Meldora portal terms of use

§ 1. General provisions

The provider and operator of the Meldora portal (the “Portal”) is , trading as , , tax ID (NIP) , e-mail: , phone: (the “Provider”).

The Portal is a tool supporting the Provider's consulting services in software vulnerability handling and compliance with Regulation (EU) 2024/2847 (the Cyber Resilience Act). The services are provided under a separate agreement concluded with the Client (the “Agreement”). In case of conflict between these Terms and the Agreement, the Agreement prevails.

The Terms are available free of charge in the Portal in a form that allows them to be downloaded, stored and printed. Using the Portal requires every User to accept the Terms at first sign-in and after every change of the Terms.

§ 2. Definitions

1. Client: a business that has concluded the Agreement with the Provider and for which a company account is kept in the Portal.
2. User: a natural person using the Portal on behalf of the Client through an individual account.
3. Account: the set of resources and permissions in the Portal assigned to a User, protected by a password and a second authentication factor (MFA).
4. Client Data: data entered into the Portal by or on behalf of the Client, in particular product data, component lists (SBOMs), decisions, messages and attachments.
5. Report: a document prepared by the Provider in the Portal containing a vulnerability assessment, a decision on notification and proposed notification texts.
6. Notification: a notification to ENISA or the competent CSIRT that the Client is obliged to submit under Article 14 of the Cyber Resilience Act.

§ 3. Technical requirements

Using the Portal requires: a current web browser with JavaScript, internet access, an e-mail address and an authenticator app (TOTP), a hardware key or a passkey. Receiving notifications about urgent matters requires a mobile phone number.

The Portal uses only necessary browser storage (session, chosen language, theme). It uses no marketing or analytics cookies.

§ 4. Accounts and security

1. The Client's first account is created by the Provider under the Agreement. Further accounts are created by the Client's Users by sending an invitation from the Portal. The Client is responsible for whom it admits to the Portal.
2. An account is personal. Sharing sign-in credentials with other persons, including within the Client's company, is prohibited.
3. Signing in requires a password and a second factor (MFA). A session expires after 30 minutes of inactivity and after 12 hours at the latest.
4. A User promptly informs the Provider of losing control of the account, losing the device with the authenticator app, or suspecting unauthorised access.
5. The Provider may block an account or a session upon identifying a threat to the security of the Portal or Client Data, informing the Client without undue delay.
6. The Client is liable for the actions of its Users in the Portal as for its own.

§ 5. Scope of the Portal

The Portal allows in particular: keeping a list of products and their versions, storing SBOMs, continuously comparing components with public vulnerability databases, notifying about matches, passing matches to the Provider for assessment, making Reports available, keeping an event log, exchanging messages and preparing Notification texts.

The Portal is not connected to the ENISA reporting platform and does not submit Notifications. Notification texts prepared in the Portal are proposals that the Client verifies and submits itself.

Monitoring results depend on the completeness and correctness of the SBOM provided by the Client and on the content of public vulnerability databases. The absence of a match does not mean that the product is free of vulnerabilities.

Reports are prepared within the deadlines set in the Agreement. Deadlines in business days exclude Saturdays, Sundays and public holidays in Poland. If preparing a Report requires information from the Client, the deadline is paused until it is provided, which is recorded in the order log.

§ 6. Client obligations

1. Keeping product data current, including versions, EU markets and the support period, and providing an SBOM after every release.
2. Designating and keeping current an emergency contact with a phone number, reachable in urgent matters.
3. Taking decisions on matches and answering the Provider's questions without undue delay, given the deadlines under the Cyber Resilience Act.
4. Submitting Notifications itself from its own account on the ENISA platform and recording in the Portal the fact and date of submission.
5. Promptly informing the Provider of security incidents concerning the products and of vulnerability information obtained through other channels, as these may start statutory deadlines.
6. Using the Portal in accordance with the law, the Terms and the Agreement.

§ 7. Prohibited conduct

In particular, the following is prohibited:

1. attempting to access data of other clients of the Provider or parts of the Portal not intended for the User,
2. performing security tests, scans or load tests of the Portal without the Provider's prior written consent,
3. uploading files containing malicious code or content inconsistent with the purpose of the Portal,
4. automated retrieval of data from the Portal other than through the provided API and tokens issued to the Client,
5. sharing API tokens with persons outside the Client's organisation,
6. distributing Reports in a way that breaches the Agreement or the Provider's rights.

