DevKit Dossier

Terms of Service

Last updated: 2026-10-01

  1. Who we are. DevKit Dossier ("the Service") is provided by DevKit Srl, Via Teodoro Valfrè 11, 00165 Roma, Italy, share capital €10,400.00 fully paid in, sole-shareholder company, VAT IT15026561009, Rome company register no. 15026561009, REA RM - 1564153 ("DevKit", "we"). Contact: support@devkit.dev, PEC devkit@legalmail.it.
  2. Who you are. The Service is offered to businesses and professionals only. By creating an account you confirm you act for a company or in a professional capacity and can bind it to these Terms.
  3. What the Service does. The Service stores software bills of materials (SBOMs) and related records you upload, matches their components against public vulnerability databases, keeps a timeline of your handling decisions, and produces exports. The Service is a record-keeping and monitoring tool. It does not assess your product's conformity with any law, does not certify compliance, does not provide legal advice, and does not file notifications with any authority on your behalf.
  4. Accounts and access. Sign-in is by email link and API keys. You are responsible for the people and systems you give access to and for keeping API keys confidential. Tell us at once if you suspect unauthorised access.
  5. Your data. You keep all rights to the SBOMs and other content you upload ("Customer Data"). You grant us the right to process Customer Data only to provide the Service, including matching it against vulnerability data and producing exports for you. We do not sell Customer Data. We do not send your component data (component names, versions and package identifiers) to third-party APIs; the sub-processors listed in the Data Processing Addendum process Customer Data only to host the Service, deliver its emails and report its errors. Customer Data is hosted in the European Union.
  6. Third-party data. Vulnerability and exploit data comes from public sources under their own licenses and terms, listed on the About page and in every export. License data in the license inventory comes from the SBOMs you upload; we only match its identifiers against the public SPDX License List. Third-party data is provided "as is". We do not warrant that it is complete, correct or timely. Decisions you take on the basis of it are yours.
  7. Acceptable use. You will not use the Service to store content you have no right to store, to attack or overload the Service, to circumvent plan limits, or in breach of applicable law. We may suspend accounts that put the Service or other customers at risk and will tell you why.
  8. Plans, trial and payment. Plans and limits are described on the Pricing page. Each plan starts with a 14-day free trial; a payment method is required to start it, and no charge is made if you cancel before the trial ends. Payments are collected by Paddle as merchant of record: Paddle.com Market Limited, or Paddle.com Inc. for buyers in the United States, or Paddle.com (Canada) Ltd. for buyers in Canada ("Paddle"). Paddle's Buyer Terms (https://www.paddle.com/legal/buyer-terms) and Paddle's Refund Policy apply to the purchase, and Paddle issues the invoices, including VAT. Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Questions about the Service itself are answered by us at support@devkit.dev. Prices exclude VAT unless stated otherwise. We may change prices with 30 days' notice by email; changes apply from your next renewal.
  9. Term and cancellation. Subscriptions renew monthly or yearly until cancelled. You can cancel at any time from the account settings; the subscription ends at the close of the paid period. Refunds are governed by our Refund Policy.
  10. Export and deletion. You can export all Customer Data at any time while your subscription is active. After the subscription ends, the account stays in read-only mode for 30 days for export; Customer Data is deleted within 90 days after the end of the subscription, except where we must keep it by law. Keeping records for the retention periods required by regulation is your responsibility; use the export.
  11. Availability and changes. We aim for high availability but do not guarantee uninterrupted service. We may change or discontinue features with reasonable notice; if we discontinue the Service, we give at least 60 days' notice and keep export available during that time.
  12. Warranty and liability. The Service is provided "as is" for professional use. To the extent permitted by law, we exclude implied warranties, and our total liability for all claims in any 12-month period is limited to the fees you paid us for that period. We are not liable for indirect or consequential loss, including regulatory fines, lost profits or loss of data you did not export. Nothing limits liability for wilful misconduct, gross negligence or where limitation is not permitted by law.
  13. Confidentiality. We treat Customer Data as confidential and access it only to operate the Service, to support you at your request, or as required by law.
  14. Data protection. Processing of personal data is described in the Privacy Policy. Where we process personal data on your behalf inside Customer Data, the Data Processing Addendum applies and forms part of these Terms.
  15. Changes to these Terms. We may update these Terms; material changes are announced by email at least 30 days before they take effect. Continued use after that date means acceptance.
  16. Governing law and venue. These Terms are governed by Italian law. Courts of Rome, Italy, have exclusive jurisdiction, without prejudice to mandatory rules that apply to you.