Data security & confidentiality

As your authorised representative under the Cyber Resilience Act, we hold your EU Declaration of Conformity and technical documentation — which may contain trade secrets — for the statutory retention period. Protecting that documentation is central to our service. This page explains, in plain terms, how we do it.

Where your data is stored

Our application and database run on infrastructure hosted in the EU (Germany), within the EU/EEA. Your uploaded documents are kept in dedicated object storage that encrypts every object at rest. Your data does not need to leave the EU to be managed.

Encryption

• In transit. Every connection to the portal is protected with TLS/HTTPS, so data cannot be read while travelling between your browser and our servers.
• At rest — database. The confidential free-text in your records — the mandate scope, market-surveillance authority requests and our responses, incident and vulnerability records, risk assessments and document descriptions — is encrypted with AES-256-GCM. The encryption key is held separately from the database and controlled by us. A copy of the database on its own therefore cannot reveal your data.
• At rest — documents. Uploaded files are stored with AES-256 encryption at rest.
• Passwords. We never store passwords in readable form — only a salted, one-way PBKDF2-SHA256 hash, which cannot be reversed back to the original password.

Access and accountability

Access to the portal requires authentication, and it is role-based: each client organisation sees only its own data. Every reasoned request from a market-surveillance authority is logged with a complete audit trail — when it arrived, what was provided, and when we responded. Statutory documents are held under a tamper-evident 10-year retention lock, so they cannot be silently altered or deleted within the period the CRA requires.

Governance and confidentiality

We are GDPR-compliant and provide a Data Processing Agreement (DPA) on request. Every mandate includes a confidentiality clause, and we are glad to sign a separate non-disclosure agreement (NDA). Our information-security practices follow the principles of ISO/IEC 27001 (information-security management). We are an early-stage provider and are not yet certified; certification is on our roadmap.

Your control

You decide what is uploaded. You can request an export of your data at any time, or its deletion — subject only to the statutory retention obligations that the CRA places on the representative role.

Questions about how we handle your data? Get in touch — we are happy to walk you or your advisers through the details.