crAcken Terms of Use — Free Company Trial

Version 1.0 · Effective 21 October 2026 · English is the binding language.

Provider: Aliaksandr Varabyou, Gildenweg 59, 47608 Geldern, Germany. E-mail: support@cracken.tech. Further provider information: https://cracken.tech/impressum.html. ("Provider", "we")

Service: the crAcken web application at https://www.cracken.tech, including its programming interface where the Service offers it ("Service").

1. Scope and who may use the trial

1.1 Scope. These Terms govern the free trial of the Service that a business starts itself in the Service ("Trial"). The contract is concluded between the Provider and the organisation for which the Trial is started ("Customer").

1.2 Businesses only. The Trial is offered only to entrepreneurs within the meaning of § 14 of the German Civil Code (BGB), to legal persons under public law and to special funds under public law, for their business purposes. It is not offered to consumers (§ 13 BGB). The person who starts the Trial confirms that they act on behalf of the Customer, are authorised to bind the Customer and are at least 18 years old. We may ask for reasonable evidence of these points and may refuse or end a Trial if they are not met.

1.3 Account and conclusion of the contract. A user account is created with an e-mail address and a password; the e-mail address must be confirmed. When creating the account, the user accepts these Terms on behalf of the organisation by ticking the box "I accept the Terms of Use on behalf of my organisation; crAcken is for businesses only." The contract for the Trial is concluded when an authorised person, after accepting these Terms and the onboarding notices shown, selects "Start your company trial"; a link to these Terms is shown next to that button. We store the version of these Terms, a checksum of the accepted text, the user and the server time of acceptance. These Terms can be opened, printed and saved at https://cracken.tech/terms.html at any time. Between businesses, § 312i (1) sentence 1 nos. 1 to 3 BGB and Article 246c of the Introductory Act to the BGB do not apply.

1.4 Order of documents. Mandatory law applies first. For personal data processed on the Customer's behalf, Annex A (data processing terms) applies and prevails over the rest of these Terms. The Customer's own terms and conditions do not apply.

1.5 Other contracts. A trial agreed individually and signed (for example a Trial Memorandum of Understanding) and any paid subscription are governed by their own documents. These Terms do not become a paid subscription.

2. What the Trial includes

2.1 Functions. The Trial includes the functions available in the Service when the Trial starts, in particular: upload and analysis of SBOMs in the supported CycloneDX and SPDX JSON formats (including supported JSON collections and ZIP archives); component and vulnerability findings; team work within the Customer's organisation; decisions, notes and evidence records; the reporting case workspace; source-grounded AI guidance and reportability memos; reports with PDF download; scheduled monitoring, alerts and vulnerability e-mail notifications; and access to the programming interface where the Service offers it. The evidence bundle carries a checksum. It has no qualified electronic timestamp, seal or signature and is not certified evidence.

2.2 Allowances.

2.3 One Trial per organisation. Each organisation may use one Trial. Registration alone or an invitation from a colleague does not start a Trial. Repeating the start does not create a new allowance. If an organisation starts further Trials through additional accounts, we may end them. We may extend a Trial or its allowances by e-mail.

2.4 Not included. The Trial has no service level agreement, no guaranteed availability and no guaranteed response time. It does not include individual expert work, submission of reports to authorities, single sign-on or on-premise installation.

2.5 Changes to the Service. We may change the Service during the Trial for maintenance, security and further development, provided that the functions listed in clause 2.1 remain available in substance and the allowances of a running Trial are not reduced.

3. Accounts and acceptable use

3.1 Users. The Customer's administrator manages invitations and roles. Credentials and programming-interface keys must be kept secret and must not be shared. The Customer is responsible for the use of its accounts and keys and ensures that its users comply with these Terms.

3.2 Permitted uploads. The Customer uploads only material it is entitled to use and to disclose for this processing. The standard workflow does not require source code. The Customer removes credentials, secrets, malware, unrelated source files and personal data that is not needed from uploads. Special categories of personal data (Article 9 GDPR) and data on criminal convictions (Article 10 GDPR) must not be uploaded.

