Terms of Service

Last updated 3 November 2026

1. Who we are

WatchMyStack (“we”, “us”) is a free online service. You can reach us at contact@watchmystack.com.

2. These terms

These terms apply when you use watchmystack.com, create an account, or receive our emails. By creating an account, or by using the service, you agree to them. If you use WatchMyStack for an organisation, you confirm you may accept these terms on its behalf, and “you” includes that organisation.

You must be at least 18. Our privacy notice explains how we handle personal data and forms part of how we provide the service.

3. What WatchMyStack does

You tell us which products you run. We match them against public lists of vulnerabilities known to be exploited (currently CISA’s Known Exploited Vulnerabilities catalogue and ENISA’s EU Vulnerability Database, and others we may add), add information from the US National Vulnerability Database, show the results on your dashboard and, if you choose, email you. We also offer reports, an optional weekly email and related features.

WatchMyStack is an information service to help you prioritise. It does not scan, access, test or change your systems, and it doesn’t fix anything for you.

Because it’s free, it runs on a best-effort basis: there is no guaranteed availability, response time or level of support. We reply to messages when we can, usually within a few working days.

4. What it can’t promise

Please read this section carefully. It explains the limits of any alerting service, including ours.

• Sources can be incomplete or late. We rely on public lists run by others. Some exploited vulnerabilities are listed late, never listed, or listed with errors, and new attacks on unknown flaws can’t be on any list.
• Matching isn’t perfect. We match by product names and, where you give one, the version you run. A vulnerability may be missed, or shown for a product or version it doesn’t affect. Version filtering depends on data published by NIST, which may be wrong or change.
• Alerts can be delayed or fail. Email can be delayed, filtered as spam or not delivered, and our service or our providers can be unavailable.
• Rankings and deadlines are guidance. Priority scores, “due” dates and suggested actions help you decide; they aren’t instructions to follow without checking the vendor’s own advice.
• Reports are evidence, not certification. Our reports, including the NIS2 evidence report, record what was found and handled in WatchMyStack. They are not legal advice and don’t certify compliance with NIS2 or any other law.

You remain responsible for your own security: keeping an up-to-date inventory, following vendor advisories, patching and mitigating, and deciding what to do. WatchMyStack is one aid among the measures you should have in place, not a replacement for them.

5. Your account

• Give an email address you control and keep it up to date, so alerts reach you.
• Keep your password, authenticator app and recovery codes safe. Two-step verification is required for every account.
• You are responsible for what happens under your account. Tell us straight away at contact@watchmystack.com if you think someone else has used it.
• One person per account. Don’t share your sign-in.

6. Acceptable use

Don’t use WatchMyStack to break the law or harm others. In particular, you must not:

• attack, probe, scan or load-test the service, or try to get around its security, bot checks or rate limits;
• access other people’s accounts or data, or try to;
• copy or harvest the service or its data by automated means, except through features we provide for that;
• use the service, or information from it, to attack or gain unauthorised access to any system;
• resell, rebrand or offer the service to others as your own without our written agreement;
• reverse engineer the service, except where the law allows it despite this term.

Found a security problem in WatchMyStack? Thank you. Please tell us privately at contact@watchmystack.com (see our security.txt) and give us reasonable time to fix it before sharing it. We won’t take action against good-faith research that follows these terms and doesn’t harm users or data.

7. Your information

Your stack, settings and other information you add stay yours. You allow us to store and use them only to provide and improve the service, as the privacy notice describes. You can download, clear or delete your data at any time under Profile → Your data.

If you send us feedback or ideas, we may use them freely without paying you, and you keep any rights you have in them.

8. Third-party data and names

Vulnerability information comes from third parties such as CISA, ENISA, NIST and others, and links may take you to their sites. We don’t control them and aren’t responsible for their content. Product and company names are trademarks of their owners and are used only to identify products; we aren’t affiliated with or endorsed by those companies.

9. Our rights in WatchMyStack

The website, software, design, text and the way we combine and present information belong to us or our licensors. While you follow these terms, you may use WatchMyStack for your own and your organisation’s internal purposes, and share reports and links it produces. No other rights are given to you.

10. Price

WatchMyStack is currently free. If we introduce paid features, we will tell you at least 30 days in advance, and you will only pay for something you have expressly agreed to buy.

11. Changes, suspension and ending

• We keep improving WatchMyStack and may add, change or remove features. If a change significantly reduces what the service does for you, we’ll tell account holders by email in advance where we reasonably can.
• You can stop using WatchMyStack and delete your account at any time.
• We may suspend or close an account that breaks these terms, puts the service or other users at risk, or where the law requires it. Where it’s safe and lawful, we’ll tell you why and give you a chance to respond.
• We may stop offering WatchMyStack altogether with at least 30 days’ notice by email, so you can download your data.

12. Liability

What we never exclude. Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud, for harm we cause deliberately or through gross negligence, or for anything else the law doesn’t allow us to limit. If you are a consumer, nothing in these terms affects your statutory rights.

The service is provided “as is”. Because of the limits explained in section 4, and to the extent the law allows, we don’t promise that WatchMyStack will be uninterrupted, error-free, complete or that it will detect every vulnerability that affects you.

Losses we are not responsible for. To the extent the law allows, we are not liable for: loss of profit, revenue, business, contracts or goodwill; loss or corruption of data on your systems; indirect or consequential loss; or loss caused by a security incident, attack or vulnerability in your systems, including where an alert was missing, late or wrong.

Our total liability. To the extent the law allows, our total liability to you for all claims connected with WatchMyStack is limited to €100, reflecting that the service is free.

Business users. If you use WatchMyStack for a business, you will compensate us for reasonable losses and costs arising from your breach of section 6 (acceptable use).

13. Law and disputes

These terms are governed by the laws of Malta, and the courts of Malta have jurisdiction. If you are a consumer living elsewhere in the EU, you also keep the protection of the mandatory laws of your country and may bring a claim in your local courts. Before going to court, please contact us: most issues can be resolved quickly.

14. Changes to these terms

We may update these terms, for example when the service or the law changes. We’ll change the date at the top and, for changes that significantly affect you, email account holders at least 30 days before they take effect. If you don’t agree, you can delete your account before then. Continuing to use WatchMyStack after that means you accept the new terms.

15. General

• If any part of these terms is found invalid, the rest still applies.
• If we don’t enforce a term straight away, we can still enforce it later.
• We may transfer our rights and obligations to another organisation that takes over WatchMyStack; we’ll tell you, and your rights won’t be reduced. You may not transfer yours without our agreement.
• These terms, with the privacy notice, are the whole agreement between you and us about WatchMyStack. They are in English.

16. Contact

Questions about these terms: contact@watchmystack.com.