TuxCare SecureChain Portal Terms of Use

Effective date: October 15, 2026

Please read these TuxCare SecureChain Portal Terms of Use (the “Terms of Use” or “Terms”) before You access and use the SecureChain Portal at https://sc.tuxcare.cloud and its workspace subdomains. These Terms govern the portal, its APIs, related submitters, and the services available through them (the “Portal Services”). They form a legal agreement between You (“You” or “Your”) and TuxCare, Inc. (“We” or “TuxCare”).

If You accept for an entity, You represent that You have authority to bind that entity. In that case, “You” means that entity and its authorized users. Authorized Users act on Your behalf, and You are responsible for their compliance with these Terms. By accepting these Terms of Use, You also accept the SecureChain Portal Data Processing Addendum published at https://tuxcare.com/legal/securechain-portal-data-processing-addendum/ (the “DPA”), which is incorporated into these Terms by reference and applies where TuxCare processes Personal Data on Your behalf. You accept these Terms through the acceptance control provided by TuxCare or by signing an Order that incorporates them. If You do not accept, do not create a workspace or use the Services.

TuxCare may update these Terms from time to time. An updated version becomes binding when You affirmatively accept it through an electronic acceptance control provided by TuxCare or by signing an Order that references the updated version. TuxCare may require acceptance of an updated version as a condition of continued Free Access or renewal of a paid Subscription. Unless You accept an updated version earlier, the version applicable to an existing paid Subscription will continue to apply for the remainder of its then-current Subscription Term, except to the extent a change is required by applicable law.

1. Definitions

The following definitions apply to these Terms of Use:

“Account” means an individual user profile used to authenticate to and access the Portal and one or more Workspaces. Creating an Account does not, by itself, create a paid Subscription or billing obligation.

“Authorized User” means an employee, contractor, or other individual whom You authorize to access or use Your Workspace, the Programs, or the Portal Services on Your behalf.

“Access Credentials” means passwords, SSO credentials, Tokens, API keys, registry credentials, and other credentials used to access a Workspace, the Programs, or the Portal Services.

“Applicable Data Protection Laws” means all applicable data protection, data privacy, and cybersecurity laws, rules, and regulations anywhere in the world that are in force from time to time, including but not limited to (i) the EU General Data Protection Regulation 2016/679, (ii) the Swiss Federal Act on Data Protection of 25 September 2020, in force since 1 September 2023 (“FADP”), and (iii) in respect of the United Kingdom, the GDPR as it forms part of UK law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018.

“Customer Data” means data or content that You or Your Authorized Users submit, transmit, store, or otherwise make available to TuxCare through the Programs or Portal Services, including through a Workspace or the CLI, and data derived from it. Customer Data does not include SecureChain Output, except that any Customer Data incorporated into or reproduced in SecureChain Output remains Customer Data.

“Documentation” means the then-current user manuals, technical documentation, and coverage information made available by TuxCare for the applicable Programs and Subscription Services, including the lists of supported technologies, versions, and packages.

“Free Access” means access to a SecureChain Workspace that TuxCare makes available under its then-current free plan, without charge and without requiring a credit card. Free Access is subject to the applicable Usage Limits and other conditions disclosed on the SecureChain Portal or in the applicable Documentation. Free Access is not a paid Subscription or a trial that automatically converts to a paid Subscription.

“Open-Source Components” means third-party software distributed under an open-source license that is included in or distributed with the Programs.

“Order” means an ordering document, quote, or purchase record accepted by You and TuxCare or an authorized reseller. It identifies the purchased services, tier, term, fees, and applicable license metric or limits.

“Personal Data” means any information relating to an identified or identifiable natural person that relates to, describes, is capable of being associated with, or could be linked, directly or indirectly, with a particular natural person, as defined by Applicable Data Protection Laws, and accessed, stored or otherwise processed by TuxCare as part of its provision of the Service to Customer.

“Programs” means the SecureChain command-line interface (CLI) and any related client, submitter, agent, integration, or other software that TuxCare makes available for installation or execution on Your systems or in Your CI/CD environment, including updates to that software. Programs do not include the hosted SecureChain Portal or Access Credentials.

“SecureChain Portal” or “Portal” means Tuxcare’s hosted web application, including its associated Workspace subdomains and APIs, available at https://sc.tuxcare.cloud or any successor address designated by TuxCare.

