Terms of service

1. Introduction and contracting entity

These Terms of Service ("Terms") govern the use of EmbedHarbor services provided by Shanghai Weisha Technologies Co., Ltd. (上海未鲨科技有限公司), referred to as "EmbedHarbor", "we", "us", or "our".

EmbedHarbor provides software tools and services relating to software supply-chain security, vulnerability management, product-security documentation, and trusted software delivery.

These Terms apply to the relevant website tools and hosted services where they are presented and accepted. Access to general informational website content does not, by itself, establish a paid service agreement.

A separate written agreement, order form, or product-specific agreement may govern certain services. Where agreements conflict, the expressly agreed order of precedence applies.

Scope: what these terms cover today

These terms cover this website and the free browser tools. They do not grant any account, hosted-service, integration or paid capability described later in these terms; those apply only under a separate agreement, and the hosted product application publishes its own terms. A business customer's data processing is governed by the applicable agreement and DPA, not by this page.

The version line on this page records when this published text took effect. It is not the date on which any separate service agreement is accepted or becomes binding; such an agreement sets its own effective date.

2. Business use and authority

Our hosted services are primarily intended for professional and business use. If you create an account or accept these Terms on behalf of an organization, you represent that you have the authority to bind that organization.

You are responsible for providing accurate registration information and maintaining appropriate access permissions.

This website does not offer consumer purchases. If consumer-facing transactions are introduced, the additional terms and mandatory consumer rights that apply will be published before any such transaction is offered.

3. Services covered

Depending on availability, EmbedHarbor services may include:

• Free online software analysis and validation tools.
• SBOM validation and software component analysis.
• Vulnerability intelligence and management workflows.
• Product-security and compliance-readiness documentation.
• Software supply-chain collaboration.
• Trusted software delivery and related security services.
• Optional AI-assisted technical analysis.

Not all features are available in every deployment, plan, region, or product version. Feature descriptions and product-specific documentation define the intended capabilities and limitations of each service. Future or planned features are not contractual commitments unless expressly agreed in writing.

On this website the available services are the free browser tools: the SBOM Validator, SBOM Diff, CRA Scope Checker and X.509 Decoder.

4. Accounts and organization administration

Certain services require registration. Where an account exists, you must maintain the confidentiality of account credentials and take reasonable steps to prevent unauthorized access. Organization administrators may invite users, assign roles, and manage access within their organization.

You are responsible for ensuring that users have appropriate authorization to access data made available through your organization. You must notify us promptly if you become aware of unauthorized account access or a significant security issue involving your account.

We may apply reasonable authentication, verification, and security controls to protect the service. This website itself has no account or login.

5. Customer data and ownership

"Customer Data" means information, files, records, and other materials submitted to a hosted service by or on behalf of a customer.

As between the parties, customers retain their rights, title, and interests in their Customer Data. Submitting Customer Data does not transfer ownership of that data to EmbedHarbor.

Customers grant us a limited, non-exclusive right to process Customer Data to the extent necessary to provide, secure, maintain, and support the requested services and to fulfill applicable contractual and legal obligations.

We do not acquire an independent right to publish or commercially distribute a customer's confidential SBOMs, technical documentation, security findings, or other Customer Data merely because that data is submitted to the service. Customer Data may be processed by authorized service providers where necessary and subject to appropriate safeguards.

The free tools on this website do not submit Customer Data to us: files and answers are processed in your browser.

6. Customer responsibilities

Customers are responsible for:

• Ensuring that submitted information may lawfully be processed.
• Obtaining necessary permissions to submit third-party materials.
• Managing access rights and organization invitations.
• Maintaining appropriate backups or exports where needed.
• Reviewing technical findings before relying on them.
• Determining applicable legal and regulatory obligations.
• Responding to security incidents and vulnerability reports relating to their own products.

Customers must not submit materials they are not authorized to disclose or process. Customers should avoid uploading private keys, passwords, access tokens, or other secret materials unless the service expressly supports their secure handling.

