Security

Database, file storage and compute all run in Frankfurt. Stated precisely: the infrastructure is in the EU and our providers are US companies, so this is EU hosting rather than EU legal control. If your procurement needs the latter, say so and we will tell you honestly whether we can meet it.

No passwords. A sign-in link by email, Google, or your own identity provider over OpenID Connect — Entra ID, Okta, Google Workspace, Ping and JumpCloud all speak it. Connecting one means proving you own the email domain by publishing a DNS record, and a connection can only sign in addresses on the domain it proved, so a provider configured to authenticate anybody still cannot get a stranger into your workspace. Public mail domains cannot be claimed at all. SAML is not supported, which we would rather say than ship a setting that does nothing.

Four roles, checked in one place rather than remembered at each screen. The one worth knowing about is the auditor: read-only, can generate and download evidence packs, and can change nothing. A reviewer who can prove what happened without being able to alter it is the whole point of the role.

Available to every account and enforceable across a workspace. It is checked per session rather than per user, and re-checked on every request into the application. The first version of this asked whether the account had ever verified anywhere, which meant enrolling once let every later session walk straight in, including one created from an intercepted sign-in link. That makes a second factor decorative, which is worse than not having one, because the settings page tells you that you are protected.

Sessions live in the database rather than in a token, chosen so that removing somebody actually revokes their access rather than waiting for a token to expire. Removal deletes the membership and, if that was their last workspace, their sessions, in the same transaction.

Every tenant table carries a workspace identifier, and it is enforced in a single database client rather than remembered at each call site. A query that names another workspace is refused outright rather than quietly rewritten. Automated tests attempt cross-tenant reads and writes on every build.

Every action is recorded and hash-chained to the one before it, so an altered or removed entry is detectable. The chain is per workspace, so one customer’s activity cannot be used to infer another’s, and each entry is written in the same transaction as the change it describes — an audit log that can disagree with the data it records is worse than none, because it is trusted.

The database refuses updates and deletes on that table with a trigger rather than a permission, because the application connects as the table owner and an owner bypasses permissions. Closing a workspace cannot cascade the chain away either. Stated precisely: this makes tampering detectable, not impossible. Anyone who could rewrite the whole table could recompute the chain, which is why the evidence pack carries a verification code anyone can check without seeing the contents.

Case data and audit events are retained for seven years, because they are the evidence a market-surveillance authority may ask for. Everything else is purged within 30 days of a workspace closing. Anonymous SBOMs submitted to the free check are never stored at all.

There is no SOC 2 report, no ISO 27001 certificate, no third-party penetration test and no bug bounty. If your procurement requires any of those, we do not meet it today and would rather you find that out here than three weeks into an evaluation.

Two specifics, because a general disclaimer hides more than it admits. Everything is encrypted at rest by the database provider. Two things get a second layer on top of that and one does not: single sign-on client secrets are encrypted by the application, API keys are stored as hashes and cannot be read back at all even by us, and the two-factor seed has neither. Hashing and encryption are different properties and are named separately here rather than averaged into one word. And the deadlines and scope verdicts this product computes are read from the article text and have not been through a lawyer.

Declara is itself a product with digital elements, so the obligation we help you meet would apply to us on the same date it applies to you. Our own disclosure address and SBOM are not published yet. We would rather say that than claim a policy we have not stood up, on the one page where claiming things you have not done is the whole failure mode.