Version 3+5dc43cab

Fristal Terms of Service

Version v3. Last updated 21 October 2026.

1. Who we are and what these terms cover

1.1 These terms are an agreement between Tagg Software Ltd, a company registered in England and Wales (company number 16997744, registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE) ("Tagg", "we", "us") and the business that signs up to use Fristal ("you", "the Customer").

1.2 Fristal is a web service that helps software and device manufacturers prepare for the EU Cyber Resilience Act (the "Service").

1.3 These terms, the Privacy Notice at https://fristal.com/privacy and your Plan form the whole agreement. If anything conflicts, these terms win, except for the Privacy Notice on personal data.

1.4 You can contact us at hello@fristal.com or by post to our registered office.

2. Business customers only

2.1 The Service is for business use only. By creating an account you confirm that you are signing up for a business, trade, craft or profession (including as a sole trader or self-employed person), and not as a consumer.

2.2 We do not sell to consumers. If you are a consumer, do not sign up or use the Service.

3. Definitions

Account: your Fristal organisation account. Each organisation has one login, created at sign-up. The person who holds it is the "Account owner".

Customer Content: everything you upload or enter into the Service, including lockfiles, SBOMs, product names and versions, findings, reporting checklists, report fields, notes and evidence log entries.

Fees: the subscription fees for a paid plan. The Free plan has no Fees.

Plan: the Free plan or a paid plan described in clause 9.1, or a Sponsored Plan under clause 9.9.

Third-Party Data: vulnerability and exploitation data from OSV.dev, the CISA Known Exploited Vulnerabilities (KEV) catalogue, and any other source we add.

4. The Service

4.1 The Service is an information service. It:

(a) takes a lockfile or SBOM that you upload and produces a CycloneDX SBOM for each product;

(b) checks the components in each active product (clause 9.10) against Third-Party Data, usually once a day;

(c) sends alerts when it finds a new match;

(d) where you record that a vulnerability is being actively exploited in your product, starts a timed checklist with report fields pre-filled for you to review, export and use;

(e) keeps an evidence log of actions taken in the Service; and

(f) provides a free "Am I in scope?" checker and a quick SBOM scan.

4.2 Third-Party Data may be incomplete, delayed or wrong. The Service depends on sources we do not control. They may be incomplete, out of date, or contain errors. Matches depend on how well your components are identified in your lockfile or SBOM.

4.3 No guarantee of detection. We do not guarantee that the Service will find every vulnerability that affects your product, that every match is correct, or that every severity or exploitation label is accurate. You should not treat the Service as the only check on your components.

4.4 We do not submit reports. We do not submit reports to ENISA, to any Computer Security Incident Response Team (CSIRT), to any national authority or to any other body, on your behalf or otherwise. Any notification or report under the Cyber Resilience Act or any other law is yours to make, through the channels that apply to you. The Service helps you track the timing and prepare the content.

4.5 Who decides. The reporting clock starts only when you confirm the time you became aware of active exploitation. Fristal does not decide whether a vulnerability is actively exploited in your product. A listing in the CISA KEV catalogue is a prompt for you to assess, not a finding that your product is affected.

4.6 Changes. We may add, change or remove features. We will tell you in advance if we are going to remove a feature that is important to your plan, unless the change is needed for security or legal reasons.

5. Your responsibilities

5.1 You remain responsible for your legal obligations. You remain solely responsible for complying with the Cyber Resilience Act (Regulation (EU) 2024/2847) and every other law that applies to you. This includes monitoring your products for vulnerabilities, assessing them, documenting them, reporting them and deciding what to do about them, as well as conformity assessment, technical documentation, supply-chain duties and any sector-specific rules.

5.2 Accuracy of what you upload. You are responsible for the accuracy and currency of every SBOM, lockfile and product detail you upload. The Service can only check what you give it. You must upload a new lockfile or SBOM when your product changes.

