Terms of Service

These Terms of Service apply to business and professional customers using Scopeward.

Scopeward · scopeward.eu · app.scopeward.eu · Version 1.0 · Last updated: 12 September 2026

Effective date: 12 September 2026

Operator: J. B. Nielsen T., trading as Scopeward · Vestaveien, 1476 Rasta, Norway

Contact: hello@scopeward.eu · Privacy: privacy@scopeward.eu, with hello@scopeward.eu as a fallback.

1. The service and your agreement

These terms govern your use of Scopeward and form an agreement with the operator identified above. If you act for an organisation, you must have authority to accept them for it.

Scopeward is offered only for business or professional use. By purchasing, you confirm that you act mainly for purposes connected with your trade, business, craft or profession and, if you act for an organisation, that you have authority to accept these terms for it. Scopeward is not offered for personal, family or household use. Mandatory rights that apply despite this restriction remain unaffected.

Scopeward is an online service for business customers. Section 6 explains how service and terms updates are handled.

2. What you get

A short questionnaire feeds a deterministic, versioned CRA ruleset. It returns an indicative classification, supporting provisions and relevant dates. Where information is insufficient, the result identifies the unresolved point.

The classification engine uses no language model, network call, randomness or current-clock lookup. The same answers under the same version produce the same result. No language model is used elsewhere in the service. Document drafts use templates and your records.

Paid features include a readiness report and a workspace for obligations, notes, document drafts, evidence, SBOM monitoring, incident records and vulnerability reports submitted through your intake form. The workspace also provides service notifications and an exportable, signed action history. Checkout states what your purchase includes.

Nobody checks your answers, classification or work as part of the service. No paid tier provides a human assessment. You are responsible for the accuracy and completeness of the information you supply, for deciding whether an output is appropriate for your circumstances and for obtaining professional advice where needed. Results and drafts are not legal advice. They create no lawyer-client relationship and may be wrong or incomplete.

Scopeward issues no certificates, badges, seals or marks and makes no statement that you or your product comply with the law. You remain responsible for your own conformity assessment, documents and deadlines.

Saving an incident does not notify an authority. Scopeward does not submit, transmit or pre-register anything with a CSIRT, ENISA, the Single Reporting Platform or another authority. You must file required notifications yourself. The service does not protect against enforcement action.

3. Paddle, prices and cancellation

Paddle is the merchant of record and seller of paid access. Your sale and billing agreement is with the Paddle entity named at checkout. We operate the software. Paddle collects payment, issues receipts or invoices, handles applicable transaction taxes and processes refunds. We never receive card details.

See Paddle's buyer terms, refund policy and buyer support. Paddle's applicable sale terms govern billing, tax and refunds; these terms govern product use.

Paddle Checkout shows the localized price and total before payment. A report is a one-time purchase with 30 days of core workspace access. Continuing core access requires a separately accepted monthly workspace subscription. A report purchase alone does not authorise recurring charges. The workspace subscription is offered separately inside the workspace after the included access period ends.

Cancel through the management link in your Paddle emails, Paddle support, or hello@scopeward.eu. Cancellation ends renewal; access continues to the end of the paid period.

The purchased report remains accessible. After core workspace access ends, workspace records and exports remain available read-only until deletion or service closure. Editing, reminders, notifications and SBOM monitoring stop. Cancellation does not delete your account, and account deletion does not cancel Paddle billing.

Refunds follow Paddle's applicable policy and mandatory law. We offer no outcome-based refund promise. After a refund or chargeback, we may withdraw the access purchased.

4. Your account and content

Accounts are currently for one user. Sign-in uses an emailed link, not a password. Protect your email account and do not share links or sessions.

Keep your product facts accurate. Upload only content you have the right to use. Do not upload secrets, payment-card details, unrelated personal data, health data or other special-category or criminal-offence data.

Do not break the law, interfere with the service, bypass access controls or access another customer's records. Do not misrepresent an output as certification, official approval or an assessment checked by a person. Keep the review-status disclosures with shared outputs. Security testing within our published disclosure policy is permitted.

You keep your rights in your content. You allow us to handle it only as needed to provide the service, including the storage, backups and provider processing disclosed in the Privacy Policy. You may use and share your reports, drafts and exports for your organisation's work. We retain our rights in our software, ruleset and templates.

Evidence bytes are on our server's disk in Paris, outside the database, and are included in encrypted backups. The application serves them only to the signed-in workspace owner.

For subscribed workspaces, SBOM monitoring compares package URLs and versions on our server in Paris with locally stored copies of public OSV vulnerability data and CISA's Known Exploited Vulnerabilities catalogue. We download those public datasets on a schedule independent of customer activity. We do not send customer SBOMs, package identifiers, versions or other workspace content to those sources, and do not fall back to external package-query services. Source code is never uploaded or read. Components without a supported package URL or supported version information may not be matched. Public data and local copies can be incomplete or out of date, and monitoring may miss or delay findings.