“Portal Services” or “Services” means the Portal and related hosted functionality made available by TuxCare, including Workspaces, APIs, integrations, vulnerability matching, findings, scan history and comparisons, triage, remediation information, reports, alerts, and rechecking of retained scans. Available features and Usage Limits may depend on whether You have Free Access or a paid Subscription.

“Subscription Services” or “Subscription” means paid Portal Services, features, or support, if offered, purchased under an applicable Order. Free Access is not a paid Subscription.

“SBOM” means a software bill of materials that describes components, their versions, and related metadata.

“SecureChain Output” means analyses and results generated by or through the Programs or Portal Services based on Customer Data, including findings, scan comparisons, fix plans, recommendations, reports, alerts, exports, and SBOMs generated by the Programs or Portal Services. SecureChain Output may incorporate or reproduce Customer Data, and any Customer Data contained in SecureChain Output remains Customer Data. SecureChain Output does not include the Programs, the TuxCare catalogue, underlying vulnerability or advisory databases, or third-party materials.

“Token” means a credential that permits a user or an automated process to access specified Services.

“Usage Limits” means the limits applicable to Your use of the Programs or Portal Services, including limits on Authorized Users, Workspaces, scans, submissions, storage, retention, API requests, integrations, or other usage, as specified in the applicable Order, free plan, or Documentation.

“Vulnerability Advisory” or “Advisory” means information published or maintained by TuxCare or a third party concerning a known or suspected vulnerability, security issue, affected component or version, available fix, or mitigation.

“Workspace” means the organization-specific environment within the Portal through which You and Your Authorized Users submit, store, access, review, and administer Customer Data and SecureChain Output.

SecureChain Portal and CLI

The Portal stores dependency reports and SBOMs. It matches their components against vulnerability advisories and available TuxCare catalogue information. It keeps scan history, compares scans, and provides findings, triage controls, fix recommendations, and configured notifications. New advisories can cause the Portal to evaluate stored inventories again without a new upload from You.

The CLI reads supported package metadata and uses Your package manager or other supported tools to obtain dependency information. Some commands can change project configuration, install packages, or fail a CI build under Your selected rules. You remain responsible for backups, review, tests, deployment, and the actions of Your own tools.

Upload behavior depends on the client version, command, and configuration. An upload can include private package names and repository metadata. SBOM can also include dependency graphs, artifact hashes, relative paths, component metadata, and any additional fields in the submitted document. Read the SecureChain Portal Privacy Policy and review the upload preview that the client provides before You authorize a workflow.

Ordinary dependency submissions do not require source code. Do not submit source code, passwords, private keys, Access Credentials, or personal or confidential information that is not reasonably necessary to use the Portal Services. You are responsible for reviewing third-party SBOMs and other documents before submission. The Portal may retain fields contained in a submitted document even if those fields are not used for matching or analysis.

Accepting these Terms does not authorize every project to upload data. You control which commands and CI workflows submit to Your Workspace. When You authorize a recurring workflow, each later run can submit data under that authorization without another interactive prompt. Use Your own Workspace endpoint and Token for private projects.

Findings depend on the inventory, supported ecosystems, advisory data, and time of evaluation. An absent finding does not prove that a component is safe or that every component was evaluated. Services do not guarantee detection of all vulnerabilities, malware, or exploitable conditions, or compliance with any particular law or standard.

Workspace Administration and Integrations

Your administrators control Authorized Users, roles, Access Credentials, identity providers, integrations, and notification destinations. You are responsible for ensuring that each Authorized User and automated process has appropriate authority and access scope and for providing any notices required to people whose Personal Data You submit.

If You configure image scans, You authorize the selected registry access, image retrieval, and inventory generation needed for those scans. Registry credentials and other secrets must use the designated credential controls. Do not place credentials in repository URLs, SBOM fields, triage notes, or support messages.

If You configure email or webhook notifications, You authorize delivery of the selected findings and metadata to those destinations. Confirm that each destination may receive the data. The destination provider’s terms and privacy practices apply to its own processing. Third-party identity providers, package registries, and CI systems remain subject to their own terms.

The Portal may contain links to third-party websites or services for convenience. TuxCare does not control and is not responsible for their content, availability, security, or privacy practices. A link does not imply Tuxcare’s endorsement of the third party or its products or services.

