Terms of Use

1. License Grant

Subject to your continuous compliance with these Terms and your payment of any applicable fees, the Vendor grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to install and run the Software on machines you own or control, solely for your internal business purposes and only for the duration permitted by your active license file, license.json, issued by the Vendor.

This license terminates automatically upon expiry of your license file, upon any breach of these Terms, or upon revocation by the Vendor.

2. Restrictions

You shall not, and shall not permit any third party to:

• Copy, distribute, sublicense, lease, rent, lend, sell, or otherwise transfer the Software or any license file to any third party.
• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Software, except to the extent such activity is expressly permitted by applicable law notwithstanding this restriction.
• Modify, adapt, translate, or create derivative works of the Software.
• Remove, alter, or obscure any proprietary notices, license file contents, signatures, watermarks, or attributions in or on the Software or its outputs.
• Circumvent, disable, or otherwise interfere with any licensing, authentication, expiry, or anti-tampering mechanism of the Software, including by tampering with the license file, the embedded public key, or the system clock.
• Use the Software to develop a competing product, or to benchmark the Software for the purpose of public comparison, without the Vendor's prior written consent.
• Use the Software in any way that violates applicable law or third-party rights.

3. Open-Source Components

The Software bundles or depends on third-party open-source components, including but not limited to Syft (Apache-2.0), Grype (Apache-2.0), and Electron (MIT). Those components are licensed under their own terms; nothing in these Terms modifies your rights or obligations with respect to those components. Applicable notices are described in the THIRD_PARTY_NOTICES.md file shipped with the Software, and the full license texts for redistributed components are shipped with the Software in the files referenced there.

4. Advisory Tool, No Legal, Security, or Compliance Advice

The Software is an advisory and informational tool only. The Software's outputs, including any Software Bill of Materials, license report, vulnerability or CVE report, risk classification, copyleft analysis, or other artifact produced by the Software, are provided for informational purposes only and must not be relied upon as legal advice, security advice, license-compliance certification, or a definitive determination of any matter relating to open-source licensing, intellectual property, security, or regulatory compliance.

You acknowledge and agree that:

• The Software depends on third-party tools and data sources, including Syft, Grype, Grype's vulnerability database service, and the Google deps.dev Open Source Insights API, and the Vendor has no control over their accuracy, completeness, or availability.
• The Software's classification of a license as permissive, copyleft (weak), copyleft (strong), or unknown is a heuristic, not a legal opinion.
• The Software may fail to detect dependencies, misidentify licenses, miss obligations, and produce false positives or false negatives.
• Deep-enrichment features may introduce additional inaccuracies, and any license assertion you accept or enter through the Software is your responsibility.
• You are solely responsible for your own legal and license compliance and for independently verifying the Software's output before relying on it for any decision.

5. No Warranty

The Software is provided "AS IS" and "AS AVAILABLE," with all faults and without warranty of any kind. To the maximum extent permitted by applicable law, the Vendor disclaims all warranties, whether express, implied, statutory, or otherwise, including without limitation the implied warranties of merchantability, fitness for a particular purpose, title, accuracy, completeness, quiet enjoyment, and non-infringement, and any warranties arising from a course of dealing, usage, or trade practice.

Without limiting the foregoing, the Vendor does not warrant that the Software will meet your requirements, operate uninterrupted or error-free, be free of harmful components, have all defects corrected, produce accurate or reliable output, detect every applicable open-source or security issue, or retain access to any third-party service the Software depends on.

6. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall the Vendor be liable to you or any third party for any indirect, incidental, special, consequential, exemplary, or punitive damages, including damages for lost profits, lost revenue, lost data, lost goodwill, business interruption, procurement of substitute goods or services, regulatory fines, settlement payments, royalties, license-compliance liabilities, litigation costs, or any other damages, however caused and under any theory of liability, even if the Vendor has been advised of the possibility of such damages.

The Vendor's aggregate liability arising out of or relating to these Terms or the Software, whether in contract, tort, or otherwise, shall not exceed the lesser of the total fees actually paid by you to the Vendor for the Software in the twelve months immediately preceding the event giving rise to the claim, or US $100.

These limitations apply notwithstanding the failure of any limited remedy of its essential purpose and to the maximum extent permitted by law.

7. Indemnification

You shall defend, indemnify, and hold harmless the Vendor and the Vendor's affiliates, officers, employees, and agents from and against any and all claims, demands, actions, liabilities, damages, losses, costs, and expenses, including reasonable attorneys' fees, arising out of or related to your use of the Software, your reliance on any Software output, your failure to comply with applicable open-source license obligations, your breach of these Terms, or your violation of any law or third-party right.

8. License File and Expiry

The Software requires a valid, unexpired license file, license.json, signed by the Vendor. You acknowledge that license files have an expiry date, features remain available only while a valid license file is installed and unexpired, and tampering with the license file, the embedded public key, the license-state file, or the system clock is a material breach of these Terms and may also violate applicable computer-misuse laws.

9. Network Features and Data Handling

The Software's deep-scan and deep-enrichment features make outbound network requests to third-party services, including, depending on the ecosystem, proxy.golang.org, registry.npmjs.org, pypi.org, and api.deps.dev. These features transmit only package coordinates, consisting of name, version, and ecosystem identifier; the Software does not transmit your source code or repository contents.

The Vendor is not responsible for the policies, availability, or accuracy of those third-party services, and your use of those features is subject to their respective terms. The Vendor does not collect telemetry from the Software. For additional details, see the Privacy Policy shipped with the Software.

If you purchase a paid license, support, if any, is provided as described in the Support & Maintenance Policy shipped with the Software. Vulnerability scanning also relies on Grype's vulnerability database, which is downloaded and refreshed from third-party infrastructure operated for the Grype ecosystem.

10. Term and Termination

These Terms remain in effect until terminated. They terminate automatically without notice upon expiry of your license file or upon your breach of any provision. The Vendor may also terminate these Terms at any time by revoking your license.

Upon termination, you shall cease all use of the Software and delete all copies in your possession or control. Sections 2, 4, 5, 6, 7, 11, 12, and any other provisions that by their nature should survive termination, will survive.

11. Governing Law and Venue

These Terms are governed by, and construed in accordance with, the laws of the State of Arizona, USA, without regard to its conflict-of-laws rules. The parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Maricopa County, Arizona for any dispute arising out of or relating to these Terms or the Software. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

12. Miscellaneous

• Entire agreement. These Terms constitute the entire agreement between you and the Vendor regarding the Software and supersede any prior or contemporaneous agreements on the subject.
• Severability. If any provision of these Terms is held unenforceable, the remaining provisions remain in full force.
• No waiver. No failure or delay by the Vendor in exercising any right shall operate as a waiver.
• Assignment. You may not assign or transfer these Terms or any rights hereunder without the Vendor's prior written consent. The Vendor may assign these Terms freely.
• Updates. The Vendor may revise these Terms from time to time. Continued use of the Software after revised Terms are made available constitutes your acceptance of the revised Terms.
• Refunds. Refunds, if any, are governed by the OSSScan Refund Policy shipped with the Software and available from the Vendor upon request.
• Contact. Questions about these Terms should be sent to jim@ossscan.com.

Acknowledgement

By installing or using OSSScan, you acknowledge that you have read, understood, and agree to be bound by these Terms of Use.