Keep independent copies of records you must retain.

5. Processing personal data for your organisation

For personal data you ask us to process on your organisation's behalf, your organisation is controller and we are processor. If it is itself a processor, we act as subprocessor. These processing terms take priority over conflicting product-use terms.

The subject is your assessment and workspace records. Processing includes collection, organisation, storage, template generation, retrieval, notifications, exports, backups and deletion to provide the functions you use. It lasts during service use, including retained read-only access, and the deletion periods in the Privacy Policy.

Data may include names, work contacts, account identifiers and personal information in your records. It concerns staff, contractors, customers, contacts, vulnerability reporters and people named in incidents. You determine its lawful purposes and basis, give appropriate notices and supply lawful instructions. The restrictions in section 4 apply.

• Instructions and confidentiality. We follow your documented instructions, including these terms. If applicable EEA law requires other processing, we inform you beforehand unless legally prohibited. We promptly flag instructions we consider unlawful. Authorised people are bound by confidentiality.
• Security and assistance. We apply risk-appropriate measures, including those in the Privacy Policy, and assess their effectiveness. We assist with individual rights, security, breach notifications, impact assessments and prior consultation, taking account of the processing and information available.
• Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your content and provide available relevant information.
• Providers and transfers. You authorise the subprocessors identified in the Privacy Policy. Equivalent written obligations apply to them, and we remain responsible for their performance. We give 30 days' email notice before adding or replacing one. If a reasonable data protection objection cannot be resolved, you may end the affected processing and subscription. Refunds follow Paddle's terms and mandatory law. International transfers require an applicable lawful safeguard. Paddle's independent payment processing is outside this authorisation.
• Return and deletion. When processing ends, you choose return followed by deletion or deletion without return. Contact us for instructions. We delete copies under the Privacy Policy's schedule unless applicable EEA law requires retention. Backups awaiting expiry remain isolated from ordinary use. We confirm completion on request.
• Oversight. We provide necessary information and allow and contribute to audits and inspections by you or your appointed auditor. Routine audits normally use 30 days' notice and occur once a year at your cost. Incidents, suspected non-compliance and legal requirements may require additional or urgent audits. Reasonable arrangements protect other customers; timing and fees must not prevent necessary oversight.

6. Availability, ending access and changes

There is no SLA or uptime or response-time commitment. Interruptions and stale monitoring data are possible. Keep an independent way to meet deadlines and file notifications.

We may suspend access where reasonably necessary for security, unlawful use, a serious breach or loss of paid entitlement. Where practicable, we explain the issue and allow it to be corrected. A material breach that can be remedied has a 14-day cure period after notice.

If we discontinue the service, we give 60 days' email notice and keep exports available during that period. Refunds and purchase remedies follow Paddle's applicable terms and mandatory law. The Privacy Policy governs deletion after closure.

We may update the ruleset. Saved results identify their version and are not automatically updated. Reassess when your facts or the ruleset change.

Material changes to these terms receive 30 days' email notice and a new effective date. You may cancel before they apply. Where required, we obtain renewed agreement. Price changes also follow Paddle's process. Checkout currently records the time of acceptance.

7. Liability and governing law

To the fullest extent permitted by applicable law, Scopeward is provided as available. We do not promise that an output is accurate, complete, current or suitable for a particular conclusion, or that the service will be uninterrupted or error-free.

To the fullest extent permitted by applicable law, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, business, opportunity, goodwill or anticipated savings arising from or relating to the product, report, workspace or these terms.

Scopeward's total aggregate liability for all claims arising from or relating to the product, report, workspace or these terms during any twelve-month period will not exceed the greater of EUR 249 and the amounts actually paid for the Scopeward product through Paddle during the twelve months immediately preceding the first event giving rise to the claim. Scopeward is not responsible for loss that could reasonably have been avoided by checking outputs, maintaining independent records or using the applicable official reporting channel.

These exclusions and limits do not apply to fraud or wilful misconduct, gross negligence where liability cannot lawfully be limited, death or personal injury where applicable, statutory data-protection rights, or any other liability that applicable law does not permit the parties to exclude or limit. Neither party gives an indemnity. Nothing in this section limits rights against Paddle concerning the payment transaction under Paddle's buyer terms.

Norwegian law governs these terms. Disputes may be brought before the competent Norwegian courts under applicable jurisdiction rules. Mandatory protections and court rights remain unaffected. Paddle's sale agreement has its own governing-law provisions.