Legal notice

Name

CRAFT

Status

Experimental prototype

Address

France

Contact

contact@craftsec.eu

Publication

The person responsible for publication of the CRAFT website

For any question, write to contact@craftsec.eu.

Host

Vercel Inc.

Address

440 N Barranca Avenue #4133, Covina, CA 91723, United States

Contact

vercel.com/contact

Website

vercel.com

The website is hosted by Vercel Inc. Pursuant to Act No. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN), the identity of the host is stated here.

CRAFT allows you to upload an SBOM file (CycloneDX or SPDX JSON) in order to obtain a first view of components and potentially applicable public vulnerabilities, via the OSV database.

The service is experimental, offered without an account and without consideration. It constitutes neither a regulatory services contract nor an obligation to achieve a result.

The interface, texts, CRAFT trademark and graphic elements of the website are protected. Any unauthorised reproduction is prohibited.

Uploaded SBOMs remain the property of the uploader. CRAFT acquires no rights over their content beyond what is necessary to perform the requested analysis.

Vulnerability identifiers (CVE, OSV) and associated data come from public sources, notably osv.dev.

CRAFT is a prototype. In particular:

• it does not constitute legal advice;
• it does not definitively determine the scope of application of the Cyber Resilience Act;
• it does not guarantee the absence of vulnerabilities and does not constitute a regulatory notification;
• a detected CVE is not confirmation that your product is vulnerable. Human analysis remains necessary.

To the extent permitted by law, the publisher shall not be held liable for damage related to the use of the prototype, an interruption, an analysis error or a decision taken on the basis of the displayed results.

Data processing is described in the privacy policy and, for uploaded files, in what happens to your SBOM.

These notices are governed by French law. In the event of a dispute, and failing an amicable resolution, the French courts shall have jurisdiction, subject to applicable public-policy rules.