1. Our agreement with you
These terms govern your access to and use of VulnBeacon: its web application, its API, its reports, its integrations and its MCP service (Model Context Protocol).
“VulnBeacon”, “we”, “us” and “our” mean the company that operates the service, identified in our Legal notice and in your order or access confirmation. You can reach us at contact@vulnbeacon.com.
“You” means the individual or the organisation entering into the agreement. If you accept these terms for an organisation, you confirm that you are authorised to bind it.
VulnBeacon serves both business customers and consumers. A consumer is an individual acting outside their trade, business or profession. A provision expressly limited to business customers does not apply to consumers.
There is no public sign-up: an administrator creates your account once access has been requested. The agreement begins when you accept these terms, directly or through an order that incorporates them, and we confirm your access. Visiting the website creates no subscription.
Your order or access confirmation states the features, duration, limits and any charges of your access. A separately agreed data processing agreement governs the processing we perform on your behalf. Mandatory law prevails over every contractual document. Terms expressly agreed in an order prevail over these general terms, but they cannot remove a mandatory consumer right.
2. What the service provides
VulnBeacon analyses software bills of materials (SBOMs), supported dependency manifests and related product information against vulnerability records and package intelligence.
Within the features of your access, the service organises findings, supports prioritisation and release decisions, tracks remediation and exceptions, and produces reports, VEX statements and evidence for reviews.
Results depend on the information you submit and on the intelligence available at the time. VulnBeacon does not certify that software is free of vulnerabilities, and it does not guarantee that every affected component will be identified.
Compliance views describe readiness and the evidence available. They are not certifications, regulatory approvals or legal advice.
You remain responsible for judging findings in their context, validating proposed changes and deciding whether a release or a remediation is appropriate. This does not relieve us of supplying the service as agreed or of meeting the standards the law sets.
3. Accounts and access
Provide accurate account information and keep it current. Protect your password, your API keys and your integration credentials, and tell us at once if you suspect that someone else has used them.
Our administrators can block an account and close it on request. If your organisation requested your account, it must tell us when your access should end.
A Product CI key and a Supplier key may be used only for the products they name and the operations they allow.
You must have the legal capacity to enter into this agreement. Where the law requires the authorisation of a parent, a guardian or an organisation, it must be obtained before access is provided.
4. Permitted use
During your agreed access period, you may use VulnBeacon for your own purposes or for your organisation’s authorised activities, within the applicable feature and usage limits.
You must not:
- Submit information you have no right to provide.
- Access another customer’s information or bypass permissions.
- Circumvent usage limits or security controls.
- Disrupt the service or introduce malicious material.
- Use the service to facilitate unlawful exploitation, fraud or infringement.
- Resell access or provide services to third parties, unless your agreement permits it.
- Copy or reverse engineer protected parts of the service, except where the law or a relevant licence permits it.
Being able to analyse information about software does not authorise you to test that software, its vendor or its infrastructure. Security testing of VulnBeacon itself requires our separate authorisation.
5. Your information
“Customer Data” means the SBOMs, dependency inventories, product details, annotations, decisions, policy settings and other information that you or your authorised users submit.
You keep your rights in Customer Data. You permit us to host, process, reproduce and transmit it as far as necessary to provide the service, follow your instructions, keep the service secure, give the support you ask for and meet legal obligations. This permission gives us no general right to publish your confidential information.
The analysis is built for SBOMs and dependency manifests. Do not submit passwords, private keys, source code the analysis does not need, or personal information the service does not need.
You are responsible for holding the rights and the lawful basis needed to submit information and to instruct its processing. Where the law requires a data processing agreement for personal information processed on your organisation’s behalf, it must be in place before that information is submitted.
6. External intelligence and integrations
To check the health of your dependencies and to run the pull-request check, the service sends package identifiers to the package-intelligence services and registries listed in section 4 of our Privacy notice. You authorise these lookups. They never carry a whole SBOM, but a private package’s name can still disclose something about your software: tell us before you upload confidential identifiers if your use requires the lookups to be restricted.
When you enable an integration, you authorise the exchange its configured purpose needs. An alerting or ticketing integration, for example, receives product details, findings and links into the application.
Independent services have their own terms and privacy practices. We remain responsible for our own obligations and, as the law requires, for the providers acting on our behalf.
7. Assistants and MCP
Through MCP, an assistant or client you choose acts on VulnBeacon with the API key you give it. It can read, or act, only as far as that key allows.
You choose the client, you decide which key it receives, and you review the actions you let it take. Our Privacy notice explains how the hosted MCP endpoint handles your key.
We do not use Customer Data to train AI models. The assistant’s provider processes your prompts, the information retrieved and the answers under its own terms.
Check an assistant’s conclusions against the underlying evidence before you rely on them.
8. Confidentiality and security
Each party will protect the other’s non-public business, technical and security information with reasonable care and use it only for the purposes of the agreement. Access is limited to the people and providers who need it and who are bound by appropriate confidentiality obligations.
This does not cover information that is lawfully public, independently developed, already known without restriction or lawfully obtained from someone else. A disclosure the law requires may be made, with notice where notice is permitted.
We maintain measures to protect accounts and Customer Data, including access controls, the protection of credentials and security logging. No online service can prevent every incident. Where an incident triggers notification duties under the law or a data processing agreement, we will meet them.
