How we protect your data
An SBOM shows what your product is made of, and reports describe its weak points. That is why the portal is built like a security tool, not like an ordinary web application.
MFA on every account
An app code or passkey for clients, a hardware key or passkey for the consultant. A session expires after 30 minutes of inactivity and after 12 hours at the latest.
Company isolation
Every row in the database belongs to one company, and the database itself refuses access to other companies' data (Row-Level Security). The address of another company's report returns “not found”.
Encryption
TLS 1.3 connections, data encrypted at rest, and SBOMs and reports additionally with a key assigned to your company. Backups are encrypted and kept in a second EU region.
Hosting in the European Union
Servers, backups and the e-mail and SMS providers operate in the EU. We do not transfer data outside the EEA.
Event log
Every sign-in, upload, assessment and publication is written to a tamper-evident log. You see the order log in the portal.
Safe file processing
SBOMs are parsed in an isolated process with a size limit. E-mails carry no vulnerability details, only a link to the portal.
Testing before launch
Before the first client is admitted the portal undergoes a penetration test, and every major change a security review.