Free Access and Paid Services

Free Access does not require a credit card and does not automatically convert into a paid Subscription. TuxCare may apply Usage Limits and may change Free Access features prospectively upon reasonable notice, unless an urgent security or legal reason prevents notice. Accessing or using the Portal does not, by itself, create a paid Subscription or authorize any charge. Paid Portal Services, if offered, are provided under an applicable Order. The applicable fees are stated in and payable in accordance with the Order and Tuxcare’s applicable billing terms.

Suspension, Termination, Deletion and Data Export

TuxCare may suspend or restrict access where reasonably necessary to address a material breach of these Terms, non-payment under an applicable Order, unauthorized access, unlawful use, a material security risk, or a legal requirement. If a breach can reasonably be cured and immediate action is not required to prevent harm or comply with law, TuxCare will provide notice and a reasonable opportunity to cure. TuxCare may end Free Access upon reasonable notice, subject to urgent security or legal requirements. Termination of a paid Subscription is governed by the applicable Order and the SecureChain Portal License Agreement.

An authorized Workspace owner may request deletion through the process TuxCare makes available. TuxCare will delete the Workspace from the active Portal environment thirty (30) days after receiving a valid deletion request. Deletion may deactivate sign-in and applicable Access Credentials but does not necessarily remove all Customer Data immediately. Customer Data retained in backups or archives will be deleted in accordance with Tuxcare’s applicable retention and backup-deletion practices, unless continued retention is required or permitted by applicable law. TuxCare may prune older scans and related records in accordance with the retention periods or Usage Limits disclosed in the Portal, Documentation, SecureChain Portal Privacy Policy, applicable Order, or other applicable service notice.

TuxCare may retire a dormant Free Access Workspace. TuxCare may provide an inactivity notice at or after twelve (12) months of inactivity, suspend the Workspace at or after thirteen (13) months of inactivity, and delete the Workspace at or after fifteen (15) months of inactivity. Before deletion, TuxCare will provide a reasonable opportunity to obtain an available archive export through the process designated by TuxCare.

Revoking Access Credentials or stopping submissions does not delete reports or inventories already stored in the Portal. Retention, deletion, archives, backups, and any available export or retrieval period are described in the SecureChain Portal Privacy Policy, the DPA where applicable, and any applicable Order. TuxCare may retain security, transaction, and legal acceptance records as permitted or required by applicable law and its disclosed retention practices. Workspace deletion does not cancel a separate paid Subscription.

Programs and License Agreement

The Programs are governed by the SecureChain Portal License Agreement. Do not download, install, or use the Programs unless You have accepted that SecureChain Portal License Agreement. These Terms govern the hosted Portal Services and Customer Data submitted to or processed through them.

Any limited warranties and remedies applicable to the Programs are stated in the SecureChain Portal License Agreement or an applicable Order. Except as expressly stated there, the Programs are subject to the disclaimers and limitations contained in that SecureChain Portal License Agreement.

Restrictions on Use

You shall comply with applicable laws and shall not use the Programs or Portal Services in a manner that infringes another person’s rights, causes material harm, or violates these Terms, the SecureChain Portal License Agreement, or an applicable Order. TuxCare reserves the right to seek damages from You to the fullest extent permitted by law.

You shall not, and shall not permit any other person to: (a) access or use the Portal Services for an unlawful, fraudulent, or abusive purpose; (b) interfere with or disrupt the Portal or Portal Services; (c) probe, scan, or test their security except under TuxCare’s authorized security-testing process; (d) bypass or circumvent access controls, security controls, or Usage Limits; (e) introduce malicious code; (f) access, submit, or analyze data without the necessary rights and permissions; (g) scrape, extract, reproduce, or use TuxCare catalogue information or underlying databases except through documented functionality and as permitted by these Terms; (h) resell, sublicense, or make the Portal Services available as a standalone service to third parties, except as expressly authorized in an applicable Order; provided that You may use the Programs and Portal Services in connection with services You provide to Your customers as permitted under the SecureChain Portal License Agreement; or (i) disclose Access Credentials to an unauthorized person.

TuxCare may use automated and manual measures reasonably necessary to operate, secure, support, and protect the Portal and Portal Services and to enforce these Terms. TuxCare is not obligated to review Customer Data for legality, accuracy, or completeness. TuxCare may restrict access to or remove Customer Data that it reasonably believes violates applicable law, creates a material security risk, or materially breaches these Terms, subject to the DPA where applicable.

