Terms of use

This website is operated by Cryvanta AB, organisation number 559593-0537, of Hammarbybacken 27, 120 30 Stockholm. The full details are on the company details page. Using the site means these terms apply between you and us.

Everything here describes what we do. None of it is a binding offer, a quotation, or a commitment to take on work — an engagement starts when we have both signed something, and not before.

Our knowledge base is general information written to be useful, not advice about your situation. Your systems, your suppliers and your regulatory position are things we would need to look at before saying anything about them, and nothing on this site has looked at them. Do not act on it as though it had. In particular, whether NIS2, DORA or any other regime applies to your organisation is a legal question about your entity, and we say so on the pages that discuss it.

We keep the site accurate and we correct it when it is wrong, but we do not promise it is complete or current at any given moment, and the security landscape it describes changes faster than any page does.

The text, design, code, diagrams and film on this site are ours. You are welcome to read them, link to them, and quote them with attribution. You may not republish them as your own or use them to train a model that reproduces them.

Third-party names and logos on this site belong to their owners. A customer mark may be displayed only after the underlying engagement and the owner's permission have been confirmed; its purpose is to identify that organisation, not to claim a broader endorsement. If you own one of them and dispute its use, write to us.

We are responsible for what we say here being written in good faith, and for correcting it when it is not right. We are not responsible for decisions taken purely on the strength of a marketing page — which is why the section above tells you not to take any.

Where the law lets us limit liability, our liability for the website itself is limited to direct loss. We choose not to limit liability for death or personal injury, for intentional or grossly negligent conduct, or anything else Swedish law does not permit to be excluded. A court may adjust or disregard an unreasonable term after considering all the circumstances (avtalslagen (1915:218) 36 §).

Work we actually do for you is a different matter entirely, and it is governed by the engagement agreement, not by this page. That agreement is where liability, scope and remedies for the work itself live.

We work in offensive security, so we will say this plainly rather than hide it in a clause. Intentionally obtaining unauthorised access to data intended for automated processing may constitute dataintrång (brottsbalken 1 kap. 2 §, 4 kap. 9 c §). A benevolent motive does not itself authorise the access.

What that means here is simple: do not test our systems without asking. If you want to look, our responsible disclosure policy sets out what is in scope, what is not, and the good-faith safe harbour we offer to anyone who stays inside it. Research that follows that policy is welcome and we will not pursue you for it.

The same principle runs the other way and it is the foundation of our own work. We test a customer's systems only under a written scope they have agreed — targets, rules of engagement, exclusions, timing and stop rules. That authorisation is not paperwork around the engagement; it is the thing that makes the engagement lawful, which is why nothing is ever touched outside it.

Swedish law governs these terms and any dispute arising from this website, and the Swedish courts have jurisdiction, with Stockholms tingsrätt as the court of first instance. Where we have an engagement agreement with you, that agreement decides this instead.

We may update these terms. The date at the top of the page says when they last changed, and the version in force is the one published here at the time. Last updated 6 August 2026.