Terms of Service

KROMSE is workflow software. It scans connected repository code, uploaded SBOMs and firmware, and selected container images. It collects security evidence and helps your team organize it into drafts a human reviews.

KROMSE does not do the following, and no part of these terms should be read as saying otherwise:

• KROMSE supports evidence and human review; it does not certify legal compliance.
• KROMSE is not a filing channel. Drafts require human approval and are never submitted automatically to a CSIRT, to ENISA, to a supervisory authority, or to any other external recipient.
• KROMSE does not provide legal advice. Its output is an operational signal, not an opinion on your obligations under the Cyber Resilience Act, NIS2, the AI Act, or anything else.
• KROMSE does not guarantee that a scan finds every vulnerability in your code, or that a finding it reports is genuine. Scanner output requires human judgement.

A conclusion about your regulatory position, and any decision to notify anyone of anything, remains yours and your advisers'.

KROMSE is operated by Kromse Labs, S.L., identified above. Your checkout page and invoice show the seller of your subscription. For questions about an existing subscription, contact info@kromse.com.

The service is offered for professional and work use, including by freelancers and self-employed people. "You" means the person or organization purchasing or using the service for that purpose. If you act for an organization, you must have authority to bind it; a business email address alone does not establish that authority. Describing a purchase as professional use or accepting these terms does not remove consumer status or mandatory rights where the law actually grants them.

KROMSE is under active development. Available features and operational limits are described in the application and current documentation. Creating a workspace alone does not authorize a subscription charge. A subscription requires selecting a plan and accepting the checkout payment terms.

For new subscriptions, Basic costs €59 per month and Pro costs €299 per month. Monthly plans are charged immediately, have no trial, and renew monthly until cancelled. Annual Basic costs €588 per year and annual Pro costs €2,988 per year, charged upfront for the full year after the trial described below, and renew annually until cancelled. These prices exclude applicable VAT. The currency, applicable taxes, total payable and renewal terms are shown before you confirm checkout.

Eligible new annual subscriptions include one seven-day trial per workspace and require a payment card. A workspace that has already received a trial is not eligible for another; renewals have no new trial. Where no trial applies, a new annual subscription is charged immediately. Unless you cancel before the trial ends, the selected annual price is charged automatically at the trial end shown in checkout. Cancelling before that time prevents the annual subscription charge and retains trial access until the original seven-day trial end. Separately purchased usage credit remains a separate purchase. The trial is a contractual offer and does not replace any statutory withdrawal right.

Basic includes AI usage credit and Pro includes 5× Basic's AI usage credit per monthly credit period, including on annual plans; the AI usage credit included in Enterprise is customizable and agreed in writing. Included credit resets monthly: unused included credit expires and is replaced by the next monthly allowance; it does not accumulate. Extra usage is available to buy, and purchased top-up credit carries over between these periods until used. The annual trial receives a separate, one-off trial allowance sized to the selected plan, Basic or Pro; unused trial credit expires at trial end and the first paid month starts with a fresh included allowance.

Metered AI and search usage consumes available credit at the rates KROMSE applies; the application shows your usage as a percentage of your allowance. There is no fixed search quota: available usage is funded by the credit balance, subject to the selected plan, supported features, technical capacity and acceptable-use rules. A funded balance does not promise unlimited throughput or uninterrupted provider availability. Credit is for service usage, not a cash deposit or a promise of cash redemption.

After payment, cancelling stops the next renewal and preserves access for the paid subscription term. Cancellation does not routinely entitle you to a partial-term refund, a refund for unused included credit, or a refund of credit already used. Duplicate or incorrect charges will be corrected, including refunds where appropriate. These rules do not limit mandatory withdrawal, conformity, termination or refund rights. Use the billing controls to cancel, or contact info@kromse.com for billing assistance. Existing subscriptions retain their previously agreed commercial terms until a valid change is made under section 12; accepting this document alone does not migrate them to these new prices or trials.

Authentication is handled by our authentication provider. You are responsible for the accounts you invite into your workspace, for the roles you grant them, and for removing people who should no longer have access. Actions taken in your workspace are recorded in a tamper-evident audit trail attributed to the user who took them.

By attaching an input and starting a scan, you instruct KROMSE to:

• Read repository code at the selected commit through your approved GitHub App installation or the Git source you attach, including public Git repositories.
• Read the SBOM or firmware you upload, or retrieve the container image reference you select from its registry. An SBOM scan covers the components it lists, not an independent inspection of the whole product.
• Run scanners in temporary working directories and remove those working copies when processing finishes. Uploaded firmware is also retained as a product input, as described in the Privacy Policy.
• Store the resulting scan evidence, encrypted, for the retention period of your plan.
• Send supported component and advisory identifiers to vulnerability-data services for lookup and enrichment, including during deterministic scans, as detailed in the Privacy Policy.
• Send a bounded, secret-redacted selection of your code to an AI provider — but only for a scan where you have explicitly selected an AI model for that purpose.

You are responsible for the rights needed to provide each repository, SBOM, firmware file or container image, including any third-party content it contains.

The Privacy Policy describes precisely what is received, stored, and transmitted. Read it before connecting anything.

A separate AI processing policy (Configured providers / EU-only / Deterministic-only) applies in addition to the AI data setting. Both settings must permit an AI request. EU-only and Deterministic-only currently block all customer AI, with no fallback provider: no EU AI endpoint is approved. A deterministic-only scan never sends repository source code or excerpts to AI; chat and verdicts can use its findings metadata, including attached scans and findings. Workspace Off blocks new requests. Stored verdicts remain visible with their recorded model and date.

