Terms of Service

These Terms of Service apply to business and professional customers using Scopeward.

Scopeward · scopeward.eu · app.scopeward.eu · Version 1.1 · Last updated: 1 October 2026

Effective date: 1 October 2026

Operator: J. B. Nielsen T., trading as Scopeward · Vestaveien, 1476 Rasta, Norway

Contact: hello@scopeward.eu · Privacy: privacy@scopeward.eu, with hello@scopeward.eu as a fallback.

1. The service and your agreement

These terms govern your use of Scopeward and form an agreement with the operator identified above. If you act for an organisation, you must have authority to accept them for it.

Scopeward is offered only for business or professional use. By purchasing, you confirm that you act mainly for purposes connected with your trade, business, craft or profession and, if you act for an organisation, that you have authority to accept these terms for it. Scopeward is not offered for personal, family or household use. Mandatory rights that apply despite this restriction remain unaffected.

Scopeward is an online service for business customers. Section 6 explains how service and terms updates are handled.

2. What you get

A short questionnaire feeds a deterministic, versioned CRA ruleset. It returns an indicative classification, supporting provisions and relevant dates. Where information is insufficient, the result identifies the unresolved point.

The classification engine uses no language model, network call, randomness or current-clock lookup. The same answers under the same version produce the same result. No language model is used elsewhere in the service. Document drafts use templates and your records.

Paid features include a readiness report and a workspace for obligations, notes, document drafts, evidence, SBOM monitoring, incident records and vulnerability reports submitted through your intake form. The workspace also provides service notifications and an exportable, signed action history. Checkout states what your purchase includes.

Nobody checks your answers, classification or work as part of the service. No paid tier provides a human assessment. You are responsible for the accuracy and completeness of the information you supply, for deciding whether an output is appropriate for your circumstances and for obtaining professional advice where needed. Results and drafts are not legal advice. They create no lawyer-client relationship and may be wrong or incomplete.

Scopeward issues no certificates, badges, seals or marks and makes no statement that you or your product comply with the law. You remain responsible for your own conformity assessment, documents and deadlines.

Saving an incident does not notify an authority. Scopeward does not submit, transmit or pre-register anything with a CSIRT, ENISA, the Single Reporting Platform or another authority. You must file required notifications yourself. The service does not protect against enforcement action.

3. Payments, prices and cancellation

The operator identified above is the seller of paid access and operates the software. Stripe processes payments and manages billing on our behalf. Your purchase agreement is with us. We are responsible for customer support, refunds and applicable transaction taxes. Card details are entered on Stripe’s hosted checkout; Scopeward does not receive full card numbers or security codes.

For purchase, billing or refund questions, contact hello@scopeward.eu. Stripe’s payment processing does not replace these terms or transfer our responsibilities as seller to Stripe.

Checkout shows the price, currency and total before payment. A report is a one-time purchase with 30 days of core workspace access. Continuing core access requires a separately accepted monthly workspace subscription. A report purchase alone does not authorise recurring charges. The workspace subscription is offered separately inside the workspace after the included access period ends.

Cancel your subscription through Manage subscription and payment details on your account page, or contact hello@scopeward.eu. Cancellation ends renewal; access continues to the end of the paid period.

The purchased report remains accessible. After core workspace access ends, workspace records and exports remain available read-only until deletion or service closure. Editing, reminders, notifications and SBOM monitoring stop. Cancellation does not delete your account. Cancel billing before deleting your account, or contact hello@scopeward.eu for assistance.

Contact hello@scopeward.eu to request a refund or report a billing error. Refund requests are assessed under these terms and mandatory law. We offer no outcome-based refund promise. After a refund or chargeback, we may withdraw the access purchased.

4. Your account and content

Accounts are currently for one user. Sign-in uses an emailed link, not a password. Protect your email account and do not share links or sessions.

Keep your product facts accurate. Upload only content you have the right to use. Do not upload secrets, payment-card details, unrelated personal data, health data or other special-category or criminal-offence data.

Do not break the law, interfere with the service, bypass access controls or access another customer's records. Do not misrepresent an output as certification, official approval or an assessment checked by a person. Keep the review-status disclosures with shared outputs. Security testing within our published disclosure policy is permitted.

You keep your rights in your content. You allow us to handle it only as needed to provide the service, including the storage, backups and provider processing disclosed in the Privacy Policy. You may use and share your reports, drafts and exports for your organisation's work. We retain our rights in our software, ruleset and templates.

Evidence bytes are on our server's disk in Paris, outside the database, and are included in encrypted backups. The application serves them only to the signed-in workspace owner.