5.3 Keep alerts working. You must keep your alert channels working. In particular you must:

(a) keep the email addresses on your Account up to date, and check that Fristal emails are not blocked or filtered away;

(b) keep any Slack or other webhook you add working, and only add webhooks you control;

(c) use a monitored or shared mailbox for the Account, and/or the optional Slack channel, so that alerts do not depend on one person's inbox; and

(d) check the "last checked" date shown for each product, and act on any missed-scan alert.

We are not responsible for an alert you did not receive or act on because of your settings, your email provider, your webhook, or a change you made.

5.4 Your decisions. You decide whether a vulnerability is actively exploited in your product, what remedial action to take, whether and when to report, and what to say in any report.

5.5 Advice. You should take advice from a qualified adviser on your obligations. Section 6 explains what the Service does and does not do.

6. No legal advice

6.1 The Service, including the "Am I in scope?" checker, the reporting checklists, the report fields, the FAQs and all other content, is general information only. It is not legal, regulatory, technical or professional advice. Using the Service does not create a lawyer–client relationship.

6.2 The scope checker gives a general indication of whether the Cyber Resilience Act is likely to apply to a product. It does not decide whether the Act applies to you, and its results can be wrong if your answers are wrong or your circumstances are unusual.

6.3 We do not certify, approve or endorse any product, and nothing in the Service means your product complies with the Cyber Resilience Act or any other law.

7. Warranties

7.1 We will provide the Service with reasonable skill and care.

7.2 Except as set out in these terms, we give no warranties, conditions or representations about the Service. To the extent the law allows, we exclude all implied terms, including any implied terms about satisfactory quality, fitness for a particular purpose, and non-infringement.

7.3 You confirm that you have the authority to bind your business to these terms, and that you will use the Service in line with them.

8. Liability

8.1 What we cannot limit. Nothing in these terms limits or excludes:

(a) our liability for death or personal injury caused by our negligence;

(b) our liability for fraud or fraudulent misrepresentation; or

(c) any other liability that cannot be limited or excluded by law.

8.2 Cap. Subject to clause 8.1, our total liability to you arising out of or in connection with these terms or the Service, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total Fees you paid to us under these terms in the 12 months before the event that gave rise to the claim.

8.3 Exclusions. Subject to clause 8.1, we are not liable to you for any of the following, however they arise:

(a) indirect or consequential loss;

(b) loss of profit, revenue, business, anticipated savings or goodwill;

(c) loss or corruption of data, including Customer Content (you are responsible for keeping your own copies, see clause 12.4);

(d) regulatory fines, penalties or other sanctions imposed on you by any authority, and any amount you try to recover from us for them;

(e) losses arising from a missed notification or report deadline, to the extent the miss was caused by a failure to act on an alert, a failure to keep your Account or alert channels working, or a decision you made; or

(f) loss caused by inaccurate, incomplete or out-of-date information that you give us, including SBOMs and lockfiles (see clause 5.2).

8.4 Third-Party Data. We are not liable for the content, accuracy, completeness or timeliness of Third-Party Data, beyond what clause 8.2 allows.

8.5 Reasonableness. This section applies because you are a business customer (clause 2). You and we agree that the limits and exclusions in this section are fair and reasonable. They reflect the Fees charged, the free and low-cost nature of some plans, and the fact that you control your regulatory decisions and submissions.

8.6 Warranty and liability. Clause 7 sets out the standard we promise: reasonable skill and care, with no promise that the Service is fit for a particular purpose. Our liability for any breach of that standard is subject to this section 8.

9. Plans, fees and payment

9.1 Plans. The current plans are:

Every plan includes daily checks, email alerts, the weekly summary email and incident reporting for its active products (clause 9.10). Solo and Team are the "paid plans".

New Accounts start on the Free plan. You do not need a payment card to sign up or to use it. The Free plan has no Fees and no fixed end date. You can move to a paid plan at any time from your Account page. We may change the limits of the Free plan, or stop offering it, by giving at least 30 days' notice by email to the Account owner.

9.2 VAT. We are not registered for VAT, so no VAT is charged on the Fees. If we register for VAT in future, we will give you notice before VAT is added to the Fees, and VAT will then be charged at the rate in force at that time.