3.3 Protection of the Service. The Customer must not bypass access controls, access data of other customers, introduce malicious code or deliberately disrupt the Service. Security tests that could affect other customers need our prior agreement in text form. Suspected vulnerabilities may be reported in good faith to support@cracken.tech.

3.4 No resale. The Trial is for the Customer's own organisation and products. Use for separate client organisations, resale, sublicensing or operating a managed compliance service needs a separate agreement. Internal comparison and benchmarking are permitted; publication of results remains subject to confidentiality, third-party rights and applicable law. Statutory rights that cannot be excluded remain unaffected.

3.5 Illegal content and point of contact. Our single point of contact for users and authorities under Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act) is support@cracken.tech, in English or German. Notices of illegal content stored in the Service may be sent to that address. If we restrict content or access, we inform the Customer of the reasons, unless the law prohibits this.

4. Results and the Customer's responsibility

4.1 Nature of the results. Findings, scores, readiness views, AI guidance, memos and reports are decision support. They depend on the input, the matching methods, the available sources and the time of the analysis. Citations support traceability; they do not guarantee correctness, completeness or legal sufficiency. A result without findings does not prove that there are no vulnerabilities. AI output can be wrong.

4.2 Human review. The Customer remains responsible for checking relevant results, prioritising remediation, deciding on reportability, meeting deadlines and making any required notifications. The Service does not submit anything to authorities. We are not the Customer's regulatory representative, incident response team, certifier or legal adviser, and the Service does not provide legal services. Using the Service does not transfer the Customer's obligations under Regulation (EU) 2024/2847 or other law to us.

4.3 Monitoring and e-mail. The Customer selects releases, schedules and recipients within the Trial. Monitoring runs on schedules and depends on when sources are updated. It is not real-time detection, and e-mail delivery cannot be guaranteed.

5. Customer data and confidentiality

5.1 Rights. The Customer keeps all rights in the data it uploads or creates in the Service ("Customer Data"). We receive only the rights needed to provide, secure and support the Service and to meet legal retention duties. The Customer may use its reports, decisions and generated recommendations for its business, also after the Trial. No guarantee of copyright protection, originality or exclusivity of AI output is given. Our software, methods and third-party source material are not transferred.

5.2 Confidentiality. Each party protects the other party's non-public business, technical and security information with at least reasonable care, uses it only for this contract and limits access to persons who need it and are bound to confidentiality. SBOMs, product details, vulnerability information and customer-specific results are confidential even if not marked. Information that is public, independently developed or lawfully received without restriction is excluded. Disclosure required by law is limited to what is required and, where permitted, notified in advance. Confidentiality continues after the end of the contract as long as the information is not public.

5.3 How we protect uploaded SBOMs and other Customer Data.

• Customer Data is stored in the European Union (database and file storage of our hosting provider Supabase in the region eu-west-1, Ireland).
• Access within the Service is limited to the Customer's organisation by row-level access rules in the database.
• Only we and automated tools under our control access Customer Data, and only to operate, secure and support the Service, to fix faults, or on the Customer's instruction.
• We do not use Customer Data to train AI models, to build a knowledge base shared across customers, for advertising or for our own product research.
• We do not name the Customer, use its logo or publish its results without its separate written permission.

5.4 Vulnerability lookups. To find vulnerabilities, the Service sends component identifiers (such as package names, versions, package URLs and CPE names) and vulnerability identifiers to public vulnerability databases. These are currently OSV.dev (operated by Google), the CVE list of the CVE Program, FIRST EPSS and the U.S. National Vulnerability Database. The Customer's name, account data and the SBOM file itself are not sent. These databases are independent third parties and are not our processors.

5.5 AI features. AI guidance and memos are generated only when a user requests them. For this, the Service sends the context of the request (finding, component, product, release and case information, including text the users entered there) together with excerpts from public sources to OpenRouter, Inc. (USA), which forwards it to the provider of the selected model (currently the OpenAI model gpt-4.1-mini). The excerpts are taken from our own search server, hosted by Hetzner Online GmbH in Germany. We have configured the AI service so that AI providers may use the data only to produce the requested answer and to detect abuse, and not to train models. The model provider may keep requests for up to 30 days for abuse monitoring.

