How does CVD Portal meet the EU Data Act switching rules?
Last updated 18 October 2026
CVD Portal meets the EU Data Act switching rules with a free full data export on every plan, a switching period of at most 30 days, at least 90 days to retrieve data, and no switching charges.
Key takeaways
- Every plan can export all tenant data in JSON or CSV, from Settings or through the API, free of charge.
- A switch to another provider ends no later than 30 calendar days after the request, and the service keeps running during that time.
- Customers have at least 90 calendar days after switching to retrieve their data, and the data is then erased.
- CVD Portal charges nothing for switching or export and has no early termination penalties.
- The platform, its database and its backups are hosted in Germany by a German provider.
Chapter VI of the EU Data Act, Regulation (EU) 2023/2854, applies to providers of data processing services from 12 September 2025. Porta Regulus B.V. operates CVD Portal as such a service. The contract terms are in section 7 of the Terms of Service. This page is part of those terms.
Which Data Act duties apply, and how are they met?
| Article | What it requires | How CVD Portal meets it |
|---|---|---|
| Article 23 | Remove commercial, technical and contractual obstacles to switching | Export works on every plan with no plan gate. No switching charge, no early termination penalty, no lock-in term. |
| Article 25(1) and (2) | Written switching terms, a notice period of at most two months, a transitional period of at most 30 days, at least 30 days to retrieve data, then full erasure | Terms of Service section 7. No notice period, a transitional period of at most 30 days, at least 90 days to retrieve data, then erasure of all exportable data. |
| Article 25(3) | The customer can choose to switch, to move to its own infrastructure, or to erase its data | All three options, by written request. Terms of Service section 7, point 1. |
| Article 25(4) and (5) | Notice within 14 working days if 30 days is not technically possible, and the right to extend the transitional period once | Both are in Terms of Service section 7, points 2 and 3. |
| Article 26 | Information on switching procedures, formats and limitations, and an online register of exportable data structures and formats | This page. The register below lists every exportable data category and its formats. |
| Article 28 | Publish the jurisdiction of the ICT infrastructure and the measures against unlawful international governmental access | The jurisdiction section below. |
| Article 29 | No switching charges from 12 January 2027, and clear information on fees and penalties before the contract | No switching charges now. Standard fees are on the pricing page. There are no early termination penalties. |
| Article 30(2) | Open interfaces for switching, free of charge, available to all customers to an equal extent | GET /api/v1/account/export. Every plan can create a key with only the account:export scope, free of charge. |
| Article 30(3) | Compatibility with common specifications or harmonised standards for interoperability, 12 months after their publication | None is published yet in the central Union standards repository. We will meet them within 12 months of publication. |
How do I switch to another provider?
- Send a written request to security@cvdportal.com. Say whether you want to switch, move the data to your own infrastructure, or erase it. If you switch, name the destination provider.
- Export the data yourself at any time. In the dashboard, go to Settings and export as JSON, CSV or HTML. For software, create an API key with only the
account:exportscope and callGET /api/v1/account/export?format=jsonor?format=csvwith the headerAuthorization: Bearer <key>. - We complete the switch within 30 calendar days. You can extend that period once. We help you and the destination provider, and we tell you about any known risk to continuity.
- After the switch you have at least 90 calendar days to retrieve the data. Then we erase it and tell you that the contract has ended.
Register of exportable data
The export holds 32 data categories. All of them are in every export. An empty category is left out of the CSV archive and listed in its manifest.
| Key | Data category |
|---|---|
| company | Company profile |
| users | Team members |
| submissions | Vulnerability submissions |
| submission_communications | Submission communications |
| security_advisories | Security advisories |
| art14_reports | Article 14 reports |
| art14_report_snapshots | Article 14 report snapshots |
| remediation_decisions | Remediation decisions |
| upstream_reports | Upstream reports |
| upstream_stakeholders | Upstream stakeholders |
| products | CRA products |
| cra_artifact_states | CRA obligation artifact states |
| assessment_snapshots | Assessment snapshots |
| review_triggers | Review triggers |
| evidence | Evidence records |
| security_review_items | Security review items |
| sboms | SBOMs |
| sbom_findings | SBOM findings |
| supply_chain_partners | Supply-chain partners |
| hardware_components | Hardware components |
| scan_targets | Scan targets |
| scan_results | Scan results |
| pipeline_findings | Pipeline findings |
| monitoring_sources | Monitoring sources |
| trust_viewers | Trust portal viewers |
| assignments | Contributor assignments |
| sla_policies | SLA policies |
| notification_preferences | Notification preferences |
| api_keys | API keys |
| webhooks | Webhooks |
| settings | Settings |
| audit_logs | Audit log |
Formats
- JSON, UTF-8. One object with
exportedAt(ISO 8601),company, andsections. Each section has akey, alabelandrows. Each row keeps the field names of the data model. Dates are ISO 8601. - CSV with a header row, in a ZIP archive with one file per non-empty category and a manifest.
- HTML, one self-contained file for reading. Available in the dashboard only.
Known limitations
- Uploaded evidence files are not in the self-service export. Their records are. On request we deliver the files as a ZIP archive within the transitional period.
- The export holds the 10,000 most recent audit log entries. On request we deliver the full audit log within the transitional period. The export includes the hash chain values, so you can check that the history was not changed.
- Audit log IP addresses older than 90 days are removed to protect the people they belong to.
What is not exportable
- Security credentials. Password hashes, two-factor secrets, API key hashes, webhook signing secrets and access tokens are removed. They would weaken security and cannot be used elsewhere.
- Data specific to the internal functioning of the platform whose export would breach our trade secrets. This is the configuration of our AI features, including prompts and model settings, and our internal security controls.
- Anonymised, aggregated statistics across customers. These belong to Porta Regulus B.V., as section 4 of the Terms of Service states.
Which jurisdiction applies, and how is unlawful international access prevented?
The platform, its database and its backups run on infrastructure in Germany, operated by a German hosting provider. Porta Regulus B.V. is a company under the law of the Netherlands. The infrastructure is therefore subject to the law of the European Union and its Member States.
Measures against international governmental access that would conflict with Union law:
- The platform database, file storage and backups are in the European Union.
- Traffic is encrypted with TLS 1.2 or later. Stored integration credentials are encrypted with AES-256-GCM. Backups are encrypted before they leave the host, and the decryption key is held offline.
- Administrative access runs only over a private network. Changes to tenant data are recorded in a tamper-evident audit log.
- Some subprocessors are based outside the European Union, for example the edge network that terminates TLS and the provider of optional AI features. They are listed with their region and transfer mechanism on the trust page, and transfers rely on Standard Contractual Clauses.
- If an authority of a third country asks for customer data, we check the request against Union and Member State law. We refuse a request that conflicts with that law. Where the law allows, we tell the customer before we answer, and we give only the minimum data the request needs.
Fees and charges
Switching and export are free of charge. There are no early termination penalties. The standard service fees are on the pricing page.
Source
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data (Data Act), CELEX 32023R2854, Articles 23 to 32 and 50. Full text on EUR-Lex.