Terms of Service

Version 1.0. These terms are under legal review. Until that review is complete they apply as published here. This English text is a translation; the German version (Allgemeine Geschäftsbedingungen) prevails.

1. Scope and provider

These Terms of Service apply to all contracts on the use of the software-as-a-service platform "Resilic" and the associated software "Resilic Edge" (together: the "Services") between Resilic AI – Christian Morgenthaler, Gartenstraße 24, 76307 Karlsbad, Deutschland ("Resilic") and the customer.

The Services are offered exclusively to businesses within the meaning of section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. Consumers cannot contract for the Services.

Deviating, conflicting or supplementary terms of the customer do not become part of the contract, even if Resilic does not expressly object to them.

2. Subject of the contract

Resilic is a platform with which manufacturers of machinery and industrial equipment manage their products, their software components (software bills of materials), suppliers, installations in the field and known vulnerabilities, and prepare the reporting obligations under Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act, "CRA"). The current scope of the Services follows from the service description and the price list on resilic.ai and from the documentation at docs.resilic.ai.

Resilic supports the customer in preparation and documentation. Resilic does not provide legal advice, does not assess the conformity of the customer's products with the CRA, the Machinery Regulation (EU) 2023/1230 or other rules, and does not guarantee conformity. Responsibility for meeting legal obligations, including reporting obligations towards authorities, remains with the customer.

Vulnerability information comes from public third-party sources (among others EUVD, NVD and CISA KEV) and from security advisories of the customer's suppliers. Resilic gives no warranty for the completeness, correctness or timeliness of these sources.

3. Conclusion of the contract and free trial

By creating an organisation in Resilic and accepting these terms, a contract on a free, non-binding trial of 30 days is concluded. The trial ends automatically; no payment obligation and no automatic renewal arise.

A paid contract is concluded only when the customer expressly orders a plan and Resilic confirms the order by activating it. The person who creates the organisation or orders a plan confirms that they are authorised to contract on behalf of the customer.

4. Scope of services and availability

Resilic provides the Services as an online service. The point of delivery is the outbound connection of the data centre in which Resilic is operated. The customer is responsible for its own internet connection and devices.

Resilic aims at an availability of 99.5 % on a monthly average at the point of delivery. Announced maintenance windows, disruptions outside the responsibility of Resilic, and periods in which the customer cannot use the Services for reasons on its own side do not count as downtime.

Resilic develops the Services continuously. Functions may be extended, changed or, where reasonable for the customer and the agreed core of the service is preserved, discontinued. Resilic announces material changes in good time.

The customer can export its data from Resilic at any time in common machine-readable formats (among others CycloneDX, CSV, JSON and PDF).

5. Resilic Edge

Resilic Edge is software the customer runs on its own hardware in its network or in the network of its end customer. For the term of the contract Resilic grants the customer a simple, non-exclusive, non-transferable right to use Resilic Edge within the Services. Any further use, in particular reverse engineering, decompilation or passing it on to third parties, is not permitted unless mandatory law allows it.

The customer decides in which network it deploys Resilic Edge and ensures that it is entitled to do so. Resilic Edge reads device information with read-only standard protocols only; assessing the effects on the respective network is the customer's responsibility.

6. AI-assisted functions

Some functions use AI models to produce drafts, for example of reports, policies or assessments. Drafts are labelled as such and take effect only after review and approval by a named person of the customer. Resilic submits nothing to authorities.

AI drafts are produced by an external provider on behalf of Resilic. The customer's content is not used to train AI models. Details are governed by the data processing agreement.

7. Customer's obligations

• The customer keeps credentials confidential, manages the access rights of its users and informs Resilic without delay of any misuse.
• The customer uses the Services only within the law and the contract and does not upload content for which it lacks the necessary rights.
• The customer reviews results, drafts and assessments from Resilic before using them, in particular before a report to an authority or a communication to end customers.
• The customer backs up its data at reasonable intervals through exports, as far as it needs the data outside Resilic.
• The customer reports disruptions without delay and cooperates in their resolution to a reasonable extent.

8. Fees and payment

The fee follows from the ordered plan and the price list valid at the time of the order. All prices are net of statutory VAT. Depending on the plan the fee is due monthly or annually in advance.

Payments are processed by the payment provider Stripe. In the event of default Resilic may suspend access after a reminder and a reasonable grace period; the payment obligation remains.

Resilic may change prices with six weeks' notice to the start of a new billing period. If the customer objects to the change, either party may terminate the contract as of the date the change takes effect; otherwise the change is deemed accepted. Resilic points out this consequence in the notice.

9. Term and termination

Contracts with monthly billing run for one month and renew by one month unless terminated to the end of the current month. Contracts with annual billing run for twelve months and renew by twelve months unless terminated with one month's notice to the end of the term. Termination is given in text form or through the account settings in Resilic.

The right to terminate for cause remains unaffected. Cause exists for Resilic in particular where the customer is in default with two monthly fees despite a reminder, or uses the Services unlawfully.

After the end of the contract the customer can export its data for a further 30 days. Resilic then deletes the organisation's data unless a statutory retention duty requires otherwise.

10. Data protection

Where Resilic processes personal data on behalf of the customer, the data processing agreement applies, which is part of this contract. The privacy policy applies to processing on the public website.

11. Warranty

Resilic provides the Services according to the state of the art and remedies defects within a reasonable time. The warranty does not cover impairments caused by circumstances outside Resilic's responsibility, in particular third-party data, the customer's infrastructure or use contrary to the contract.

Resilic does not owe a particular outcome in detecting vulnerabilities, attributing devices or the customer meeting deadlines. Drafts and assessments are aids; the decision is the customer's.

12. Liability

Resilic is liable without limitation for intent and gross negligence, for injury to life, body or health, under the Product Liability Act and to the extent of a guarantee it has given.

For slight negligence Resilic is liable only for the breach of material contractual duties, meaning duties whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer regularly relies. In that case liability is limited to the typical, foreseeable damage and at most to the fees the customer paid in the twelve months before the event giving rise to the claim.

For loss of data Resilic is liable, within the above rules, only up to the effort that would have been needed to restore the data had the customer backed it up properly and regularly. Any further liability is excluded.

13. Confidentiality

Both parties treat confidential information of the other party, in particular product, vulnerability and customer data, as confidential and use it only to perform the contract. The duty continues for three years after the end of the contract. It does not apply to information that is or becomes public without the receiving party's fault, or that must be disclosed by law.

14. Changes to these terms

Resilic may change these terms with effect for the future where this is necessary for objective reasons, such as a change in the law or in the Services, and the change does not unreasonably disadvantage the customer. Resilic announces changes in text form at least six weeks before they take effect. If the customer does not object within that period the change is deemed accepted; Resilic points out this consequence in the notice. If the customer objects, the contract continues on the previous terms and either party may terminate it at the next possible date.

15. Final provisions

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. If the customer is a merchant, a legal entity under public law or a special fund under public law, Karlsruhe is the exclusive place of jurisdiction for all disputes arising from this contract.

Changes and additions to the contract require text form. Should a provision of these terms be invalid, the remaining provisions stay in force. In case of differences between the German version and a translation, the German version prevails.