Disclaimer and Responsibility Matrix
DRAFT – pending legal review. This text is a working draft and is not yet in force. It must be reviewed by counsel before it is used in a contract.
This page explains the limits of Softwsp services, a brand of Netbase JSC, and sets out who is responsible for what. It forms part of our terms.
Who does what
| Area | Softwsp | Customer |
|---|---|---|
| Firmware analysis, reports, SBOM | Responsible | Provides the file of the version actually sold |
| Source code and SDK that can be built, and the legal right to use them | Not applicable | Responsible |
| Patching within the agreed scope, emulated tests, re-scan | Responsible | Approves the scope |
| Test lab at the customer’s site, sample devices, network access, coordinating engineer | Sends a checklist and checks the lab remotely | Responsible |
| Tests on real devices to the agreed test set | Carries them out remotely | Cooperates and confirms results |
| Firmware signing and key management | Supports the process | Responsible and holds the keys |
| Re-testing for radio or product approvals if a change affects them | Points out items that may be affected | Responsible |
| OTA release and mass rollout | Only if rollout service is purchased, following a plan the customer approves | Responsible by default |
| Operation of devices, machines, power and networks at the customer’s site | Does not do this | Responsible |
| Compliance filings and reports to authorities | Drafts documents if purchased | Responsible for submitting and signing |
| Network recordings and changes to running networks (plants) | Gives guidance only | Records, decides and applies changes |
| Vulnerabilities found after hand-over | Alerts if a monitoring service is purchased | Decides and applies fixes |
Limits of our work
- No absolute assurance. Reports reflect the vulnerabilities and issues known on the date of analysis, for the firmware version or information provided. We do not guarantee that a product is free of vulnerabilities, and we make no claim of absolute security.
- Not a certification. Our reports and documents support compliance work. They are not certificates from a testing laboratory or competent authority. Compliance remains the responsibility of the manufacturer or importer.
- Information supplied by you. We are not responsible for errors that result from incorrect or incomplete files, source code, SDKs or information supplied.
- Scope. Fixes cover only the items in the signed scope. Anything else is a new request.
- Emulated environments. Tests in emulation do not fully represent real hardware. The customer confirms results of tests on real devices before release.
- Release and rollout. The customer decides on release, signing, rollout and rollback, except where a purchased rollout service was carried out according to the approved plan.
- Sample devices. Sample devices are supplied for testing. We are not responsible for damage to sample devices when the agreed procedure was followed.
- Re-certification. The cost and responsibility for any re-testing or re-certification lie with the customer.
- Liability. Our total liability is limited as set out in the terms and does not cover indirect loss such as lost revenue, recalls or business interruption.
- Confidentiality and data. Customer material is used only for the job, stored encrypted and deleted at the agreed time, under a mutual confidentiality agreement.
- Disclosure. Vulnerabilities found in a customer’s firmware are not published without the customer’s agreement, unless already public from another source.
- Rights in the material. The customer warrants that it has the legal right for us to analyse and, where agreed, modify the material provided.
Additional limits for industrial and plant work
- Passive recordings only. A network recording reflects only the traffic seen during the recording period. Devices that did not communicate in that time will not appear, and identification of models and firmware from traffic may be incomplete.
- No operation of production systems. We do not operate on running machines or production networks, and we do not run active scans on production networks. Active testing happens only on a lab or sample machine with written agreement.
- No patching of third-party controllers. We do not patch the firmware of PLCs, robots or CNC controllers made by other vendors. We point to the vendor’s official fix or to a mitigation.
- Recommendations need local review. Recommendations must be assessed by a qualified engineer at the customer under the plant’s safety procedures before they are applied. Softwsp is not liable for production interruption, damage to machines or safety incidents that arise when recommendations are applied.
Website content
Guides and articles on this website are general information, not legal advice. Please check the current official text of each regulation and obtain advice for your own situation.
Contact
Questions about this page: see the contact page.