Account Security

You must provide accurate account information and keep it current. Protect Your identity provider account, session, and Tokens. Do not sell or transfer access, or allow an unauthorized person to use Your credentials. Authorized CI and service accounts may use scoped Tokens under Your control. You are responsible for activity under Your account. Notify TuxCare immediately of unauthorized access or another security breach. TuxCare is not liable for loss caused by another person using Your credentials, subject to applicable law and any separate written agreement.

Billing, Payments and Refunds

Paid Portal Services, if offered, are provided under an applicable Order and are subject to TuxCare’s standard billing, payment, cancellation, refund, and chargeback processes. The applicable Order and any separate written agreement control in the event of a conflict with the policies listed below. These policies do not apply to Free Access or cause Free Access to convert into a paid Subscription:

You shall, in addition to the fees, pay all applicable sales, use, transfer, or other taxes and all duties, whether national, state, or local, however designated, that are levied or imposed in connection with Your purchase under that Order. You shall reimburse TuxCare for the amount of any such taxes or duties paid or incurred directly by TuxCare as a result of this transaction, and You agree that TuxCare may charge any such reimbursable taxes to the payment instrument You used for Your initial payment.

Ownership and Data Rights

TuxCare and its licensors retain all rights in the Portal and Portal Services, excluding Customer Data and third-party materials. Subject to these Terms and any applicable Order, You may access and use the Portal and Portal Services within the applicable Usage Limits. Your rights to install and use the Programs are governed by the SecureChain Portal License Agreement.

You retain ownership of Customer Data and the rights of its owners. You grant TuxCare a nonexclusive right to receive, store, copy, analyze, and transmit Customer Data to provide and secure the Portal Services. This right includes advisory matching, scan comparisons, support, backups, and notifications You configure. It lasts only for the service and lawful retention periods. It permits disclosure to Your authorized users and service providers under appropriate confidentiality and data protection duties.

TuxCare treats nonpublic Customer Data as confidential. TuxCare does not acquire a right to publish it, sell it, or use it in advertising. TuxCare does not use nonpublic Customer Data to train a general-purpose AI model unless You separately authorize that use. TuxCare may disclose data where applicable law requires it, subject to the Data Processing Addendum where it applies.

You represent that You have the rights and authority needed to submit Customer Data and to grant this limited right. You agree to defend, indemnify, and hold TuxCare and its affiliates harmless from third-party claims arising from Your unlawful submission of Customer Data. This includes reasonable expenses and attorneys’ fees, subject to any separate written agreement. This duty does not cover a claim caused by TuxCare processing data outside Your authorized instructions.

Trademarks

Please refer to Logo and Trademark Usage Guidelines for details on TuxCare’s intellectual property rights. The trademarks, logos, and service marks (“Marks”) displayed on the SecureChain Portal, on tuxcare.com or Documentation are the property of TuxCare, Inc., or other third parties. The trademarks of other third parties are the property of their respective owners and are only mentioned on the SecureChain Portal or tuxcare.com for informative purposes. You are not permitted to use these Marks without the prior written consent of TuxCare or the third party that owns the Marks.

Export Control

You represent and warrant that You are not located in, under the control of, or a national or resident of any country to which the United States has embargoed goods. You agree that You will not export or re-export any goods or products unless You have complied with all applicable U.S. and foreign government export controls and approvals. If You access the Portal from outside the United States, You do so at Your own risk and are responsible for compliance with the laws of Your jurisdiction.

You acknowledge that TuxCare is subject to economic sanctions laws, including but not limited to those enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), the European Union, and the United Kingdom (“Economic Sanctions Laws”). Accordingly, You shall comply with all Economic Sanctions Laws, including, but not limited to, those of the United States, the European Union, and the United Kingdom. You shall not provide access to the Programs or Portal Services to any individuals identified on OFAC’s list of Specially Designated Nationals (“SDN List”), the UK’s HM Treasury’s Consolidated List of Sanctions Targets, or the EU’s Consolidated List of Persons, Groups, and Entities Subject to EU Financial Sanctions (collectively “Sanctioned Parties”). You shall not take any action that would place TuxCare in a position of non-compliance with any such Economic Sanctions Laws. Furthermore, You represent and warrant that (i) You have not in the past been, and will not be in the future, connected with any Sanctioned Parties, (ii) You shall provide such information regarding any individual or entity with which You do business in any location covered by Economic Sanctions Laws upon request of TuxCare, and (iii) shall promptly advise TuxCare of any activities which increase the risk of Your non-compliance with this Section or TuxCare’s non-compliance with Economic Sanctions Laws.