Scans default to deterministic analysis with no repository source code sent to an AI provider. Optional code review requires selecting an AI option for that scan. Sending a chat message sends that message and bounded workspace context to OpenAI. Current chat can retrieve relevant workspace evidence and use OpenAI web search for external information; queries and selected context needed for those operations are processed by OpenAI. The workspace AI setting defaults to metadata-only, allowing paths and line numbers but no automatic source excerpts or repository read tools. Code-excerpts enables bounded redacted source reads for eligible features; Free verdicts never list or read repository files. Workspace Off blocks new AI requests. Deterministic-only scan choice blocks source code and excerpts, while chat and verdicts may use findings metadata. Stored verdicts remain visible with their recorded model and date. Your own messages can contain code even in metadata-only mode. Supported text and Office documents are parsed within KROMSE; external OCR and PDF/image reading are disabled.

These actions have different inputs, described in the Privacy Policy. Provider retention and other data controls depend on the applicable account configuration and provider terms; these terms make no fixed retention or whole-product EU-only processing promise.

AI output is a hypothesis for a human to check. It is presented as such in the product and should be treated as such.

• Scan only code you are entitled to scan.
• Do not use KROMSE to attack, probe, or test systems you do not own or have written permission to test.
• Do not attempt to reach another customer's workspace, or to circumvent the scoping that keeps workspaces separate.
• Do not upload malware for distribution, or use KROMSE to develop or stage an attack.
• Do not present KROMSE output as a certification, an audit, or legal advice — to a regulator, a customer, or anyone else.

Your code, your evidence, and everything your team writes into the workspace remain yours. KROMSE claims no ownership over them and uses them to operate the service for you.

KROMSE does not use your source code or your workspace content to train machine learning models, and does not sell it. Where an optional AI provider is used, that provider's own terms govern what it does with the request; the Privacy Policy names each provider and the retention position KROMSE has been able to confirm.

The software, interface, and documentation remain KROMSE's.

KROMSE aims to provide the subscribed service with reasonable care and skill. Unless separately agreed in writing, no specific uptime percentage, round-the-clock support, service credits or fixed support response time is promised. Maintenance, technical faults and third-party outages may interrupt service. This does not remove obligations for the paid service or remedies that cannot lawfully be excluded. Support and service questions can be sent to info@kromse.com.

You may stop using KROMSE and disconnect your repositories at any time. Disconnecting a GitHub installation does not remove separate Git sources or erase stored workspace records. KROMSE may suspend access for misuse described in section 7.

Stopping use or disconnecting a repository does not itself cancel a subscription; cancellation follows section 3. Suspension for misuse will be proportionate to the risk or breach, with notice and an opportunity to remedy where reasonably practicable. Urgent action may be needed to protect the service, data or others. Suspension does not extinguish any refund or other remedy required by law.

For data return or workspace closure, contact info@kromse.com. Kromse Labs S.L. handles the request after verifying the workspace owner and agreeing its scope. Available SBOM, audit and report downloads cover their stated scope. Wider data return and erasure require a manual operator process; archiving a product is not workspace erasure. Shared accounts, provider records and backups are reviewed separately. Completion is confirmed with any retained categories and remaining steps identified; no fixed deletion turnaround is promised here.

KROMSE provides assistance, security evidence and draft materials for human review. It does not guarantee complete vulnerability detection, that every finding is correct, that a product is secure, or that you comply with any law or standard. You must verify findings, sources, recommendations and drafts before acting on them, deploying changes or submitting material. These limits on the purpose of the service do not excuse KROMSE from performing its own contractual obligations with reasonable care and skill.

To the extent permitted by applicable law, KROMSE excludes liability for indirect or consequential loss, including lost profit, lost business opportunity or business interruption to the extent such loss is indirect or consequential. Subject to the exceptions below, KROMSE's total aggregate liability arising from or relating to the service or these terms is limited to the fees actually paid by you for the affected service in the twelve months preceding the event giving rise to the claim.

The exclusions and cap do not apply to fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any liability that applicable law does not allow to be excluded or limited. They do not restrict mandatory consumer rights, statutory data-protection rights or remedies, or duties and liability that cannot be limited under applicable law. Nothing here removes KROMSE's own security, confidentiality or data-protection obligations. A failure to perform those obligations remains actionable; any cap applies only insofar as the law permits it.

These terms are governed by Spanish law. Disputes are subject to the courts competent under applicable law; no exclusive forum is imposed where a mandatory jurisdiction rule provides otherwise. If you are legally a consumer, this choice of law does not deprive you of mandatory protection afforded by the law of your habitual residence where applicable. No declaration of professional use, checkbox or acceptance of these terms waives rights that cannot lawfully be waived.

The current document version is displayed on this page. When required documents change, KROMSE records the version and requests acceptance at the next use of the application, retaining earlier acceptance records. This records acceptance and is not itself advance notice of a commercial change. Existing subscriptions keep their agreed prices, billing periods, trial conditions and other commercial terms until a change is validly made with applicable notice, consent and cancellation rights. Changes are not retroactive. Material changes will be communicated before they take effect as required by law or the applicable agreement; any new price must be disclosed before a renewal at that price. A separately agreed written arrangement applies to the parties and services it identifies, subject to mandatory law.

For questions about these terms, contact info@kromse.com.