Security

Last updated date of publication

Where does an uploaded SBOM go?

• Storage: the file goes into Cloudflare R2, and its details into Cloudflare D1. Both are encrypted at rest. Nothing is stored anywhere else.
• Analysis: runs on Cloudflare's container platform, in a container that starts when you upload and stops when the work is done. It reads your file through our own API, with a credential that can only read SBOMs and report results.
• Lookups: to check your components, we send their names, versions and public repository references to OSV.dev (run by Google), the U.S. National Vulnerability Database, and GitHub. We never send your company name, your product names or the file itself.
• No AI: no language model reads your SBOM or your results, and none is trained on them. We use a model only on vendors' public advisories, on our own hardware.

Who can see it?

• Only people you add to your account. Every request is checked against the account it is for. To anyone else, your SBOMs, findings and decisions answer "not found", the same as if they did not exist.
• Our tests include a customer of another company trying each route that serves an SBOM, a finding, an export or a decision. Every one of those tests must fail closed.
• Our staff can open a customer's data only through a separate operator role, used to answer your support requests and deletion requests.

How do people sign in?

• With a six-digit code emailed to their work address. There are no passwords to leak or reuse.
• Codes expire after 10 minutes, work once, and die after five wrong guesses. We store them only as keyed hashes, never in readable form.
• Sessions are cookies that scripts cannot read, sent only over HTTPS and only to our own address. They expire after 12 hours.
• Your colleagues join by invitation from someone already in your account. Nobody joins because of their email domain.

Can we delete our data?

Yes, yourselves, from the app: one release, a whole product, or the entire account. Deletion removes the file, its analysis, your decisions about its findings and every alert sent about it. Closing an account leaves no copy of its members' email addresses. The database keeps restorable history for up to 30 days, so within 30 days nothing remains.

What do you keep a record of?

Every decision with consequences is recorded with who made it and when: a vulnerability marked "not affected", a colleague added or removed, an upload withdrawn, a deletion. Under the Cyber Resilience Act you need to show who decided what about a vulnerability, and this is that record.

What about the vendor documents you show us?

We archive vendor advisories exactly as published, and you can always open the original. Content fetched from the internet is treated as hostile. It is displayed with raw HTML disabled, then cleaned, under a policy that allows no inline scripts and no loads from other sites, including images.

Found a security problem?

Tell us at security contact. We welcome good-faith reports and won't treat them as a breach of our terms. Please give us a reasonable time to fix the problem before publishing.

Who else handles data, and where: Privacy Policy.