Legal · Version 1.0 · Effective 27 July 2026

Terms of service

The contract between you and DNS Ventures LLC for CRA Kit. What we do, what we do not do, what you pay, and who is responsible for what.

These terms are the agreement between you and DNS Ventures LLC for the use of CRA Kit at https://cra.synthworx.com. Using the service means you accept them. If you are accepting on behalf of a company, you are confirming you have the authority to bind it.

1. Who we are

CRA Kit is operated by DNS Ventures LLC, a limited liability company registered in the State of Wyoming, United States of America, at 30 N Gould St, STE R, Sheridan, WY 82801, United States of America. You can reach a person at hello@synthworx.com.

2. What CRA Kit is

CRA Kit is software. It reads what you give it, matches your components against public vulnerability feeds, and drafts the documents the EU Cyber Resilience Act asks a manufacturer to hold. It keeps that evidence, versioned and dated, and it helps you prepare an Article 14 notification inside the deadline.

3. What CRA Kit is not

We are not a notified body. We are not a conformity assessment body. We are not a law firm and we do not give legal advice.

Nothing the service produces is a conformity assessment, a certificate, or a legal opinion. The determination, the risk assessment, the declaration of conformity and every other document are drafts built from your own answers and your own data. You check them. You sign them. You remain the manufacturer, and the obligation to place a compliant product on the market stays with you.

We do not file anything with ENISA on your behalf. ENISA has stated that no application programming interfaces are provided for the Single Reporting Platform at this stage, so submission is manual entry into their portal by you. What we produce is the notification, prepared and validated in their field order.

4. Your account

• Sign-in is by a link emailed to you. Anyone with access to that mailbox can reach your account, so treat it as you would a password.
• You are responsible for what the people you invite do in your account. Roles are owner, admin, editor and viewer, and you control who has which.
• Keep your organisation details accurate. Your legal name, address and country go onto the EU declaration of conformity we generate. A wrong address there is a wrong address in your technical file.

5. What you may upload

You may upload firmware, build manifests and documents that you have the right to analyse. That is either your own product, or a product you have been authorised in writing to examine. The full rules are in the acceptable use policy, which forms part of these terms.

6. Your data stays yours

You own everything you put in and everything the service produces from it: your SBOMs, your findings, your documents, your VEX statements, your cases and your audit trail. We do not claim any ownership of it.

You grant us the limited right to store, process and display that data for one purpose only, which is running the service for you. That right ends when you delete the data or close the account, except where we are keeping something because the law or your own ten-year retention setting requires it.

We do not use your firmware or your data to build our component signature pack, to train any model, or for any purpose other than serving your account. We count operational things like how many scans ran, and those counts carry no customer data.

You can export everything in open formats at any time: CycloneDX, SPDX, OpenVEX and CSAF in and out. Evidence bundle download stays available on any account that has ever held a paid plan, including after that plan ends. Holding your own evidence hostage to a subscription is not something we are willing to do.

7. Plans, price and tax

• Prices are published on the pricing page. There is no quote and no sales call.
• Payments are handled by Dodo Payments as merchant of record. They are the seller for the transaction, they collect VAT or apply reverse charge, and they hold the card. We never see or store card details.
• Monthly plans renew every month. Annual plans are billed once a year at ten months of the monthly price and renew every year.
• Changing plan mid-period is prorated immediately by Dodo, not deferred to your renewal.
• We may change prices. Existing subscribers get at least 30 days notice by email, and a change never applies to a period you have already paid for. If you do not want the new price, cancel before it takes effect.

8. Cancellation

You can cancel at any time from the billing screen, with nobody to email and no retention call. Cancelling stops the subscription at the end of the period you have already paid for. You keep every feature of your plan until that date, no further payment is taken, and one button puts it back if you change your mind before then.

Refunds are covered by the refund and cancellation policy, which forms part of these terms.

9. What we promise

• Every feature listed on the pricing page works as described. We check the pricing page against production automatically, and a bullet that stops being true gets deleted or fixed rather than left standing.
• We do not fabricate a measurement. Binary analysis reports what it read out of your image, with the file, the offset and the matched string. A component whose version we could not recover is reported as version unknown, never as a guess.
• Components we cannot match to a vulnerability feed are named, with the reason, in the product view, on your trust page and in every export.
• We do not state a regulatory fact we have not read in the primary source. Provenance for the ruleset is published in our changelog and every artifact carries the ruleset version it was produced under.