7. Acceptable use

You must not use EmbedHarbor services to:

• Gain unauthorized access to another party's systems or data.
• Distribute malware or facilitate unlawful attacks.
• Interfere with the availability or security of the service.
• Circumvent technical access controls or usage limits.
• Attempt unauthorized access to another customer's information.
• Submit unlawful content or knowingly infringe third-party rights.
• Misrepresent generated results as independently certified findings.
• Use automated access in a way that materially disrupts the service.

Legitimate defensive security research, vulnerability assessment, and authorized testing are not prohibited merely because they concern cybersecurity. However, security testing against EmbedHarbor's own production infrastructure requires appropriate authorization; see the vulnerability reporting section.

8. Free tools and open-source software

Certain EmbedHarbor tools may be made available without charge or distributed under open-source licenses. Use of a free hosted tool does not automatically grant rights to the underlying source code. Where software is published under an open-source license, the applicable license governs the rights granted to that software, and these Terms do not remove, restrict, or replace rights granted under a valid open-source license.

Free hosted services may have reasonable technical limits, including file-size restrictions, rate limits, or availability restrictions. The current browser tools state their limits on each tool page.

Unless expressly agreed otherwise, free services do not include guaranteed uptime, response times, technical support, or continued feature availability.

9. Technical findings and regulatory readiness

EmbedHarbor tools may provide validation results, component identification, vulnerability matches, security assessments, documentation status, or other technical findings. These outputs are based on the available inputs, configured analysis methods, accessible external data sources, and the scope of the relevant analysis.

Results may be incomplete or inaccurate due to missing identifiers, incomplete SBOMs, unavailable vulnerability intelligence, unsupported formats, outdated information, or other technical limitations. A finding of "no known high risk", a successful validation, or an absence of reported vulnerabilities does not establish that a product is secure or free from vulnerabilities.

EmbedHarbor does not automatically certify products or establish compliance with the EU Cyber Resilience Act or other regulatory frameworks. Unless a specific product feature and agreement expressly provide otherwise, use of the services does not submit regulatory notifications or vulnerability reports to public authorities on behalf of customers.

Customers remain responsible for independent assessment and applicable reporting, documentation, remediation, and conformity obligations.

10. Artificial intelligence and third-party intelligence

Some features may use AI models or third-party security intelligence sources. No AI-assisted feature is active on this website today. Outputs from such services may contain errors, omissions, false positives, or unsupported conclusions.

Customers must independently evaluate material findings before making security, operational, legal, or regulatory decisions. Where personal data or confidential Customer Data is transmitted to a third-party provider, the applicable data processing and contractual requirements must be satisfied.

Before any AI-assisted feature is enabled, the interface or documentation will identify the categories of information sent for processing, the provider or provider categories, and whether customer-supplied API keys are supported.

11. Privacy and data processing

Our Privacy Policy describes our processing of personal data for which we act as a controller.

Where EmbedHarbor processes personal data on behalf of a customer, the relevant processing obligations are governed by applicable law and an appropriate DPA or other binding data processing agreement. Customers remain responsible for their own lawful processing instructions and data protection obligations.

12. Paid services

Certain services may be offered under paid plans or separate commercial agreements. This website does not currently sell any service and offers no self-service checkout.

Where paid services are offered, applicable charges, billing terms, subscription periods, usage limits, renewal conditions, and cancellation arrangements must be presented before a customer enters a paid transaction. No fee or recurring payment obligation arises solely from visiting the public website or using a tool clearly offered without charge.

Any service-specific pricing or commercial commitments must be separately agreed or clearly presented at the point of purchase, including applicable taxes and refund conditions.

13. Service availability and changes

We may maintain, update, or modify services to improve security, compatibility, and functionality. We may introduce reasonable restrictions necessary to prevent abuse or protect the infrastructure.

Where a change materially affects an active contractual commitment, we will comply with applicable notice and contractual requirements. Service-level commitments apply only where expressly included in a binding agreement.

The free website and tools are provided on an "as available" basis: they may change, be suspended, or be withdrawn.

