Terms of service

Between ExploitClock LLC ("we") and the business customer ("you") · Last updated: 11 September 2026

Privacy · Terms · DPA · Security · Imprint

1. The service

ExploitClock is software that monitors software bills of materials against public vulnerability and exploitation feeds, tracks deadlines under Regulation (EU) 2024/2847 (Cyber Resilience Act) Article 14, produces draft notifications, and keeps an evidence log. It is a tool for your compliance process; it does not file notifications on your behalf, it does not make you compliant, and it is not legal advice.

2. Your responsibilities

You remain the manufacturer responsible for determining awareness, assessing exploitability, filing notifications with the ENISA Single Reporting Platform and your coordinating CSIRT within the legal deadlines, and for the accuracy of everything you submit. Feeds can be late or incomplete; the absence of a match is not proof of the absence of a vulnerability or of exploitation. Keep your alert channels and contact details current, and keep your own copy of the evidence by exporting regularly.

3. Accounts and plans

Plans are limited by number of active products as shown on the pricing page. Trials convert to the free (zero-product) state unless a plan is purchased. Fees are billed in advance monthly or annually via Stripe; you may cancel at any time and retain access to the end of the paid period. Prices exclude VAT. Single sign-on (SAML or OIDC through Auth0) is available on request and is not part of the self-serve plans.

4. Data

You own your data: your products, SBOMs, cases, drafts and evidence log. We process it as described in the Privacy notice and the Security page, and we act as your processor for personal data you upload under the Data Processing Agreement. You may export all of it at any time from Settings, in a documented JSON format. We do not use your data to train models and we do not sell it.

5. Availability

We aim for 99.9% monthly availability on paid plans. This is an operating target and not a warranty; there is no service credit scheme. The status page is the source of truth for current state, incidents and scheduled maintenance, and maintenance is announced there in advance. The service runs in a single EU region, so a regional outage takes it down. Because your deadlines do not pause, configure at least two alert channels.

6. Liability

To the extent permitted by law, our aggregate liability under these terms is limited to the fees you paid in the twelve months preceding the claim. We are not liable for regulatory fines, indirect or consequential loss. Nothing limits liability for wilful misconduct or where it cannot be limited by law.

7. Termination and what happens to your data

Either party may terminate for material breach not cured within 30 days. You may cancel a subscription at any time and keep access to the end of the paid period.

• You can export the complete account at any time while it exists, including after cancellation, from Settings. There is no separate export window to wait for and no request to file.
• Deleting the account in Settings is immediate and irreversible. It removes your products, SBOMs, cases, drafts, evidence log, settings, API keys and invites and anonymises the account record. There is no grace period and no undo, so export first.
• If the contract ends by termination or non-payment and you have not deleted the account yourself, we delete the account data within 90 days of the end of the contract. This is a step we run, not an automatic timer in the product, and we send an export reminder to the account owner before we do it. Weekly database backups roll off after twelve weeks.
• We keep billing and accounting records for the statutory retention period.

8. Support

• Channel: email support@exploitclock.com. Everything, including security reports and DPA signature requests, goes there.
• Hours: Monday to Friday, EU business hours, excluding public holidays at our place of establishment.
• Target first response: 2 business days on all plans, 1 business day on Unlimited. These are targets, not contractual response times, and they cover the first human reply, not resolution.
• Security reports: acknowledged within 2 business days; see the Security page.
• Incidents: the status page is the source of truth. Please check it before reporting an outage.

The clocks, feed polling and alerting run continuously and do not depend on support hours.

9. Governing law and disputes

These terms are governed by the laws of the State of Idaho, United States of America, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. Exclusive jurisdiction lies with the state and federal courts located in Idaho, United States of America, and each party submits to their personal jurisdiction. Nothing in this section deprives you of mandatory protections of the law of your place of establishment where those cannot be excluded by agreement, and it does not affect the choice of law and forum in the Standard Contractual Clauses, which govern the transfer of personal data. If a provision is invalid the remainder stands.

10. Data protection

Our Data Processing Agreement under Art. 28 GDPR, incorporating the EU Standard Contractual Clauses (Module 2, controller to processor) and the sub-processor annex, forms part of these terms and applies to every plan, on every tier, from the moment you create an account. You do not need to request it and it is not a paid add-on. Read it at https://exploitclock.com/dpa. If your procurement process needs a signed copy, email support@exploitclock.com and we will return a countersigned PDF of the same text. Where the DPA and these terms conflict on the processing of personal data, the DPA prevails.

Questions: support@exploitclock.com · Operator identity and postal address: Imprint