For subscribed workspaces, SBOM monitoring compares package URLs and versions on our server in Paris with locally stored copies of public OSV vulnerability data and CISA's Known Exploited Vulnerabilities catalogue. We download those public datasets on a schedule independent of customer activity. We do not send customer SBOMs, package identifiers, versions or other workspace content to those sources, and do not fall back to external package-query services. Source code is never uploaded or read. Components without a supported package URL or supported version information may not be matched. Public data and local copies can be incomplete or out of date, and monitoring may miss or delay findings.

Keep independent copies of records you must retain.

5. Processing personal data for your organisation

For personal data you ask us to process on your organisation's behalf, your organisation is controller and we are processor. If it is itself a processor, we act as subprocessor. These processing terms take priority over conflicting product-use terms.

The subject is your assessment and workspace records. Processing includes collection, organisation, storage, template generation, retrieval, notifications, exports, backups and deletion to provide the functions you use. It lasts during service use, including retained read-only access, and the deletion periods in the Privacy Policy.

Data may include names, work contacts, account identifiers and personal information in your records. It concerns staff, contractors, customers, contacts, vulnerability reporters and people named in incidents. You determine its lawful purposes and basis, give appropriate notices and supply lawful instructions. The restrictions in section 4 apply.

• Instructions and confidentiality. We follow your documented instructions, including these terms. If applicable EEA law requires other processing, we inform you beforehand unless legally prohibited. We promptly flag instructions we consider unlawful. Authorised people are bound by confidentiality.
• Security and assistance. We apply risk-appropriate measures, including those in the Privacy Policy, and assess their effectiveness. We assist with individual rights, security, breach notifications, impact assessments and prior consultation, taking account of the processing and information available.
• Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your content and provide available relevant information.
• Providers and transfers. You authorise the subprocessors identified in the Privacy Policy. Equivalent written obligations apply to them, and we remain responsible for their performance. We give 30 days' email notice before adding or replacing one. If a reasonable data protection objection cannot be resolved, you may end the affected processing and subscription. Contact hello@scopeward.eu about refunds; mandatory rights remain unaffected. International transfers require an applicable lawful safeguard. Stripe’s payment processing roles are described in the Privacy Policy.
• Return and deletion. When processing ends, you choose return followed by deletion or deletion without return. Contact us for instructions. We delete copies under the Privacy Policy's schedule unless applicable EEA law requires retention. Backups awaiting expiry remain isolated from ordinary use. We confirm completion on request.
• Oversight. We provide necessary information and allow and contribute to audits and inspections by you or your appointed auditor. Routine audits normally use 30 days' notice and occur once a year at your cost. Incidents, suspected non-compliance and legal requirements may require additional or urgent audits. Reasonable arrangements protect other customers; timing and fees must not prevent necessary oversight.

6. Availability, ending access and changes

There is no SLA or uptime or response-time commitment. Interruptions and stale monitoring data are possible. Keep an independent way to meet deadlines and file notifications.

We may suspend access where reasonably necessary for security, unlawful use, a serious breach or loss of paid entitlement. Where practicable, we explain the issue and allow it to be corrected. A material breach that can be remedied has a 14-day cure period after notice.

If we discontinue the service, we give 60 days' email notice and keep exports available during that period. Contact hello@scopeward.eu about refunds and purchase remedies; mandatory rights remain unaffected. The Privacy Policy governs deletion after closure.

We may update the ruleset. Saved results identify their version and are not automatically updated. Reassess when your facts or the ruleset change.

Material changes to these terms receive 30 days' email notice and a new effective date. You may cancel before they apply. Where required, we obtain renewed agreement. We notify you before a subscription price change takes effect so you can cancel before the next charge. Checkout currently records the time of acceptance.

7. Liability and governing law

To the fullest extent permitted by applicable law, Scopeward is provided as available. We do not promise that an output is accurate, complete, current or suitable for a particular conclusion, or that the service will be uninterrupted or error-free.

To the fullest extent permitted by applicable law, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, business, opportunity, goodwill or anticipated savings arising from or relating to the product, report, workspace or these terms.

Scopeward's total aggregate liability for all claims arising from or relating to the product, report, workspace or these terms during any twelve-month period will not exceed the greater of EUR 249 and the amounts actually paid for the Scopeward product during the twelve months immediately preceding the first event giving rise to the claim. Scopeward is not responsible for loss that could reasonably have been avoided by checking outputs, maintaining independent records or using the applicable official reporting channel.

These exclusions and limits do not apply to fraud or wilful misconduct, gross negligence where liability cannot lawfully be limited, death or personal injury where applicable, statutory data-protection rights, or any other liability that applicable law does not permit the parties to exclude or limit. Neither party gives an indemnity. Nothing in this section limits mandatory rights concerning a payment transaction.

Norwegian law governs these terms. Disputes may be brought before the competent Norwegian courts under applicable jurisdiction rules. Mandatory protections and court rights remain unaffected.