14. Suspension and termination

We may suspend or restrict access where reasonably necessary to:

• Address a significant security threat.
• Prevent unlawful use or abuse.
• Respond to a binding legal requirement.
• Protect other customers or the integrity of the service.
• Enforce a material breach of these Terms.

Where reasonably practicable and legally permitted, we will provide notice and an opportunity to address the issue. Customers may stop using free services at any time and may request account closure through the available account controls or support channel.

The consequences of termination, including data export, deletion, and retained records, are subject to the applicable agreement, data retention policy, and legal obligations. Hosted services state those rules in their agreement before the service is offered.

15. Intellectual property

EmbedHarbor and its licensors retain their rights in the proprietary services, software, user interfaces, documentation, and related intellectual property.

Subject to compliance with these Terms, customers receive a limited, non-exclusive, non-transferable right to access and use the hosted services for their authorized purposes during the applicable service period.

Open-source software is separately governed by its applicable license, and Customer Data remains subject to section 5. No license to use EmbedHarbor trademarks or branding is granted except as expressly authorized.

16. Confidentiality

Each party may receive non-public information from the other party in connection with the services. Where information is identified as confidential, or should reasonably be understood to be confidential from its nature and circumstances, the receiving party must use it only for authorized purposes and protect it with reasonable care.

Confidential information does not include information that becomes public without breach, was lawfully known without confidentiality restrictions, was independently developed, or was lawfully obtained from another source without confidentiality obligations. A party may disclose confidential information where legally required, subject to any applicable notice obligations and restrictions.

More detailed confidentiality obligations may be established in a separate agreement. The free tools process your files in the browser and do not disclose them to us.

17. Disclaimers

To the extent permitted by applicable law, informational website content and free services are provided on an "as available" basis without a promise that they will be uninterrupted, error-free, or suitable for every purpose.

We do not guarantee that vulnerability databases identify every relevant weakness, that analysis outputs are complete, or that using the services will prevent cybersecurity incidents.

Nothing in these Terms excludes warranties, statutory rights, or other obligations that cannot lawfully be excluded. Express obligations contained in a separate binding service agreement remain applicable.

18. Limitation of liability

Neither party excludes or limits liability to the extent such exclusion or limitation is prohibited by applicable law. Any agreed limitation of liability preserves mandatory legal protections and addresses the applicable exceptions.

Paid and hosted services: the aggregate liability cap, the measurement period, and any exclusion of indirect or consequential losses are stated in the applicable order form or service agreement, which prevails over this section.

Free website and tools: to the extent permitted by law, we are not liable for indirect or consequential loss, or for decisions taken in reliance on a tool result. Nothing in these Terms limits liability that cannot be limited by law.

19. Governing law and disputes

The parties should first attempt to resolve disputes through good-faith communications. Questions and disputes may be sent to [email protected].

For a paid or hosted service, the governing law and the competent courts or agreed dispute resolution mechanism are stated in the applicable agreement, which prevails over this section.

These Terms do not select a governing law or forum for the free website and tools. Nothing in this section restricts mandatory rights or legal remedies that cannot lawfully be waived in your jurisdiction.

20. Changes to these terms

We may update these Terms for future use of the services. For material changes affecting existing users, we will provide notice and obtain any consent required by applicable law or a binding agreement.

Changes will not retroactively modify a separately signed agreement unless permitted by that agreement and applicable law. The effective date of the current version appears at the top of this page.

21. Contact

Questions about these Terms may be directed to:

Shanghai Weisha Technologies Co., Ltd.
上海未鲨科技有限公司
Registered office: 10th Floor, Building 1, No. 188 Changyi Road, Baoshan District, Shanghai, China
上海市宝山区长逸路188号1幢10层
Company registration identifier (Unified Social Credit Code): 91310113MAEGFWLF2L
Registration authority: Shanghai Baoshan District Administration for Market Regulation
上海市宝山区市场监督管理局
Email: [email protected]
Website: https://embedharbor.com

See the legal notice for the confirmed operator details.