vulnerabilities catalogue), which can be incomplete or late: no match doesn’t mean a component is safe.

Deadlines and reminders

Deadlines are computed in UTC from the time you record, following our reading of Article 14, which is set out in the app. Reminder emails are an aid. Email can be delayed or lost, and the service can be unavailable, so you stay responsible for meeting every deadline.

The beta

Early access is by invitation and free of charge. Features may change while we build. We’ll tell you at least 30 days before paid plans start, with the price, and you decide then whether to continue. If we end the beta, we’ll give you at least 30 days’ notice to export your data.

Your account

Sign-in is by emailed link. Keep your team’s email accounts, the API tokens you create for CI and the tracker tokens you connect secure; anything done with them counts as done by you. Your organisation’s owner manages who has access.

Your data

Everything you put into Firmline CRA stays yours. We use it only to provide the service, as set out in the data processing agreement. You can download all of it, and delete your organisation, at any time from Settings. When you delete it, or the service ends, we delete your data within 30 days. Encrypted backups keep a copy for up to 12 months, then it’s gone.

Firmline CRA sends what it needs to outside services: package URLs to OSV.dev, component names (CPEs) to NVD and vulnerability IDs to ENISA’s EUVD, never your SBOM files; and, if you connect an issue tracker, the issue text for a case to that tracker.

Security advisories you publish

Advisories you publish are public, under your organisation’s name, and anyone may copy them. You’re responsible for what they say.

Fair use

Don’t use Firmline CRA to break the law, to store data you have no right to, or to attack, overload or probe the service or other customers’ data. Don’t resell it without our agreement. We may suspend access that does, and will tell you why.

Availability and support

We run the service with care and back it up every night, but during the beta we don’t promise a level of availability. Support is by email, at info@firmline.eu.

Liability

The beta is provided as it is. As far as the law allows, we aren’t liable for indirect or consequential loss, lost profits, fines or penalties, or deadlines missed, and our total liability is limited to the greater of €100 and the fees you paid us in the 12 months before the claim. Nothing in these terms limits liability for intent, gross negligence, or anything else the law doesn’t allow to be limited.

Changes and ending

We’ll tell you about material changes to these terms at least 30 days ahead, by email. You can stop using Firmline CRA at any time by deleting your organisation.

Law and courts

These terms are governed by the law of Greece, and the courts of Athens have jurisdiction, without affecting any mandatory rights you have where you are established.