5.6 Feedback. Feedback is voluntary. We may use non-confidential suggestions to improve the Service without payment or attribution. This does not cover Customer Data, confidential examples, source code or patent rights.

6. Personal data

6.1 For the user accounts and our own records we are the controller; see the privacy notice at https://cracken.tech/datenschutz.html#app.

6.2 For personal data contained in Customer Data we act as the Customer's processor. Annex A forms the data processing agreement under Article 28 (3) and (9) GDPR and applies from the start of the Trial.

7. End of the Trial, export and deletion

7.1 End. The Trial ends after 30 days or when the 10th analysis is completed, whichever comes first. New analyses, other new processing actions, scheduled monitoring and vulnerability notifications then stop. The workspace remains readable for at least 30 days after the end. Essential account, security and end-of-trial messages may still be sent.

7.2 Export. During the Trial and while the workspace is readable, users can download reports as PDF and report drafts as PDF or JSON in the Service. On request to support@cracken.tech we provide, free of charge and within 30 days, the original uploaded SBOM files and a machine-readable JSON export of products, releases, components, findings, decisions and cases.

7.3 Deletion. The Customer may ask us at any time to delete its workspace; we do so within 30 days. If no paid contract or agreed extension follows the Trial, we delete the workspace and its Customer Data no earlier than 30 days and no later than 90 days after the end of the Trial, after notifying the administrator by e-mail at least 14 days in advance. Backup copies are overwritten in the backup cycle of our hosting provider. We keep the records of accepted Terms and notices for three years after the end of the year in which the organisation was deleted, to prove the contract, and data we must keep by law. These records are kept apart from ordinary use.

7.4 Switching. Where Chapter VI of Regulation (EU) 2023/2854 (Data Act) applies, the Customer may request a switch to another provider or the erasure of its data through support@cracken.tech; clauses 7.2 and 7.3 apply accordingly, and no switching charges are made.

7.5 Ending the Trial early. The Customer may end the Trial at any time by e-mail to support@cracken.tech. We may end the Trial by e-mail with 14 days' notice. Our right to terminate for good cause remains unaffected.

7.6 Suspension. We may suspend affected access in proportion to the risk in case of a serious security threat, unlawful use or a material breach. We inform the Customer as soon as reasonably possible, state the reason where lawful, limit the disruption and restore access when the reason ends. For remediable breaches that are not urgent, we first give a reasonable opportunity to cure. A suspension does not remove the export and deletion rights under clauses 7.2 to 7.4.

7.7 No automatic purchase. The Trial does not turn into a paid contract. Continuing after the Trial requires a separate order. No payment is collected.

8. Support and availability

8.1 Support is available by e-mail at support@cracken.tech on German business days, 9:00 to 17:00 Berlin time; we aim to answer within two business days. There is no guaranteed availability or response time.

8.2 We may carry out maintenance. Where possible, we announce planned maintenance that interrupts the Service in advance in the Service or by e-mail.

9. Liability

9.1 We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act, under a guarantee we have given, and for defects we have fraudulently concealed.

9.2 Because the Trial is free of charge, we are otherwise not liable for slight negligence (following §§ 521 and 599 BGB). For defects of the Service we are liable only if we have fraudulently concealed them (following §§ 524 and 600 BGB).

9.3 Where we are nevertheless liable for slight negligence under mandatory law, our liability is limited to the damage that was foreseeable and typical for this kind of contract when it was concluded, and to a total of EUR 5,000 for the Trial.

9.4 Except in the cases of clause 9.1, for loss of data we are liable only for the effort needed to restore the data from copies the Customer keeps. The Customer keeps its own copies of uploaded SBOM files.

9.5 These rules also apply to the personal liability of our employees, representatives and agents. They do not change the burden of proof and do not limit rights of data subjects under Article 82 GDPR.

10. Changes to these Terms

A new version of these Terms applies to Trials started after its publication. For a running Trial it applies only if the Customer agrees to it, for example by accepting it in the Service. Publication on the website alone does not change a running Trial.

