CRA Desk

Draft - pending legal review, not yet legally binding.

Terms of Service

Version 1 (Draft) Effective date: 24-08-2026

Operator: Cloudsoft Marcin Malinowski, Ku Słońcu 24E/11, 71-073 Szczecin, Poland, NIP: 599-276-18-15. Contact: contact@cradesk.eu.

1. What CRA Desk is

CRA Desk helps small and mid-sized EU software vendors work through their obligations under the Cyber Resilience Act (Regulation (EU) 2024/2847): a scope classifier, SBOM ingest and continuous vulnerability watch (NVD/OSV/CISA KEV), guided Article 14 reporting drafts, and generators for a CVD policy, a security.txt and a technical documentation skeleton.

CRA Desk is a compliance aid, not legal advice, and not a substitute for the Customer's own judgment. It never files anything with ENISA or a CSIRT on the Customer's behalf - every draft it produces is reviewed and submitted by a human at the Customer.

2. Who can use the service

The service is offered to businesses (B2B) acting in a professional capacity, not to consumers. An account is created by self-signup; the person completing signup confirms they are authorised to act for the organisation they register.

3. Confidentiality of your SBOM data

A Software Bill of Materials is a map of your product's dependencies, and a match against a known vulnerability is, in effect, a map of where an attacker would look first. The Operator treats both as confidential: encrypted at rest under a dedicated key, isolated per customer, and never included in logs. This commitment is contractual and applies regardless of whether the underlying data happens to include personal data

  • see the Privacy Policy for the personal-data side of that same inventory, and the DPA for the Operator's obligations as a processor.

4. Plans and billing

The service is offered on a Free plan and on paid subscription plans (published on the homepage), billed monthly in advance through Stripe. An invoice is issued through inFakt after payment is collected. Prices and plan limits may change for future billing periods; the price and limits in force when a period was paid do not change retroactively for that period. As this is a B2B service, the statutory right of withdrawal that applies to consumer contracts does not apply here.

5. Acceptable use

The Customer may not use the service to upload data it is not entitled to disclose, to attempt to access another tenant's data, or to interfere with the service's operation. The Customer remains responsible for the accuracy of the information it enters into the scope classifier and for deciding, filing and tracking any regulatory submission the service helps it draft.

6. Limits of the service

  1. The service supports the Customer in carrying out its CRA obligations; the obligations themselves - including reporting deadlines - remain the Customer's.
  2. Vulnerability source coverage is stated openly (NVD, OSV, CISA KEV); the Operator does not warrant that this coverage is complete.
  3. The scope classifier's verdict is based on the answers the Customer provides and may need revisiting as implementing acts refine product categories - the ruleset version behind each verdict is always shown.
  4. No report or notification is ever submitted to a regulator by the Operator - the service drafts content; the Customer files it.

7. Term and termination

A subscription runs until cancelled. Cancelling a paid plan takes effect at the end of the current billing period; no partial refund is given for a period already paid. The Operator may suspend or terminate an account for a material breach of these Terms.

8. Account closure and data

Closing an account starts a 30-day grace period during which the closure can be cancelled. After that period, the Customer's data is deleted as described in the Privacy Policy, with the narrow exceptions that section lists (invoicing records the Operator is legally required to keep).

9. Changes to these Terms

The Operator may amend these Terms by publishing a new version at a new address (the next version of this document), stating its effective date. A change takes effect for new billing periods; it does not apply retroactively to a period already in progress.

10. Governing law

These Terms are governed by Polish law. [To be confirmed by legal review - see Q1 in the review package.]