Terms of Service

Last updated: February 2026

1. Service Description

Lab 191 provides security due diligence reports for open-source software components, delivered as PDF documents. Reports are designed to support compliance with the EU Cyber Resilience Act (CRA) and related regulatory requirements.

2. Nature of Deliverable

Reports represent the professional opinion of our assessors based on evidence available at the time of assessment. They are not guarantees of security, certifications, or legal compliance advice. Reports provide evidence to support your compliance efforts but do not constitute legal advice.

3. Scope Limitation

  • Reports cover the specific version analyzed at the time of issue
  • Reports do not constitute legal advice
  • Reports do not guarantee regulatory compliance — they provide evidence to support compliance efforts
  • Reports are "point-in-time" assessments and do not cover future vulnerabilities or version changes
  • Assessment scope is limited to the component itself and (for High-Criticality reports) its top transitive dependencies

4. License of Use

Upon purchase, you receive a non-exclusive, non-transferable license to:

  • Use the report for internal compliance documentation
  • Share the report with auditors, regulators, and certification bodies
  • Include the report in technical documentation required by the CRA

Reports may not be resold, publicly distributed, or used for marketing purposes without prior written permission.

5. Limitation of Liability

Our total liability arising out of or related to the purchase or use of any report is limited to the purchase price of that report. We are not liable for indirect, consequential, incidental, or punitive damages. We are not liable for regulatory decisions made by market surveillance authorities or any other regulatory body.

We are not liable for security incidents, vulnerabilities, or failures involving any component we have assessed. Our reports reflect the state of a component at the time of assessment and do not warrant its ongoing security or fitness for any particular deployment.

6. Payment Terms

  • All engagements are initiated via proposal and completed via invoice
  • Payment terms: Net 15 or Net 30 as specified on the invoice
  • Invoices are issued via Stripe Invoicing or manual invoice; wire transfer is accepted for large engagements
  • Prices are listed in USD, exclusive of applicable taxes (VAT calculated on invoice)

7. Refund Policy

  • Full refund available within 7 days of invoice payment if the report has not yet been delivered
  • No refunds after report delivery (digital delivery)
  • For multi-component engagements, prorated refunds are available for undelivered reports

8. Intellectual Property

Report content is copyrighted by Lab 191. The underlying open-source component code remains under its original license. Our assessment methodology, tooling, and report templates are proprietary.

9. Disclaimer

This report represents the professional assessment of the undersigned as of the date of issue. It is based on information available at the time of analysis and does not constitute a guarantee of security, a certification, or legal advice. The assessment covers the specific version indicated and does not extend to future versions, patches, or configurations not evaluated. Users of this report should conduct their own evaluation of the component's suitability for their specific use case and regulatory context.

10. Confidentiality & Data Handling

In the course of providing our services, you may share dependency lists, SBOMs, or other technical information about your software stack. We treat all customer-submitted data as confidential and:

  • Use it solely for the purpose of producing your assessment
  • Do not share it with third parties
  • Do not use it for marketing, benchmarking, or aggregate analysis without your explicit written consent
  • Delete customer-submitted data within 90 days of report delivery upon request

For details on personal data processing, see our Privacy Policy.

11. Governing Law

These terms are governed by and construed in accordance with the laws of Ireland. Any disputes arising from these terms that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the courts of Ireland.

12. Changes to These Terms

We may update these terms from time to time. Material changes will be communicated via email to active customers. Continued use of our services after changes constitutes acceptance of the updated terms.

Questions about these terms? Contact us.