Rösti Data License

Summary

This summary is for convenience; sections 1 to 6 and the CC BY 4.0 legal code are the binding terms.

• Free for everyone, including companies. All Rösti Data is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) . That includes everything published before today.
• Credit Rösti when you share or publish the data. Using it internally, for example in your own firewall or SIEM, needs no credit.
• The license is permanent; the service is not. Rösti is run by one person and takes a lot of effort. It may shut down, become paid, or be limited to a few partners. We will give 90 days' notice. Data you have already received stays under CC BY 4.0 forever.
• Sponsoring is welcome, not required. If your organisation relies on Rösti, please consider sponsoring it.
• No guarantees. Threat intelligence can contain errors and false positives. You decide what to block.

1. Data license

1. "Rösti Data" means the data that Rösti compiles, processes or creates and makes available through rosti.dev, api.rosti.dev, misp.rosti.dev and any other Rösti channel (API, feeds, bulk exports, MISP feed, connectors and integrations). It includes extracted indicators of compromise (IOCs), report metadata, classifications, tags, risk scores, enrichments, MITRE ATT&CK and CVE mappings, and the selection and arrangement of all of these.
2. Rösti Data is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0) . The full legal code is at creativecommons.org/licenses/by/4.0/legalcode . Under it you may copy, share, adapt and build on Rösti Data for any purpose, including commercially, as long as you give credit (section 2).
3. This license applies from today to all Rösti Data, including all data published before this date.
4. CC BY 4.0 also covers database rights in the Rösti collection, where such rights exist.
5. If anything in this page conflicts with the CC BY 4.0 legal code, the legal code prevails for Rösti Data.

2. How to credit Rösti

Credit is required when you share Rösti Data or material based on it: publishing, redistributing, reselling, or including it in a product, feed, report or dataset that others receive. Using Rösti Data only inside your own organisation needs no credit.

Use this credit line, adapted to the medium:

Data: Rösti (https://rosti.dev), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

• If you changed the data (filtered, merged, re-scored, converted), add "modified".
• Where a full line is not practical, credit in any reasonable way for the medium. For example: a comment line in a feed file, a field in a JSON or STIX object, a sources page in a report, or a credits page in a product.
• Keep any credit and license notice that comes with Rösti Data when you pass it on.

3. What the license does not cover

1. Third-party reports. Rösti Data is extracted from public reports published by third parties. The reports themselves (their text, images and files) and the YARA rules taken from them remain the property of their authors and are not licensed by Rösti. Each report in Rösti links to its original source; use of the original is governed by its publisher's terms. Publishers who want their content handled differently can contact rosti@bin.re .
2. Third-party reference lists. Rösti uses external datasets (for example domain rankings and cloud or VPN IP ranges) to calculate risk scores. The risk scores are Rösti Data; the external datasets are not, and Rösti does not redistribute them.
3. The Rösti name and logo. CC BY 4.0 does not license trademarks. You may use the name "Rösti" to credit the source, but not in a way that suggests Rösti endorses you or your product.
4. The software. The Rösti website, API and parsers are not covered by this license.

4. Service terms and the future of Rösti

The data license (section 1) covers what you may do with Rösti Data. Access to the service that delivers it (website, API, feeds, exports, MISP feed and integrations) is governed by this section and the Terms of Service .

1. Rösti is maintained by one person. Collecting, parsing, reviewing and enriching reports takes considerable effort. There is no guarantee that the service will continue in its current form.
2. What may change. Rösti may at any time:
   1. shut down the service, or parts of it;
   2. charge for access to the service or to newly published data;
   3. provide newly published data only to a limited number of partners, or keep it private;
   4. change or remove features, formats, feeds and API endpoints.
3. Notice. We will announce a shutdown, a paywall or a partners-only change (items 1 to 3 above) at least 90 days in advance on rosti.dev/updates and by email to registered users. We may act sooner only where we are forced to, for example by law, a security incident or the loss of hosting, and will then inform you as soon as possible.
4. What stays. Any Rösti Data you received under this license remains licensed to you under CC BY 4.0, permanently. A change under 4.2 only affects access to the service and data published after the change takes effect.
5. Fair use. Use an API key issued to you, do not share it outside your organisation, and do not put excessive load on the service. We may limit or suspend keys that harm the service. This never restricts what you may do with Rösti Data you have already received.

5. Supporting Rösti

If your organisation relies on Rösti, please consider supporting it. Support helps keep the service running and the data free. Supporters can get a mention on the supporters page, and for higher amounts their logo on the front page.

Organisations that resell Rösti Data or use it in their commercial products are especially encouraged to consider it. To support Rösti, visit the sponsors page or contact rosti@bin.re .

Supporting Rösti is voluntary . It is not a condition of this license, and not supporting never limits your rights under CC BY 4.0.

6. No warranty

1. Rösti Data is collected automatically from third-party reports and may be incomplete, outdated or wrong. Risk scores are estimates. The disclaimer of warranties and limitation of liability in Section 5 of CC BY 4.0 apply to Rösti Data.
2. The service is provided "as is" and "as available" , free of charge, without any warranty of accuracy, completeness, availability or fitness for a particular purpose.
3. You are responsible for how you use Rösti Data, including any blocking, alerting or other action based on it, and for testing it before use in production.
4. To the extent permitted by law, Rösti is not liable for any damage arising from the use of Rösti Data or the service, including damage caused by false positives or false negatives. Nothing here limits liability for intent or gross negligence.