If CheckOps shuts down, you lose nothing
Updated on 27 October 2026
Your CRA compliance should not depend on a vendor’s survival. Here is what ClearCloud commits to, in writing, if the service ever closes.
- At any timefull export of your data, in open formats
- 90 daysnotice before any shutdown, service kept running
- Open sourceCheckOps code released if the service stops for good
- Refundedanything paid in advance and not used
Your data, exportable at any time
From Account → Export all data, any member downloads a ZIP archive that can be read without CheckOps:
- all of the organisation’s data in JSON, one table per file (products, versions, components, vulnerabilities, VEX decisions and their history, CRA reports, alerts, clusters, NIS2 self-assessments, settings);
- a CycloneDX 1.6 SBOM for each version received;
- VEX decisions in OpenVEX 0.2.0 format, per product;
- a README describing each file.
Export is included in every plan, including the free one, with no limit or fee. Secrets (API tokens, integration passwords) are not included.
90 days’ notice before any shutdown
If ClearCloud decided to stop CheckOps, every organisation would be told by e-mail at least 90 days in advance. During that period:
- the service keeps running normally: monitoring, alerts, CRA reports;
- export remains available until the last day;
- amounts paid in advance for a period after the shutdown are refunded pro rata.
If another vendor takes over CheckOps, these commitments pass to it, and you are told before any transfer of your data.
The code released if the service stops
If the service stops for good, ClearCloud releases the CheckOps source code (server, portal, Kubernetes agent and CLI) under the AGPL-3.0 free licence, no later than the closing day, with installation documentation.
You can then run CheckOps yourself, or hand it to a provider, and import your export into it. The vulnerability databases used (OSV, CISA KEV catalogue, ENISA EUVD, EPSS) are public and remain available without CheckOps.
Hosted in France, no US dependency
The platform, database and backups are hosted in France by OVHcloud, and e-mails are sent by Scaleway (France): no data is subject to the CLOUD Act. Export formats are open standards (CycloneDX, OpenVEX, JSON), readable by other tools such as Dependency-Track.
After the shutdown
Once the service is closed, all organisations’ data is deleted, backups included, within 30 days. You can also delete your account yourself at any time from Account: deletion is immediate (see article 9 of the terms of service).
Frequently asked questions
Is export paid or limited?
No. It is included in every plan, the free one included, and can be run as often as you like.
Can I reuse the export in another tool?
Yes. SBOMs are in CycloneDX 1.6 format and decisions in OpenVEX: Dependency-Track or any compatible tool reads them directly. The rest of the data is documented JSON.
What happens to my CRA compliance if CheckOps closes?
Your SBOMs, VEX decisions and report files stay in your export: these are the documents to keep in your technical documentation. With the code released, you can also keep running CheckOps yourself.
Are these commitments part of the contract?
Yes: this page is a public commitment by ClearCloud that supplements the terms of service. Any change would be announced by e-mail at least 30 days in advance.