11. Notices

Notices under these Terms are given in text form (e-mail): by us to the e-mail address of the Customer's administrator, by the Customer to support@cracken.tech.

12. Final provisions

12.1 Governing law. German law applies. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

12.2 Transfer. We may transfer this contract to a company that we control and that takes over the operation of the Service, in particular the operating company being founded. We will inform the Customer at least 14 days in advance by e-mail; the Customer may then end the Trial with effect from the transfer.

12.3 Place of jurisdiction. Where the Customer is a merchant (Kaufmann), a legal person under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the courts competent for the Provider's place of business (Geldern, Germany) have exclusive jurisdiction, to the extent permitted by law (§ 38 of the German Code of Civil Procedure).

12.4 Severability. If a provision is invalid, the rest of these Terms remains valid. The statutory rules apply in place of the invalid provision.

Annex A — Data processing terms (Article 28 GDPR)

A.1 Subject, duration, purpose. We process personal data contained in Customer Data on the Customer's behalf to provide, secure and support the Service during the Trial and the period under clause 7, and then delete it under clause 7.3. Operations: storage, parsing, matching, retrieval, generation, display, logging, sending of configured e-mails, support, export and erasure.

A.2 Data subjects and data. Data subjects: the Customer's users and invited persons, configured e-mail recipients, and persons named in uploaded files, notes, cases or evidence. Data: names and business contact details, e-mail addresses, roles, user and organisation identifiers, invitations, activity and audit records (who did what and when, including times recorded in reporting cases), notes and file contents containing personal data, delivery status of e-mails. Special categories (Article 9 GDPR) and data on criminal convictions (Article 10 GDPR) are not part of the processing.

A.3 Instructions. We process the data only on the Customer's documented instructions. These Terms, the settings chosen in the Service and instructions by e-mail from the administrator are the instructions. Where Union or Member State law requires other processing, we inform the Customer beforehand, unless the law forbids it. We inform the Customer without delay if we consider an instruction to infringe data protection law.

A.4 Confidentiality. Persons authorised to process the data are bound to confidentiality and have access only as far as needed. Automated tools under our control access the data only for operation, support and security.

A.5 Security (Article 32 GDPR). We maintain at least these measures:

• access within the Service limited to the Customer's organisation by row-level rules in the database, with roles for administrators and members;
• confirmation of the e-mail address before a Trial starts; passwords of at least 8 characters, stored by the authentication service only in hashed form;
• programming-interface keys stored only as hashes;
• encrypted transmission (HTTPS) between browser, Service, our search server and our providers;
• service credentials kept only on the server side;
• audit records for reporting cases and for accepted notices;
• backups by the hosting provider.

We may adapt the measures to the state of the art, provided the level of protection is not reduced.

A.6 Sub-processors. The Customer authorises the sub-processors listed in A.9. We inform the administrator by e-mail at least 14 days before we add or replace a sub-processor. The Customer may object for good reason within that period; if we cannot address the objection, the Customer may end the Trial before the change takes effect. We impose data protection obligations on each sub-processor that are no less protective than this Annex and remain responsible for them towards the Customer.

A.7 Assistance. Taking into account the nature of the processing, we help the Customer to answer requests of data subjects and to meet its duties under Articles 32 to 36 GDPR. We forward requests from data subjects that concern Customer Data to the Customer and do not answer them ourselves unless instructed.

A.8 Personal data breaches. We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information then available, and provide further information as it becomes available.

A.9 Sub-processors and transfers (status 21 October 2026).

E-mails that the Customer sends to support@cracken.tech are forwarded by IONOS SE to our mailbox at Google Workspace. We process them as part of the support.

A.10 End of processing. At the end of the processing we delete Customer Data or, at the Customer's choice, return it first, as described in clauses 7.2 and 7.3, unless the law requires us to keep it.

A.11 Information and audits. We provide the information needed to show compliance with Article 28 GDPR and allow audits by the Customer or an auditor it appoints, after reasonable notice, during business hours and subject to confidentiality. Ordinary information is free of charge.

A.12 Liability. Liability under this Annex follows clause 9, except where Article 82 GDPR or other mandatory law provides otherwise.

Back to start