A shared report link makes the selected report available to anyone who holds the link and, where you set one, its password, until the link expires or you revoke it. Neither expiry nor revocation can recall a copy already downloaded.
9. Service availability and changes
We will provide the service with reasonable care and skill, as described in your agreement and as the law requires. A specific availability or support commitment must be stated in your order or in a separate service level agreement.
We may change the service to keep it secure, correct faults, meet legal requirements or improve it. We will give reasonable advance notice of a material change where we can.
For consumers, a change to a continuously supplied digital service must meet the conditions the law sets. Where a change has more than a minor adverse effect on your access or use, we will give you the notice and the right to terminate that the law requires.
An experimental feature will be identified as such before you use it. Its experimental status does not remove a right that cannot lawfully be waived.
10. Fees and subscriptions
Any price, taxes, billing period, subscription duration and renewal conditions will be disclosed before you agree to a paid service.
Free access never becomes a paid subscription without your agreement. Automatic renewal applies only where it was clearly disclosed and agreed.
You may cancel a future renewal with the cancellation method provided for your subscription or by writing to contact@vulnbeacon.com. Where the law gives you a simpler or more immediate way to cancel, we will honour it.
A cancellation takes effect at the end of the current agreed period, unless your order or the law provides otherwise. A price change does not alter the charges already agreed for a fixed prepaid period.
Refunds and early termination follow your agreement and the law; no general rule excludes refunds.
11. Consumer rights
This section applies to consumers. It adds to any stronger protection the applicable law gives you.
For an eligible distance contract for a service in the European Union or the European Economic Area, you generally have 14 days from the conclusion of the contract to withdraw from it without giving a reason.
To withdraw, send a clear statement to contact@vulnbeacon.com before that period expires, identifying your account or order. You may use this wording, completed with your own details:
I withdraw from my contract for the VulnBeacon service, concluded on (date). My name is (name), my address is (address), and my account or order reference is (reference). Date: (date).
Any reimbursement due after a withdrawal is made within the legal deadline, normally within 14 days of our being informed, with the original means of payment unless you expressly agree otherwise, and without any reimbursement fee.
If you expressly ask for a paid service to start during the withdrawal period, the law may allow a proportionate charge for the service already supplied, provided the required information was given and your consent obtained.
Starting to use the service does not, by itself, waive your right of withdrawal. You lose it on full performance only under the conditions the law sets, including any prior express consent and acknowledgement they require. A separate supply of digital content with different rules would be explained separately.
The service must meet the statutory conformity requirements. If it does not, you may be entitled to have it brought into conformity, to a price reduction, or to terminate and be refunded, depending on the circumstances. Tell us so that we can address the issue.
You keep your mandatory rights concerning unfair terms, complaints, dispute resolution and access to the courts.
12. Intellectual property
We and our licensors keep our rights in the service’s software, design, documentation and pre-existing materials. You keep your rights in Customer Data.
You may use and export the reports and decisions produced for your account for the purposes your agreement permits. Third-party information, such as vulnerability records, remains subject to its own licences and attribution requirements.
If you choose to send us suggestions, we may use them to improve the service without paying you for them. This does not authorise us to disclose your confidential information or to use personal information in a way our Privacy notice does not describe.
13. Suspension and termination
We may restrict access where this is reasonably necessary to deal with a security threat, unlawful activity, a material breach or the non-payment of an agreed charge.
A restriction will be proportionate. Where it is lawful and practicable, we will explain the reason and give you a reasonable opportunity to correct the issue. An urgent threat may require immediate action.
Either party may terminate the agreement for a material breach that remains uncorrected after reasonable notice. You may also end it under your cancellation, withdrawal or other applicable rights, and at any time by asking us to close your account, at contact@vulnbeacon.com or through the administrator who gave you access.
When access ends, your right to use the service ends. Before your account is closed, you can download your products’ inventories, findings and reports from the application; where it is lawful and technically practicable, we will give you a reasonable opportunity to retrieve Customer Data before it is deleted. This does not limit any statutory right to retrieve content.
Information is then deleted or retained as our Privacy notice, any data processing agreement and the law provide. Limited audit and security records may remain for their stated purposes.
14. Liability
Each party remains responsible for its obligations under the agreement and the applicable law.
Nothing in these terms excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence where applicable, or anything else that cannot lawfully be excluded or limited.
For business customers, a liability cap or an allocation of particular losses applies only where it is expressly agreed in a separate business order and is valid under the applicable law. These general terms introduce no monetary cap and no customer indemnity.
For consumers, the statutory liability and remedies remain available. A limitation reserved for business customers does not apply to consumers.
15. Changes, complaints and governing law
We will explain a material change to these terms and give reasonable notice of it. A change never applies retrospectively. Where your agreement or a right to terminate is required, we will respect that requirement.
Send complaints to contact@vulnbeacon.com. Writing to us first is not a condition for exercising a statutory remedy or seeking urgent relief.
Unless a valid separate agreement provides otherwise, the applicable conflict-of-laws and jurisdiction rules determine the governing law and the competent courts. Consumers keep the mandatory protection, and the access to the courts, of the law that applies to them.