9.3 Billing. Fees for a paid plan are billed monthly in advance through Stripe ("Stripe"). You authorise Stripe to charge the payment method you give us for each monthly period until you cancel. We do not store full card numbers.

9.4 Failed payments. If a payment fails, we will try again and tell you, including with a notice on your Account page. Your plan stays active while the payment is outstanding. If the subscription then ends, clause 9.6 applies.

9.5 Cancellation and changing plan. You can cancel a paid plan at any time from the billing portal, which you open from your Account page. Cancellation takes effect at the end of the current monthly period. You keep your plan until then, and clause 9.6 then applies. We do not refund fees for part months, unused time or a part period after cancellation.

You can also change paid plan from the billing portal. A move to a plan with a lower Fee takes effect at the end of the current monthly period, and you keep your current plan until then. A move to a plan with a higher Fee takes effect when you confirm it. Clause 9.10 applies if your new plan covers fewer products than you have.

Closing your Account under clause 12.5 is different. It takes effect at once: any paid subscription is cancelled in Stripe on closure, and no further monthly Fees are charged.

9.6 When a paid plan or Sponsored Plan ends.

(a) When it ends. A paid plan ends when a cancellation takes effect under clause 9.5, or when a subscription ends after a failed payment under clause 9.4. A Sponsored Plan ends under clause 9.9.

(b) Grace period. For 7 days after the plan ends (the "grace period"), you keep the limits of the plan that ended, and the Service continues as before, subject to clauses 4.2 and 4.3. We will email you when the grace period starts, giving the date on which it ends, and again when it ends.

(c) After the grace period. When the grace period ends, your Account moves to the Free plan. Your oldest product stays active and every other product is paused (clause 9.10). Slack and team alerts stop. The email we send when the grace period ends names the products that are paused.

(d) What you can always do. Whatever your plan, you can log in, view your Customer Content, export it under clause 12.4 and close your Account under clause 12.5. You can also start an incident and use its reporting checklist, report fields and the evidence log for any product, including a paused one.

(e) Nothing is deleted. The end of a plan, the grace period, the move to the Free plan and pausing do not delete any Customer Content. It stays in your Account until you delete it or close your Account. Clause 12.5 then applies: we permanently delete your data 14 days after closure.

(f) Choosing a paid plan again. If you choose a paid plan during or after the grace period, the products your new plan covers are active again at once (clause 9.10), and you can add products and upload lockfiles and SBOMs within its limits.

9.7 Price changes. We may change the Fees by giving you at least 30 days' notice by email to the Account owner. A change takes effect at the start of the first monthly period that begins after the notice period. If you do not accept a change, you may cancel before it takes effect, under clause 9.5.

9.8 Non-payment. If your subscription is unpaid or cancelled, clause 9.6 applies.

9.9 Sponsored plans. We may give an Account a Plan without Fees (a "Sponsored Plan"). It has the limits of the plan we name when we grant it. It has no billing or renewal and no fixed end date, and it is personal to the Customer and not transferable. We may end or change it on 30 days' notice by email to the Account owner, or immediately by written notice if you breach these terms, clause 10.5 applies, you stop carrying on business or become insolvent, or the law requires. When it ends, clause 9.6 applies. Ending it does not end these terms. Further conditions that we confirm in writing when we grant it apply together with these terms.

9.10 Products above your plan's limit.

(a) Each plan covers the number of products shown in clause 9.1. A Sponsored Plan covers the number for the plan whose limits it has. If you have more products than your plan covers, for example after you move to a plan with a lower limit or to the Free plan, your oldest products, up to your plan's limit, stay active.

(b) Every other product is "paused". For a paused product we do not run daily scans, send alerts or include it in the weekly summary, and you cannot upload a lockfile or SBOM for it or start a manual scan. You can still view it, export its Customer Content, delete it, and use incident reporting for it as clause 9.6(d) describes.

(c) We do not delete a product or its Customer Content because it is paused. A paused product becomes active again as soon as your plan covers it, for example when you move to a plan with a higher limit or delete another product.

(d) A paused product is not checked, so the Service will not tell you about new vulnerabilities in it. Clauses 4.2, 4.3 and 5.3 apply, and you should check the product by other means.