10. What we do not promise

We do not offer a contractual uptime guarantee. If the service is unavailable for more than 72 consecutive hours, tell us and we will refund that time pro rata.

Vulnerability feeds are third-party data. NVD, CISA KEV, FIRST EPSS, the GitHub Advisory Database and ENISA EUVD publish what they publish, and a vulnerability that is absent from all of them is a vulnerability we cannot show you. Binary analysis identifies components by their version banner, so statically linked, stripped or packed code can be invisible to it, and the scan records that in its warnings.

Compliance is not a thing software can guarantee. A conformity assessment body, a market surveillance authority or a court can reach a different conclusion from the one our ruleset reaches.

11. What you are responsible for

• Reading what we produce before you rely on it, and filling in the gaps we mark.
• Filing your own Article 14 notifications, within your own deadlines.
• Getting legal advice where you need it. We are not a substitute for it.
• Having the right to upload whatever you upload.

12. Suspension

We can suspend an account that is breaking the acceptable use policy, that has not paid, or that is causing a real problem for the service or for someone else. Except where the harm is immediate, we email you first and give you a chance to fix it. Suspension for non-payment does not delete anything.

13. Our intellectual property

The service, its software, its component signature pack, its ruleset and its document templates are ours. You get a licence to use them for your own compliance work while your account is open. The documents the templates produce for you are yours to keep, publish and rely on, including after you leave.

If you send us an idea or a bug report, we may act on it without owing you anything for it.

14. Confidentiality

We treat your firmware, your findings and your unreleased vulnerability information as confidential. We do not disclose them to anyone except our sub-processors, who are bound to the same standard, and except where a law compels us. If we are compelled, we will tell you unless we are prohibited from telling you.

Trust pages are the one place your data becomes public, and only the parts you publish, only when you publish them.

15. Warranties

Beyond what section 9 says, the service is provided as it is. We disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement to the extent the law allows. Nothing in this section limits your statutory rights as a consumer.

16. Liability

Neither side is liable to the other for indirect or consequential loss, loss of profit, loss of business, or loss of data beyond the cost of restoring it from your own exports.

Our total liability for all claims arising out of these terms in any twelve-month period is capped at the amount you paid us in the twelve months before the claim arose. On the free plan that amount is zero, which is the trade you make for a product that costs nothing and asks for no email address.

Nothing here excludes liability for fraud, for death or personal injury caused by negligence, or for anything else that cannot be excluded by law.

17. Your indemnity to us

If you upload something you had no right to upload, and we are sued over it, you cover our reasonable costs and damages. That is the whole indemnity. It exists because we cannot tell from a binary image whether you were entitled to analyse it.

18. Term and ending it

These terms run while you have an account. You end them by cancelling and closing the account. We can end them on 30 days notice, and if we do while you have paid for a period, we refund the unused part of it.

Closing an account does not delete your data on its own. Ask us to erase it and we will, through an authorised erasure path that removes rows the audit triggers otherwise protect. Some records survive erasure because the law requires it, and the suppression list that stops us emailing you survives on purpose.

19. Changes to these terms

We will change these terms from time to time. Every version carries a number and a date, and the history is at the bottom of this page. For a change that materially reduces your rights we email account owners at least 30 days before it takes effect, and you can cancel before then. Small corrections take effect when published. This version is 1.0, effective 2026-07-27.

20. Law and disputes

These terms are governed by the laws of the State of Wyoming, United States of America, without regard to its conflict of law rules, and the courts there have jurisdiction.

If you are a consumer resident in the European Union or the United Kingdom, this does not take away the protection of the mandatory consumer law of the country you live in, and you can bring proceedings there.

21. The rest

• These terms, the refund and cancellation policy, the acceptable use policy, the privacy policy and, where it applies, the data processing addendum are the whole agreement between us.
• If a court finds one clause unenforceable, the rest still stands.
• Not enforcing something once does not mean we have given it up.
• You cannot transfer this agreement without our written consent. We can transfer it if the business is sold, and we will tell you.

Contact

DNS Ventures LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America. Email hello@synthworx.com and a person answers.

Version history

DNS Ventures LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America. Questions about this document go to hello@synthworx.com and a person answers.