How CVD Portal handles your data
Written for the procurement, legal, and security reviewers who diligence us. No marketing language; only what we can evidence. Updated 6 July 2026.
Hetzner, EU region.
Application, database, and backups run on Hetzner infrastructure in the EU. We do not transfer submission data outside the EU/EEA. Operational timestamps are Europe/Amsterdam.
Processor.
Tenants are the data controller for submissions their portal receives. We act as a processor under GDPR Art. 28 terms described in our Privacy Policy.
Policy at /security, machine-readable at /.well-known/security.txt.
Subprocessors
These are the third parties that process tenant data on our behalf. We will give tenants 30 days' notice before adding a new subprocessor with material access to submission data.
Subscription billing and checkout
- Data processed
- Company billing contact, invoice history, card fingerprints (card data itself never touches our servers)
- Region
- Ireland (EU); payment data processed under Stripe's EEA data residency posture
Transactional email delivery (acknowledgments, notifications, auth)
- Data processed
- Recipient email, subject line, message body, delivery metadata
- Region
- Delivery infrastructure with EU sending region available; see Resend DPA
Hosting infrastructure (compute, database, object storage, backups)
- Data processed
- All platform data at rest, including tenant and submission data
- Region
- Nuremberg, Germany (compute and database); Falkenstein, Germany (object storage)
DNS, CDN, TLS termination, and DDoS protection in front of all traffic
- Data processed
- Request metadata and content in transit (proxied, not stored)
- Region
- Global edge network; EU Data Localization options; SCCs under Cloudflare DPA
Product analytics on the marketing site and dashboard
- Data processed
- Pseudonymous usage events, page views, device metadata. No submission content.
- Region
- EU instance (eu.i.posthog.com), data stored in the EU
AI inference for optional features (triage assistance, scanner analysis)
- Data processed
- Submission text passed for analysis only when a tenant uses an AI feature
- Region
- United States; SCCs. AI features are optional and plan-gated.
Internal operational alerts to on-call staff
- Data processed
- System health events and truncated error strings. No submission content, no tenant personal data by design.
- Region
- Global; used for operational telemetry only
Self-hosted components
Application runtime
Next.js server, self-hosted on EU-based VPS. Admin access over Tailscale only; no public SSH.
PostgreSQL database
Self-managed on Hetzner infrastructure in Nuremberg, Germany. Stored integration credentials are encrypted at the application layer (AES-256-GCM). Disk-level volume encryption is on the roadmap below.
Edge & reverse proxy
Caddy with automatic TLS (Let's Encrypt). HSTS preload, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict Referrer-Policy.
Geolocation
geoip-lite library; country-level IP lookup happens in-process. No external request, no third-party analytics.
Security controls
Encryption
- ·TLS 1.2+ enforced on every public endpoint. HSTS with preload.
- ·Application-level AES-256-GCM encryption for stored integration credentials (webhook signing secrets).
- ·Passwords hashed with bcrypt; API keys stored as SHA-256 hashes, never in recoverable form.
- ·Researcher submissions support PGP end-to-end encryption when tenant publishes a key.
- ·Backup archives are encrypted before leaving the host, with the decryption key held offline.
Access control
- ·Role-based access (ADMIN, MEMBER) on every tenant workspace.
- ·Tenant data strictly isolated by companyId; cross-tenant access is a hard constraint at the ORM layer.
- ·NextAuth session management with CSRF protection; password hashing via bcrypt.
- ·Enterprise plan: SSO/SAML and EUDI Wallet identity verification (eIDAS 2.0).
Auditability
- ·Every state-changing action writes an append-only audit log with actor, timestamp (ms precision), IP, and country.
- ·Each entry is linked into a per-tenant SHA-256 hash chain. A daily job re-verifies every chain and alerts on any break.
- ·Database triggers reject UPDATE and DELETE on audit rows. Only a controlled retention job may purge operational entries.
- ·CRA Article 14 evidence entries (classification, notification, and remediation decisions) are kept permanently, and survive account deletion in pseudonymised form.
- ·Audit logs surface in the tenant dashboard and are exportable for CRA defense.
Operational security
- ·Secrets never committed to the repository; environment-based configuration.
- ·Dependency scanning in CI; Dependabot-equivalent automated update flow.
- ·No production shell access outside Tailscale; deploy user scoped to application directory.
Data ownership and exit
- ·You own every report your portal receives. We process it on your behalf, we do not sell it, and we do not use it to train models.
- ·Full export of all the data you provide, in HTML, CSV, and JSON, is available on every plan, including Free, for as long as your account exists.
- ·We delete your data on request. Closing your account removes your data within 30 days, except where a legal retention obligation applies. If a trial or subscription ends and the account stays inactive, we may delete it after a 90-day grace period and at least 30 days' prior notice.
- ·Operational audit entries are retained for 12 months. CRA Article 14 evidence entries are retained permanently and, on account deletion, are archived in pseudonymised form so your compliance record survives the erasure of personal data.
Data Processing Agreement
Our standard Data Processing Agreement (GDPR Art. 28) is published at /dpa, including processing details and the subprocessor list above as its annexes. For a countersigned copy or bespoke terms, email [email protected].
Security testing
CVD Portal is penetration tested by an independent firm every quarter. The most recent test was completed in May 2026. Enterprise clients receive the full report under NDA. A summary of scope and outcome is available on request via [email protected].
Report a vulnerability in CVD Portal itself
We run our own coordinated disclosure process. Report a security issue in CVD Portal through our disclosure policy, or read the machine-readable security.txt.
Incident response
- 01We learn of an incident via internal monitoring, tenant report, or researcher report to [email protected].
- 02A responder acknowledges within the SLA on our Security page, scopes impact, and opens an incident record.
- 03Affected tenants are notified without undue delay (and within 72 hours for personal-data breaches, per GDPR Art. 33).
- 04A post-incident write-up is published to affected tenants. Material incidents are disclosed on /status with a resolution note.
Backups & business continuity
Database backups are taken on a defined schedule and stored encrypted off the primary host. We exercise restore drills periodically. Enterprise customers can request our current RPO/RTO targets, the most recent restore test date, and our business-continuity summary under NDA via [email protected]. We are deliberately not publishing specific numbers here that we cannot continuously evidence.
On the roadmap
Items we have committed to and are tracking publicly:
- →Disk-level (LUKS) volume encryption for the database and backup storage.
- →SOC 2 Type 1 readiness engagement.