(e) Before you move to a lower plan, your Account page shows how many products would be paused. If a change of plan pauses any of your products, we will email you, naming them.

10. Acceptable use

10.1 Upload only what you are allowed to share. You may only upload files, and data about products, that you are entitled to share with us. This means your own products, or products you have permission to assess.

10.2 Do not scan other people's products. You must not use the Service to scan, probe or test any product, network, system or service that you do not own or have written permission to test.

10.3 Do not misuse the Service. You must not:

(a) try to break, bypass or test the security of the Service, or access another customer's data;

(b) upload anything containing malware, or anything designed to harm the Service or its users;

(c) overload the Service, or use automated tools to bypass rate limits, including the limits on free scans and sign-in attempts;

(d) reverse-engineer, copy, resell or sublicense the Service, except as these terms allow; or

(e) use the Service for any unlawful purpose.

10.4 Do not misrepresent the Service. You must not tell anyone that Fristal certifies, approves or guarantees your product or your compliance.

10.5 Suspension. We may suspend your Account or part of the Service immediately if we reasonably believe that it is needed to protect the Service, other customers or any third party, or if you breach this section 10. Where practical we will tell you why and when we expect to restore access. We will restore access once the issue is resolved.

10.6 Termination for breach. We may end these terms by written notice if you breach them and do not fix the breach within 14 days of our notice, or immediately if the breach is serious and cannot be fixed.

11. Availability and scan failures

11.1 No service level agreement. We do not promise any level of uptime, response time or availability. Planned and unplanned downtime may happen.

11.2 We tell you when scanning fails. If a product has not been checked successfully for more than 26 hours, the product page shows a "last checked" date and a warning banner. We also send a missed-scan alert by email to the Account's registered email address. The banner also shows in the app. You must not rely only on the absence of an alert to tell you that scanning is working. This clause does not apply to a paused product (clause 9.10), which is not checked.

11.3 Maintenance. Planned maintenance may cause downtime. Clause 11.1 applies.

11.4 Backups. Backups are overwritten or deleted in the normal course, and deleted data may remain in them until then. We do not promise a restore time. The database holds the evidence log.

12. Customer Content and data

12.1 You own your Customer Content. We do not claim ownership of Customer Content.

12.2 Our licence. You give us a non-exclusive, worldwide, royalty-free licence, for the length of your Account, to host, copy, process and transmit Customer Content only to:

(a) provide, secure, support and maintain the Service;

(b) send component names and versions to Third-Party Data sources to check them for matches; and

(c) meet legal obligations that apply to us.

12.3 Personal data. Customer Content is normally about software components and is not personal data. But it may contain personal data, for example names in a file path or a maintainer's name in a package field. Where it does, the Privacy Notice applies to our processing. You must not upload personal data that you do not have a lawful basis to process.

12.4 Export. You can export your Customer Content at any time from the Account. The exports are:

(a) a CycloneDX SBOM for each product;

(b) for each incident, its reporting checklist and report fields, as JSON, and as a printable HTML page that you can save as PDF from your browser;

(c) the evidence log, as CSV; and

(d) the original lockfile or SBOM file for each upload that we kept, downloaded one file at a time from the product page, as you uploaded it.

Reporting checklists and report fields exist only for an individual incident, not for a product as a whole. You are responsible for keeping copies you need.

12.5 Deleting products and closing your Account.

(a) Deleting a product. You can delete a product at any time from its page. Deletion is immediate and cannot be undone. It permanently deletes the product's data, its stored original files and its evidence-log entries. We keep one organisation-level record that the product was deleted, showing its name, who deleted it, when, and how many items were removed, until your Account is permanently deleted. You cannot delete a product while an incident for it still has a report that is not marked as submitted. This includes the final report, which blocks deletion until it is marked as submitted, even if its 14-day period has not started yet.

(b) Closing your Account. You can close your Account from the Account page by typing your organisation's name and entering your password. The closure page links every export (clause 12.4) before you confirm. Closure takes effect at once: the Account is locked, every user is emailed the date of permanent deletion, and any paid subscription is cancelled in Stripe.

