Legal
Terms of use
Effective date: 20 September 2026 · Last updated: 22 September 2026
Provider & acceptance
These terms govern your use of the SBOMFlow website and documentation at sbomflow.com and any access to the SBOMFlow software that is granted for evaluation. They are offered by SBOMFLOW TECHNOLOGIES LTD, a private company limited by shares incorporated in the Federal Republic of Nigeria under the Companies and Allied Matters Act 2020, company registration number 9845783, incorporated at Abuja on 10 September 2026 ("SBOMFlow", "we"). By using the site or the software you accept these terms; if you do not accept them, do not use the site or the software.
SBOMFlow currently has no hosted service, no user accounts, no checkout, and no subscription. These terms are deliberately scoped to the product that exists today: a website, public documentation, and a locally run, proprietary command-line tool.
Order of precedence
If provisions conflict, they apply in this order:
- a signed order form, pilot agreement, design-partner agreement, or other written commercial agreement between us, for the matters it covers;
- the software licence accompanying the SBOMFlow software provided to you, for software access granted under it;
- these website terms;
- the privacy notice, which governs personal data.
Business audience
The site and software address businesses and professionals. If you act for an organisation, you confirm you are authorised to accept these terms on its behalf, and "you" includes that organisation.
Website & documentation access
You may view and use the public website and documentation for your internal evaluation of SBOMFlow. The content is provided for general information about the product; it is not advice, and capability descriptions reflect the engine at the time of writing. Roadmap items are directional, not commitments.
Software evaluation and the licence boundary
The SBOMFlow software is proprietary. It is not open-source, and no production or commercial rights are implied by access to its repository, packages, website, or documentation. Where the copyright holder has granted you access, the accompanying LICENSE allows internal evaluation, development, and testing only; any production or commercial use requires a separate written agreement.
Nothing in these terms grants you any licence beyond the LICENSE and any signed agreement. Do not copy, distribute, sublicense, sell, or offer the software as a service.
Acceptable use
You agree not to:
- interfere with or disrupt the site or its hosting, or attempt to gain unauthorised access to systems or data;
- introduce malware or use the site or software to create, conceal, or distribute it;
- use the site or software in breach of applicable law, including export-control and sanctions law;
- scrape, republish, or misrepresent the content as your own, or remove notices from it;
- use the SBOMFlow name, mark, or lockup except to refer to the product truthfully.
Responsible security research
We welcome coordinated vulnerability reports. Please report suspected vulnerabilities privately by email to hello@sbomflow.com rather than disclosing them publicly, and give us a reasonable opportunity to remediate before disclosure. Do not test against infrastructure you do not own; the website is static and hosted by a third party.
Your responsibilities
SBOMFlow processes the inputs you point it at and records the decisions your reviewers make. You remain responsible for:
- your inputs (builds, SBOMs, manifests, evidence files) and the rights to use them;
- your configuration, policies, gate choices, and CI integration;
- your backups and the storage of generated evidence;
- every reviewer, approval, VEX, and release decision recorded with the tool;
- obtaining your own professional, legal, and conformity advice.
Ownership
Yours: your inputs and the evidence artifacts generated from them in your environment, subject to any signed agreement between us and to third-party rights in the underlying data sources.
Ours: the SBOMFlow software, website, documentation, brand, and marks. If you send us feedback or suggestions, you agree we may use them without restriction or obligation; we will not name you or your organisation publicly without permission.
Third-party materials
SBOMFlow consumes and links to third-party standards, tools, and data sources — for example CycloneDX, SPDX, OSV, NIST NVD, CISA KEV, FIRST EPSS, and official EU sources. Those materials remain subject to their own licences and terms, and we are not responsible for external sites.
Changes & availability
We may change, suspend, or discontinue the website, documentation, or software at any time. The site is provided without any availability commitment. Software behaviour is documented per release; we work to keep artifacts deterministic and stable, but pre-1.0 interfaces can change between releases.
What SBOMFlow is not
SBOMFlow output is engineering evidence produced by a deterministic engine plus decisions recorded by your own reviewers. It is not:
- legal or regulatory advice;
- a certification, approval, or declaration of conformity with the EU Cyber Resilience Act or any other law or standard;
- a guarantee that a product is secure or free of vulnerabilities;
- a regulatory filing — SBOMFlow never files, transmits, signs, or submits a report and never contacts a CSIRT, ENISA, or any reporting platform. Draft regulatory artifacts are watermarked unsigned drafts for your qualified people to complete.
The engine can only observe what deterministic analyzers can see; observed status is not human review, and absence of findings is not proof of safety. Advisory data sources are external and can be incomplete or delayed.
Sample data & advisory sources
Offline demonstration runs use a bundled sample advisory fixture whose
identifiers are prefixed CVE-SAMPLE-; it is clearly labelled
non-real and must never be treated as security intelligence. Live
advisory lookups are explicit, opt-in actions against the public sources
named in the documentation.
Warranties & liability
The website, the documentation and the software are provided "as is" and "as available", without warranty of any kind. To the fullest extent the law allows, we exclude all warranties, conditions and terms that are not written down here — including any implied warranty of merchantability, fitness for a particular purpose, accuracy, completeness, or non-infringement. We do not warrant that the site or the software will be uninterrupted or error-free, that advisory data obtained from external sources is complete or current, or that the evidence produced will satisfy any regulator, auditor or customer.
You are evaluating pre-1.0 software. Decide for yourself, on your own testing, whether it is fit for the use you intend.
To the fullest extent the law allows, we are not liable for loss of profit, revenue, business, goodwill, anticipated savings, data, or for any indirect, special or consequential loss, however caused. Where liability cannot lawfully be excluded or limited — for example for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation — nothing here excludes or limits it, and that liability is unaffected by this section. Subject to that, our total liability arising out of or in connection with these terms, the website, the documentation and any evaluation software is limited to the greater of the amounts you have paid us in the twelve months before the claim and NGN 100,000. Evaluation access is granted at no charge, so in most cases the first of those is nil.
These limits do not apply to a signed commercial agreement between us, which carries its own warranty and liability terms and takes precedence over this page for the matters it covers.
Suspension
We may suspend or withdraw access to the site, repository, or evaluation software where we reasonably believe these terms, the LICENSE, or the law are being breached. Provisions that by their nature should survive — including ownership, licence boundaries, and liability — survive termination.
Privacy
Our privacy notice explains what personal data we handle and why — including the website's no-analytics posture and the CLI's offline-by-default behaviour.
Changes to these terms
We may update these terms as the product evolves — for example if a hosted service or account system is ever introduced, these terms will be revised first. We will change the "last updated" date above and, for significant changes, highlight them on this page. Continued use after a change takes effect constitutes acceptance.
Governing law & jurisdiction
These terms, and any dispute or claim arising out of or in connection with them, are governed by the laws of the Federal Republic of Nigeria, where SBOMFlow Technologies Ltd is incorporated, and the courts of Nigeria have jurisdiction. If you are contracting from elsewhere and need a different governing law or forum, raise it with us in writing before you rely on the software; a signed agreement can change it, this page alone cannot.
Nothing here removes a protection that the mandatory law of your own country gives you and that cannot be contracted away.
General
If part of these terms is found unenforceable, the rest continues to apply. A failure to enforce a provision is not a waiver. You may not assign these terms without our written consent; we may assign them to a successor to our business.
These terms, together with the documents named in order of precedence, are the whole agreement between us about the website, the documentation and evaluation access, and they replace any earlier statement, proposal or assurance about them. Nobody who is not a party to these terms may enforce them.
Contact
Questions about these terms: hello@sbomflow.com.