General Data Protection Regulation

1) Introduction

• This page explains how we handle personal data under GDPR.
• It applies to users in the EEA, UK, and Switzerland.
• It works together with our Privacy Policy and Terms of Service.

This document describes how Cyber Resilience Platform processes personal data for users in the European Economic Area (EEA), United Kingdom, and Switzerland. It complements our Privacy Policy and Terms of Service.

Cyber Resilience Platform is a SaaS tool for CRA readiness assessments, SBOM analysis, vulnerability tracking, and remediation workflows. We process data in two roles: as a controller for account and billing operations, and as a processor for customer content you upload.

2) Data controller

For personal data collected through your use of Cyber Resilience Platform (account information, billing, usage analytics), the data controller is:

For data you upload to the Service (assessments, SBOM artifacts, remediation plans, and evidence files), your organization is the controller. We act as processor on your behalf. A Data Processing Agreement (DPA) is available on request for enterprise customers.

3) What personal data we process

We process the following categories of personal data:

• Identity data: Full name, email address, company name, job role
• Account data: Username, password (hashed), authentication tokens, security preferences
• Billing data: Payment identifiers, subscription tier, billing history (actual payment details are processed by our payment provider)
• Technical data: IP address, browser type, device identifiers, session timestamps, feature usage logs
• Customer content: Assessment responses, remediation plans, SBOM files, vulnerability data, evidence uploads, comments, and any other data you choose to store in your workspace
• Communications: Support tickets, contact form submissions, email correspondence

4) Legal basis for processing

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service, authenticate users, deliver features, and provide support
• Legitimate interests (Art. 6(1)(f) GDPR): Platform security, fraud prevention, service improvement, internal analytics, and business operations—balanced against your rights and freedoms
• Legal obligation (Art. 6(1)(c) GDPR): Compliance with tax, accounting, and regulatory requirements
• Consent (Art. 6(1)(a) GDPR): Optional analytics and non-essential marketing communications where required by law. You may withdraw consent at any time via account settings or the consent banner.

For customer content you upload, we process as a data processor under your instructions (your use of the Service constitutes such instructions).

5) Your GDPR rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of your personal data we hold
• Right to rectification (Art. 16): Correct inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data when retention is no longer necessary (subject to legal obligations)
• Right to restrict processing (Art. 18): Limit how we process your data in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format and transfer to another service
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent (Art. 7(3)): Withdraw consent for analytics or marketing at any time without affecting lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal or similarly significant effects

6) How to exercise your rights

You can exercise many of your rights directly within the Service:

• Access & portability: Use the "Export my data" feature in Account → Privacy Settings to download your data in JSON format
• Rectification: Update your profile information in Account → Profile
• Erasure: Request account deletion in Account → Privacy Settings (this initiates a soft-delete process with a retention period for backups)
• Withdraw consent: Disable analytics in Account → Privacy Settings or via the consent banner

For requests that need manual verification, contact us via the contact form. We respond within 30 days. If a request is complex, we may need up to 60 days and will let you know.

7) Data protection measures

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: Data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Access controls: Role-based access, multi-factor authentication for admins, least-privilege principles
• Tenant isolation: Strict database-level isolation ensuring customer data is not visible across organizations
• Logging & monitoring: Security event logging, intrusion detection, availability monitoring
• Incident response: Documented procedures for detecting, investigating, and responding to data breaches
• Employee training: Staff trained on data protection and confidentiality obligations
• Regular audits: Periodic security assessments and vulnerability scanning

8) Sub-processors

We engage carefully vetted sub-processors to support service delivery. All sub-processors are bound by data processing agreements with GDPR-compliant safeguards. Key categories include:

• Hosting & infrastructure: Cloud providers for compute, storage, and database services
• Payment processing: Payment gateway providers for subscription billing (they process payment card data directly, not via our servers)
• Email delivery: Transactional email services for password resets, notifications, and account communications
• Analytics (optional): Third-party analytics providers when you consent to analytics tracking
• Support tools: Customer support and ticketing platforms for handling inquiries

A detailed sub-processor list is available upon request for enterprise customers requiring vendor oversight.

9) International data transfers

Cyber Resilience Platform and its sub-processors may process data in regions outside the EEA, UK, or Switzerland, including the United States. For such transfers, we rely on appropriate safeguards:

• Standard Contractual Clauses (SCCs): We execute EU Commission-approved SCCs with sub-processors in third countries
• Adequacy decisions: Where the European Commission has determined a country offers adequate data protection (e.g., adequacy decision for certain jurisdictions)
• Supplementary measures: Additional technical and organizational safeguards (encryption, access controls, audit rights) to ensure protection equivalent to GDPR standards

Enterprise customers may request copies of relevant transfer mechanisms (SCCs, impact assessments) for vendor compliance reviews.

10) Data retention periods

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy:

• Account & profile data: Duration of active subscription, plus limited retention for legal/audit obligations (typically 90 days after account closure)
• Customer content: While your workspace is active; deleted upon account termination (subject to backup retention policies)
• Billing records: As required by tax and accounting regulations (typically 7 years from transaction date)
• Usage logs: 90 days for operational logs; 12 months for security event logs
• Support communications: 2 years from last interaction, unless longer retention is required for legal purposes

After retention periods expire, data is securely deleted or anonymized. Backups are retained for disaster recovery and may persist for up to 30 days beyond deletion of production data.

11) Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by Art. 33 GDPR)
• Notify affected individuals without undue delay if the breach is likely to result in high risk to their rights (Art. 34 GDPR)
• Document the breach, including facts, effects, and remedial actions taken
• Cooperate with investigations and provide necessary information to supervisory authorities

For customer data where you are the controller, we will notify your organization's administrator promptly so you can fulfill your own notification obligations.

12) Data protection officer

While not currently required to appoint a Data Protection Officer under Art. 37 GDPR, we have designated a data protection contact responsible for overseeing GDPR compliance. You may reach our data protection contact via the contact form (select "Data Protection Inquiry").

13) Right to lodge a complaint

If you believe we have not processed your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority in your EU member state, the UK, or Switzerland. You can find your local supervisory authority here:

• EU: European Data Protection Board member list
• UK: Information Commissioner's Office (ICO)
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

However, we encourage you to contact us first so we can attempt to resolve your concern directly.

14) Contact & data protection inquiries

For questions about GDPR compliance, to exercise your rights, or to request a Data Processing Agreement (DPA), contact us via the Get in Touch section on the landing page.

Please include "GDPR" in your message subject to ensure prompt routing to our data protection team.