Terms of service
Last updated 3 September 2026
1. Operator and scope
These terms govern use of ConformOps, a software service operated by Simone Laudani in Italy under the ConformOps product name. References to “ConformOps”, “we”, “us”, or “the operator” in these terms refer to Simone Laudani. Questions about these terms can be sent to privacy@conformops.eu.
ConformOps is designed for business and professional use in connection with Cyber Resilience Act work. Paid plans are offered only to users acting for business or professional purposes, not as consumers. Nothing in these terms removes a right or remedy that applicable law does not allow the parties to exclude.
2. The service
ConformOps provides software-assisted readiness assessment, traceable findings, component information, reporting-case records, and generated technical-evidence artifacts based on material supplied or connected by the customer. Features and plan limits are described on the pricing and product pages and may evolve as the service is developed.
3. Not legal advice or certification
The service does not provide legal advice, determine final CRA scope or classification, conduct a notified-body or conformity assessment, issue an EU declaration of conformity, affix CE marking, file reports with a CSIRT or ENISA, or certify compliance. Customers remain responsible for product decisions, source accuracy, review and approval of generated material, required filings, and obtaining qualified professional advice where appropriate.
4. Accounts and authorised content
You must use an authorised account and submit or connect only repositories and files you have the right to process. You are responsible for activity performed through your account and for keeping access methods secure. GitHub App installation does not transfer repository ownership or expand your rights. You must not use the service to introduce malware, probe other customers, upload secrets unnecessarily, infringe third-party rights, or interfere with service security or availability.
5. Plans and billing
Full Assessment is purchased for one CRA product, which may contain multiple repositories or components within one marketed or shipped compliance scope. Free provides up to 2 active limited preview products per workspace; archiving a Free product releases that active allowance. Full Assessment is a one-time per-product purchase with complete outputs and a 14-day verification window after the first paid assessment completes. An Organization owns each monthly or annual Continuous slot and assigns it to one product. Portfolio includes five assignable slots and explicitly confirmed additional slots. Moving a slot does not change its billing anniversary and is limited by the published reassignment cooldown. Stripe handles payment-card data directly.
For paid orders, the amount, billing cadence, applicable taxes, and any credit are shown before confirmation. Cancellations and downgrades take effect according to the paid period and leave completed product records available in read-only historical form; compliance data is not deleted merely because recurring coverage ends. Unless a checkout or order expressly says otherwise, amounts already paid are not refundable except where required by law.
6. Repository processing
Repository uploads and connections are filtered to bounded evidence-relevant UTF-8 text. The service does not execute repository code and may exclude generated trees, binaries, archives, and material outside the supported evidence policy. Evidence-relevant files above the per-file limit are reported as a partial-coverage limitation rather than silently treated as assessed; aggregate file, byte, component, entry, and credential-density limits refuse the job instead of selecting an undeclared subset. Customers remain responsible for checking whether the resulting evidence set is complete and appropriate for their product.
7. Generated output and customer decisions
Generated artifacts are working materials that require customer review, ownership, and approval. Automated matches may be incomplete or inapplicable. Absence of detected evidence does not prove that a control or process does not exist, and evidence coverage does not establish CRA compliance. Any final declaration, classification, conformity route, risk acceptance, filing, or certification decision remains outside the automated authority of the service.
8. Optional AI processing
OpenAI is the only AI provider used by ConformOps. Optional processing is off by default at workspace and product level, both settings must be enabled, and only a workspace Owner or Admin may change them. When enabled, OpenAI receives the limited sanitized request described on the AI processing page. OpenAI states API data is not used to train or improve its models unless the API account opts in; ConformOps does not opt in. AI proposals are non-authoritative and do not control a requirement state or approval. The deterministic service remains available without OpenAI.
9. Customer material and service software
You keep ownership of the repositories, files, product information, and other material you provide. You grant the operator only the rights needed to host, sanitize, analyse, transform, and store that material to provide and secure the service. ConformOps software, branding, templates, and service-generated presentation remain the operator’s or applicable licensors’ property; these terms do not transfer ownership of them.
ConformOps does not sell customer material or use it for advertising.
10. Availability, suspension, and termination
The service may change, experience maintenance, or depend on third-party infrastructure. No uninterrupted or error-free availability is promised. Access may be limited or suspended when reasonably necessary to protect the service, investigate abuse, comply with law, or address a material breach of these terms. You may stop using the service at any time; ending recurring coverage does not erase historical evidence merely because the subscription ends.
11. Responsibility and liability
ConformOps is an evidence and workflow tool, not a substitute for professional judgment. To the extent permitted by applicable law, the operator is not responsible for decisions made solely from unreviewed generated output, customer-provided inaccuracies, or failures caused by systems or services outside the operator’s reasonable control. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited.
12. Privacy, processing, and breach notices
Personal data is handled as described in the Privacy notice. By connecting third-party repositories or supplying personal data relating to other people, you are responsible for having an appropriate legal basis and authority to do so.
The Data processing agreement forms part of these terms where ConformOps processes Customer Personal Data for a business customer. Current locations and global boundaries are published on the Data residency page, and the processor breach-notification terms are published in the Breach notification commitment.
13. Archive, product deletion, and account deletion
Archiving is reversible and preserves a read-only evidence history. Permanent product deletion is Owner-only, requires an exact product-specific confirmation and retention acknowledgement, and removes the product evidence chain through a verified cross-store procedure. Account holders can request account erasure with equivalent explicit confirmation. An Owner must first transfer any workspace with a live subscription or end that subscription; an unsubscribed workspace they still own is permanently deleted, while Admin and Member access simply ends. Deletion does not remove statutory billing records or replay-protection keys, and deleting a product does not cancel an Organization subscription. The full behavior is published on the Deletion page.
14. Changes and governing law
Material changes to these terms will be published with a new revision date. Continued use after an updated version takes effect constitutes acceptance where permitted by law; if a change materially affects a paid service, any additional notice required by the applicable contract or law will be provided. These terms are governed by Italian law, subject to mandatory rules that apply regardless of that choice. Disputes are handled by the courts having jurisdiction under applicable law.