Anyone who notices a vulnerability in the Portal itself is asked to report it to . The Provider follows coordinated vulnerability disclosure principles and will not take legal action against reporters acting in good faith.

§ 8. Client Data and intellectual property

1. Client Data remains the property of the Client. The Client grants the Provider a non-exclusive right to process it solely for the purpose and to the extent necessary to provide the services covered by the Agreement, for its duration and the retention period set in § 14.
2. The Provider does not use Client Data for other purposes; in particular it does not make it available to other clients or use it to train statistical models without the Client's express consent.
3. Reports are works in which copyright belongs to the Provider. Upon a Report being made available in the Portal, the Client obtains a perpetual, non-exclusive licence to use the Report for its own business, including passing it to public authorities, ENISA, CSIRTs, auditors, notified bodies and recipients of the products.
4. The Portal, its software, layout and help content are protected by copyright and belong to the Provider. The Client acquires no rights to them beyond the right to use the Portal under these Terms.

§ 9. Confidentiality

The Provider keeps Client Data, Reports and the content of communication confidential and secures them as described in the privacy policy and the Agreement. This information is not disclosed to third parties, except to subcontractors necessary to provide the service (hosting, e-mail, SMS) bound by confidentiality, and where disclosure is required by law.

§ 10. Availability and maintenance

1. The Provider endeavours to keep the Portal available around the clock. Maintenance windows are, where possible, announced at least 24 hours in advance and scheduled outside working hours; this does not apply to interruptions necessary to fix a failure or a security threat.
2. Vulnerability monitoring depends on the availability of external databases (including NVD, OSV, GitHub Advisories, CISA KEV, EUVD). The Portal shows the time of the last synchronisation of each source.
3. The Provider makes backups at least daily and stores them encrypted within the European Union.
4. The Provider may change Portal features as long as this does not reduce the scope of services set in the Agreement. The Client is informed of material changes in the Portal.

§ 11. Liability

1. The Portal and the Reports support the Client's decisions. Decisions on the impact of a vulnerability on the product, on the content and submission of a Notification and on corrective measures are taken by the Client as the manufacturer within the meaning of the Cyber Resilience Act, and the Client bears the liability arising from that Regulation.
2. The Provider is not liable for the consequences of incomplete or outdated Client Data, in particular SBOMs, for the content and timeliness of Notifications submitted by the Client, or for the operation of the ENISA platform or external vulnerability databases.
3. The Provider's liability for the services is governed by the Agreement and applicable law. Unless the Agreement provides otherwise, the Provider's liability is limited to actual damage and to the amount of fees paid by the Client in the 12 months preceding the event. The limitation does not apply to damage caused intentionally.
4. Reports and help content in the Portal do not constitute legal advice. In matters requiring legal interpretation the Client should consult a lawyer.

§ 12. Personal data

The processing of Users' personal data is described in the privacy policy available in the Portal. For User account data the Provider is the controller. If the Client enters personal data of other persons into the Portal (e.g. in messages or attachments), the Provider processes it as a processor under the data processing agreement forming part of the Agreement.

§ 13. Complaints

Complaints about the operation of the Portal may be sent to . A complaint should describe the problem, when it occurred and contact details. The Provider responds within 14 days of receipt.

§ 14. End of use

1. Access to the Portal lasts for the term of the Agreement. After it ends the Client may download its Data, Reports and event log from the Portal for 30 days.
2. After that period the Provider deletes Client Data and the company's encryption key, except for data it must retain under the law (e.g. accounting documents) or that is necessary to establish, pursue or defend claims, and except for copies of Reports and the log if the Client requests their longer retention as evidence of compliance.
3. The Provider may block the access of a User or Client that breaches the Terms, after first requesting that the breach cease, and immediately in case of a threat to the security of the Portal or other clients' data.

§ 15. Changes to the Terms

The Provider may change the Terms for important reasons, in particular changes in law, Portal features or security requirements. The Client is informed of a change in the Portal and by e-mail at least 14 days before it takes effect. At the first sign-in after that date the User accepts the new version. A Client that does not accept the changes may terminate the Agreement under its provisions.

§ 16. Final provisions

1. The Terms are governed by Polish law.
2. Disputes arising from the use of the Portal are settled by the court competent for the Provider's seat, unless the Agreement provides otherwise.
3. If any provision of the Terms proves invalid, the remaining provisions remain in force.
4. The Terms take effect on 6 Nov 2026.