Terms of Service

1. General provisions

These Terms define the rules for using the Secvalis vulnerability management platform (the "Service") provided by SYSDEVOPS.EU Jarosław Karsznia, ul. Zbożowa 5/34, 81-020 Gdynia, Poland, Tax ID (NIP): 5871592779 (the "Provider").

The Service is addressed exclusively to entrepreneurs (natural persons, legal persons and organizational units without legal personality) who use the Service for purposes directly related to their business or professional activity. The Provider does not offer the Service to consumers.

2. Definitions

Service - the SaaS application for monitoring software vulnerabilities (CVE). Account - the organizational space created at registration. User - an entrepreneur within the meaning of Art. 43¹ of the Polish Civil Code (including a natural person running a sole proprietorship, provided that using the Service has a professional character for them) who has created an Account on the Platform. Trial - a free evaluation period of the Service.

3. Technical requirements

Using the Service requires meeting the following technical requirements: access to the Internet, a correctly configured web browser supporting cookies and the HTML5 standard (e.g. Chrome, Firefox, Edge, Safari in current versions), and an active email account.

4. Registration and account

Using the Service requires creating an Account and accepting these Terms. By concluding the agreement, the User declares that using the Service has a professional character for them (it is directly related to their business activity). The User is responsible for keeping their credentials confidential and for activity performed under their Account.

5. Trial period

New accounts start with a free trial period. After the trial ends, continued use requires a paid plan. The Provider may change the trial length; the current length is shown during registration.

6. Payments

Paid plans are currently handled individually - after the trial, the Provider arranges billing (a VAT invoice) directly with the customer. As an entrepreneur, the User agrees to receive invoices electronically. Self-service online payment may be introduced later; if so, the applicable rules will be described in these Terms before launch.

7. User obligations

The User shall not use the Service unlawfully, attempt to disrupt its operation, circumvent access limits, or create accounts in an automated/abusive manner. The Provider may apply anti-abuse safeguards (see the Privacy Policy).

The User undertakes to run the Agent and to run scans only on machines and infrastructure to which they hold legal title or have the owner's express authorisation. Scanning third-party infrastructure without authorisation is prohibited, and the User bears sole responsibility for such action.

The User acknowledges that vulnerability scanning and configuration testing by the Agent carries an inherent technical risk and may, in extreme cases, affect the stability or availability of the scanned infrastructure. The Provider is not liable for any disruption, downtime or failure of the User's systems caused by correct operation of the Agent in accordance with its documentation.

8. Confidentiality

Data the User provides to the Service in connection with vulnerability monitoring (e.g. machine names, installed package versions) may constitute the User's business secret. The Provider processes such data solely to deliver the Service, does not disclose it to unauthorized third parties, and applies technical and organizational measures to protect it. Reports and data exports (PDF/CSV) are generated for the User and remain under their control.

9. Intellectual property

All intellectual property rights to the Secvalis platform - including the software, source code, scripts (including the audit script), interface design, trademarks, and training/informational materials - belong exclusively to the Provider. Using the Service does not grant the User any copyright or license to the Platform, other than the right to use it as intended for the duration of the agreement. In particular, copying, modifying or decompiling the Platform's software without the Provider's consent is prohibited.

10. Liability and its limitation

The Service provides vulnerability information (CVE) for support purposes only and does not replace the User's own security assessment. The Provider does not guarantee detection of all vulnerabilities.

1. The Provider is liable for non-performance or improper performance of its obligations under these Terms and the Data Processing Agreement (DPA) on general principles, subject to the provisions of this section.
2. The Provider's liability towards the User, on any legal basis (contractual, tortious, unjust enrichment or other), including liability for breach of the DPA or the GDPR, is limited solely to actual damage (damnum emergens) and does not cover lost profits (lucrum cessans), indirect or consequential damage.
3. The Provider's total and maximum financial liability towards the User on all bases connected with the performance of the Terms and the DPA - including any recourse claims of the User where an administrative fine is imposed on it by the supervisory authority (UODO) or compensation is awarded to data subjects - is capped and may not exceed the equivalent of the fees actually paid by the User to the Provider in the 6 months preceding the event giving rise to the damage. Where the damage arose while using the Service in a trial or free version, the Provider's total liability is limited to PLN 500.
4. The limitations of liability referred to in points 2 and 3 do not apply where such limitation is excluded by mandatory provisions of Polish law, in particular in the case of damage caused to the User by the Provider through wilful misconduct (Art. 473 § 2 of the Polish Civil Code).

11. Force majeure

1. Neither Party is liable for non-performance or improper performance of its obligations under the Terms (including the Data Processing Agreement - DPA) if caused by circumstances of Force Majeure.
2. “Force Majeure” means an external, extraordinary event, impossible to foresee and to prevent with the utmost professional diligence, beyond the objective control of the Parties.
3. Force Majeure includes in particular: acts of terror, acts of war, natural disasters, fires or flooding of IT infrastructure (including cloud providers' data centres), prolonged and widespread failures of the power grid or telecommunications backbones, as well as massive, irreparable cyber-attacks (e.g. DDoS attacks of a scale that the hosting infrastructure provider cannot effectively counter) and sudden technical failures - not attributable to the Provider - at key external suppliers (e.g. OVHcloud), insofar as such events directly prevent the provision of the Secvalis Service.
4. A Party unable to perform its obligations due to Force Majeure shall inform the other Party without undue delay, as far as technically possible. For the Provider, publishing a notice on a publicly available status page or sending a bulk email to affected Users is sufficient notification.

12. Complaints procedure

The User may submit complaints about the operation of the Service to: [email protected]. A complaint should contain a description of the problem and data identifying the Account. The Provider examines the complaint within 14 days of receiving it and informs the User of the outcome electronically.

13. Personal data

Personal data is processed under the Privacy Policy.

To the extent the User entrusts the Provider with processing of personal data for which the User is the controller, the Data Processing Agreement (DPA) applies; it forms an integral part of these Terms. Acceptance of the Terms includes acceptance of the DPA.

14. Termination

The User may delete their Account at any time. The Provider may suspend or terminate access in case of a material breach of these Terms.

After the agreement ends, the Provider deletes the User's data within 30 days, subject to storage obligations arising from law and the backup rules described in the DPA. On a request made before termination, the Provider enables the User to export their data.

15. Changes and final provisions

The Provider may amend these Terms for important reasons, in particular: a change in the law, a technical or functional modification of the Platform, a change in the scope or method of providing the Service, or a change in pricing. Users will be informed of material changes at least 14 days before they take effect (e.g. by email or a notice in the application). Polish law applies. Disputes are resolved by the court competent for the Provider's seat.

These Terms are drawn up in Polish and English. In the event of any discrepancy between the versions, the Polish version prevails.

Contact: [email protected]