You agree to indemnify and hold TuxCare harmless from any loss, damages, liability, or expenses incurred by TuxCare as a result of Your failure to comply with any export regulations or restrictions or otherwise failing to comply with this Section.

Disclaimer; Limitation of Liability

EXCEPT FOR ANY EXPRESS WARRANTY OR SERVICE-LEVEL COMMITMENT IN AN APPLICABLE ORDER OR THE SECURECHAIN PORTAL LICENSE AGREEMENT, THE PORTAL, PORTAL SERVICES, AND SECURECHAIN OUTPUT, INCLUDING THOSE MADE AVAILABLE THROUGH FREE ACCESS, ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, TUXCARE DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. TUXCARE DOES NOT WARRANT THAT THE PORTAL SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT SECURECHAIN OUTPUT WILL BE COMPLETE, ACCURATE, OR CURRENT.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, TUXCARE SHALL NOT BE LIABLE TO YOU FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, LOST REVENUE, LOSS OF BUSINESS OPPORTUNITY OR GOODWILL, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR LOSS OR CORRUPTION OF DATA, EVEN IF TUXCARE HAS BEEN ADVISED OF THE POSSIBILITY OF THOSE DAMAGES. WHERE AN APPLICABLE ORDER PROVIDES SERVICE CREDITS, THOSE CREDITS ARE YOUR SOLE REMEDY FOR FAILURE TO MEET THE APPLICABLE SERVICE LEVEL, UNLESS THE ORDER EXPRESSLY PROVIDES OTHERWISE.

EXCEPT TO THE EXTENT LIABILITY CANNOT BE LIMITED UNDER APPLICABLE LAW OR AN APPLICABLE ORDER EXPRESSLY PROVIDES OTHERWISE, TUXCARE’S AGGREGATE MONETARY LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE PORTAL, PORTAL SERVICES, SECURECHAIN OUTPUT, OR THESE TERMS SHALL NOT EXCEED: (A) FOR CLAIMS RELATING TO A PAID SUBSCRIPTION, THE FEES PAID OR PAYABLE TO TUXCARE UNDER THE AFFECTED ORDER DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE INITIAL EVENT GIVING RISE TO THE CLAIM; OR (B) FOR CLAIMS RELATING SOLELY TO FREE ACCESS, US$100. THESE LIMITATIONS APPLY IN THE AGGREGATE, REGARDLESS OF THE FORM OR THEORY OF LIABILITY, AND NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF A LIMITED REMEDY.

Privacy

The SecureChain Portal Privacy Policy describes account data, dependency submissions, recipients, retention, and privacy rights. Where TuxCare processes Personal Data on Your behalf, the DPA governs that processing. Acknowledgment of the SecureChain Portal Privacy Policy does not constitute consent to marketing or to all data processing. International transfers require the safeguards stated in those documents and applicable law.

Miscellaneous

These Terms are governed by and construed in accordance with the laws of the State of Delaware and applicable federal laws of the United States, without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Any action, suit, or proceeding arising out of or relating to these Terms or an applicable Order shall be brought exclusively in the state or federal courts located in the State of Delaware. Each party irrevocably submits to the personal jurisdiction and venue of those courts and waives any objection based on improper venue, inconvenient forum, or similar grounds.

The headings of sections of these Terms of Use are for convenience of reference only and shall not affect the meaning or interpretation of these Terms of Use.

TuxCare may provide general notices and other communications to You by email, by posting them on the SecureChain Portal or tuxcare.com, or by other electronic transmission.

These Terms, the SecureChain Portal License Agreement, the DPA where applicable, an applicable Order, and any separate written agreement signed by TuxCare and You that expressly governs the Programs or Portal Services constitute the entire agreement concerning their subject matter and supersede prior or contemporaneous proposals, representations, and communications concerning that subject matter. In the event of a conflict: (a) a separate written agreement signed by TuxCare and You controls within its express scope; (b) the DPA controls solely with respect to TuxCare’s processing of Personal Data on Your behalf; (c) an applicable Order controls as to the matters it expressly addresses; (d) the SecureChain Portal License Agreement controls with respect to the Programs; and (e) these Terms control with respect to the Portal and Portal Services. Documentation does not modify these Terms or an Order unless expressly stated.

In the event that any portion of these Terms of Use is held unenforceable, the unenforceable portion shall be construed in accordance with applicable law as nearly as possible to reflect the original intent of the parties, and the remainder of the provisions shall remain in full force and effect.