These terms (the "Terms") govern the SBOM Watch service provided by Chen Embedded Software LLC, an Arizona limited liability company ("Provider"), to the business that subscribes ("Customer"). By ticking the acceptance box at checkout, or replying "I accept the SBOM Watch terms", the Customer agrees to these Terms. The service is for businesses only, not consumers.
Plans:Single product (one firmware line) or Product family (up to 5 firmware lines sharing a code base), billed monthly at the price shown at checkout.
Service. Once per day, Provider scans the SBOM(s) the Customer supplies against public vulnerability databases (including NVD, GitHub advisories, OSV and the CISA KEV catalog) and emails alerts for newly matched vulnerabilities. For vulnerabilities listed as actively exploited, the alert includes a draft ENISA early-warning text. The service is automated and informational. Draft texts are templates. Provider never submits reports to any authority and gives no legal advice.
Customer responsibilities. The Customer keeps its SBOMs accurate and current, monitors the alert email address, evaluates each alert, and decides on and submits any report to authorities. **Art. 14 CRA reporting remains the Customer's obligation as manufacturer.** The Customer must not rely on this service as its only means of becoming aware of vulnerabilities.
Access credentials. If the Customer gives Provider a token to fetch SBOMs, it must be read-only and limited to the SBOM location. The Customer may revoke it at any time. Provider stores it encrypted and uses it only for the service.
Export controls. The Customer represents that the monitored products and SBOMs are not ITAR-controlled, and that it is not on a U.S. restricted-party list or located in a comprehensively sanctioned country or region. Provider may suspend or terminate immediately if this is untrue, refunding prepaid fees for the unused period.
Availability and accuracy. The service depends on third-party data and infrastructure (including GitHub, vulnerability databases and email delivery). Provider does not guarantee that every vulnerability will be detected, that matches are correct, or that alerts arrive within any particular time. Missed, late, false or duplicate alerts are not a breach. Provider will make reasonable efforts to restore the service promptly after an outage.
Disclaimer. THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND ACCURACY.
Limitation of liability. PROVIDER'S TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE IS LIMITED TO THE FEES PAID BY THE CUSTOMER IN THE THREE (3) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, LOST PROFITS, SECURITY INCIDENTS, PRODUCT RECALLS, OR REGULATORY FINES OR PENALTIES (INCLUDING UNDER THE CRA), even if advised of their possibility, to the fullest extent permitted by law (this does not limit the Customer's payment obligations or §4). Claims may be brought only against Provider (the LLC), not its members, managers, employees or contractors personally. Claims must be brought within one year of the event.
Fees, payment and changes. Payment, taxes, receipts and refunds are handled by Provider's reseller and merchant of record (currently Lemon Squeezy) under its buyer terms. These Terms govern the service itself. Provider may suspend the service if payment fails. Provider may change prices or these Terms with 30 days' email notice. Continued use after that is acceptance, and the Customer may cancel instead.
Term and cancellation. Monthly, renewing automatically. Either party may cancel at any time, effective at the end of the current billing month. There are no penalties, service credits or partial-month refunds.
Data. SBOMs, alerts and contact details are confidential and used only to provide the service. They are processed using GitHub (USA) and Google email services, and the Customer consents to this. On cancellation and request, Provider removes Customer data from active systems within 30 days. Residual copies in version history or backups remain confidential and are purged when practicable.
General. Arizona law governs (excluding conflict-of-law rules and the UN CISG). Courts in Maricopa County, Arizona have exclusive jurisdiction. If any provision is unenforceable, it is enforced to the maximum extent permitted and the rest remains in effect. Neither party is liable for events beyond its reasonable control (payment excepted). These Terms are the entire agreement for the service and override any purchase-order terms.
Chen Embedded Software LLC · chenembeddedsoftware@gmail.com · Version 2, 12 October 2026