(c) Export before you close. Once your Account is closed, you cannot use the Service for it and cannot export Customer Content. Export anything you need before you close. If you close by mistake, contact us within 14 days to reopen the Account.

(d) Permanent deletion. 14 days after closure we permanently delete everything for your Account: products, components, findings, incidents, the evidence log, users, alert-delivery logs and stored original files. This includes the record of the Terms you accepted. After permanent deletion nothing can be recovered. If a stored file cannot be deleted at first, we retry until it is. Our backups will be overwritten or deleted in the normal course, as clause 11.4 describes.

12.6 Retained records. We may keep records we must keep by law, such as billing and tax records, and records we need to defend or bring a legal claim. These are kept only for as long as needed for that purpose.

12.7 Security. We take reasonable technical and organisational measures to protect Customer Content, as described in the Privacy Notice. No internet service is completely secure. You must keep your login details safe and tell us promptly if you think they have been compromised.

13. Confidentiality

13.1 Each of us will keep confidential the other's confidential information that we receive under these terms, and use it only to perform these terms. This does not apply to information that:

(a) is or becomes public other than through a breach of these terms;

(b) we already knew, or develop independently without using the other's information;

(c) we must disclose by law or by a regulator; or

(d) we disclose to our professional advisers or insurers who are bound by duties of confidence.

13.2 Customer Content is your confidential information. We keep it confidential, except as needed to provide the Service and as the Privacy Notice describes.

13.3 Obligations in this section continue for 5 years after these terms end. For trade secrets they continue for as long as the information remains a trade secret.

14. Changes to these terms

14.1 We may update these terms. For a material change we will give you at least 30 days' notice by email to the Account owner. The updated terms take effect on the date stated in the notice.

14.2 Whenever these terms change, we will ask the Account owner to accept the updated terms the next time they log in. We record the version accepted and the time of acceptance. If the Account owner does not accept, they may cancel a paid plan under clause 9.5 or close the Account under clause 12.5.

14.3 If you do not accept a material change, you may cancel a paid plan under clause 9.5, or close your Account under clause 12.5, before it takes effect.

15. Ending these terms

15.1 These terms start when you create an Account and continue until the Account is closed.

15.2 Either of us may end these terms by giving notice through the Service or by email. If you have a paid subscription, your notice takes effect at the end of the monthly period in which it is given (clause 9.5). Otherwise it takes effect when we receive it. Closing your Account under clause 12.5 takes effect at once. We may end these terms immediately, by written notice, if you do not pay, or if clause 10.6 applies.

15.3 When these terms end, your access to the Service ends, and clause 12.5 applies to your Customer Content. Clauses 6, 8, 12.5, 12.6, 13, 15.3, 16 and 17 continue to apply after these terms end, together with any other clause that by its nature should continue.

16. General

16.1 Entire agreement. These terms and the Privacy Notice are the whole agreement between us about the Service. They replace any earlier statements. Nothing in this clause excludes liability for fraud.

16.2 Assignment. You may not transfer your rights under these terms without our written consent. We may transfer our rights to a successor to all or part of our business, and we will tell you if that happens.

16.3 Force majeure. Neither of us is liable for a delay or failure caused by events beyond our reasonable control. This does not excuse payment of Fees.

16.4 Notices. Notices to you go by email to the Account owner. Notices to us go by email to legal@fristal.com, or by post to our registered office. A notice sent by email is treated as received on the next business day after it is sent, unless the sender receives a delivery failure message.

16.5 Third-party rights. No one other than us and you has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.

16.6 Severance. If any part of these terms is found to be unenforceable, the rest stays in force.

16.7 Waiver. If we do not enforce a right straight away, we have not given it up.

17. Governing law and jurisdiction

17.1 These terms, and any dispute or claim arising out of or in connection with them or the Service (including non-contractual claims), are governed by the law of England and Wales.

17.2 The courts of England and Wales have jurisdiction to settle any such dispute or claim.

Last updated: 21 October 2026.