CVD Portal

Terms of Service & Shared Responsibility Agreement

Version 1.2 · 18 October 2026

Welcome to CVD Portal (the "Platform"), operated by Porta Regulus B.V., a private limited company registered in the Netherlands (KvK 42062307, VAT NL869534208B01), with its registered office at WTC Amsterdam, Strawinskylaan 6, 1077 XW Amsterdam, Netherlands ("we", "us", the "Provider"). By registering an account, configuring a workspace, or using any part of the Platform, you ("Tenant", "Manufacturer") explicitly agree to the following Terms of Service governing your Coordinated Vulnerability Disclosure (CVD) workflows.

1. Regulatory Compliance (EU Cyber Resilience Act)

The CVD Portal is specifically engineered to assist organizations in meeting the strict reporting and disclosure requirements mandated by the EU Cyber Resilience Act (Regulation EU 2024/2847). However, the Platform acts strictly as a data-processing utility. Ultimate regulatory liability rests with the Tenant.

1.1 Platform Capabilities (Our Responsibilities)

We provide the software architecture to facilitate compliance, including:

  • Intake & Timing: Maintaining a secure reporting pipeline (SPOC) and generating immutable audit logs to track the strict 48-hour acknowledgment regulatory clocks.
  • Data Export: Generating standard OASIS CSAF 2.0 (Common Security Advisory Framework) JSON advisories for resolved reports.
  • Threat Intelligence: Correlating your uploaded component lists automatically against the NVD (National Vulnerability Database).
  • Escalation Routing: Formatting 24-hour National CSIRT/ENISA immediate notification payloads for vulnerabilities you mark as Critical/High.

1.2 Tenant Obligations (Your Responsibilities)

By using the Platform, you acknowledge that you remain legally and operationally responsible for fulfilling the following engineering duties under the CRA:

  • SBOM & Hardware Tracking (PRE-7, PRE-8): You must actively maintain, generate (via your CI/CD pipelines), and upload accurate SPDX/CycloneDX Software Bill of Materials and Hardware Asset lists to the platform's registry.
  • Triage & Risk Assessment (VRF-1, VRF-2): You must technically reproduce incoming reports, determine their severity, and appropriately trigger the "Critical" escalation tools within the platform when societal risk exists.
  • Patch Development (RMD-2, PRE-10): You must write the actual software patches, test their efficacy, and securely host the compiled binaries or patches on your own infrastructure.
  • Active Monitoring (RCP-1): You must actively monitor the platform's alerts and your Single Point of Contact (SPOC) to ensure reports are acknowledged before deadlines expire.

1.3 Conformity Assessment Scope & Boundaries (Default vs. Important & Critical Products)

The Platform provides an automated, complete self-assessment compliance path (Module A Internal Control) strictly for Default-class products with digital elements. For Important products (Annex III Class I and Class II) and Critical products (Annex IV), the CRA mandates third-party conformity assessment by an accredited Notified Body or an EU Cybersecurity Certification Scheme (EUCC), along with adherence to category-specific vertical standards.

The Provider is not a Notified Body, does not conduct laboratory testing, and does not issue EU type-examination or conformity certificates. For Important and Critical products, the Platform operates solely as a documentation and evidence assembly tool to assist the Tenant in preparing the technical file and risk assessments for their designated third-party assessment body.

2. Operations & Security

All vulnerability data is encrypted in transit and at rest. If your operations require End-to-End Encryption (E2EE) for sensitive payload exchange, you are responsible for safely generating and managing your own PGP asymmetric key pairs within the Platform's Security Settings.

3. Warranties and Limitation of Liability

The Platform is provided "AS-IS" and "AS AVAILABLE". To the extent permitted by law, we disclaim implied warranties of merchantability and fitness for a particular purpose. Reliance on the automated threat-intelligence mapping does not constitute an exhaustive penetration test of your internal systems. We shall not be held liable for regulatory fines, legal penalties, or security breaches resulting from a Tenant's failure to acknowledge active vulnerability reports, accurately configure their components, or deploy protective patches.

Subject to the following paragraph, our total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), or otherwise, is limited to the total fees you paid to us for the Platform in the twelve (12) months immediately preceding the event giving rise to the claim. We are not liable for indirect, incidental, or consequential loss, or for loss of profit, revenue, goodwill, or data.

Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under Dutch law, including liability for intent (opzet) or gross negligence (bewuste roekeloosheid) within the meaning of Book 6 of the Dutch Civil Code (including art. 6:248 BW), for death or personal injury caused by our negligence, or for fraud.

4. Intellectual Property and Licence

All intellectual property rights in the Platform, including its software, design, and documentation, remain the exclusive property of Porta Regulus B.V. and its licensors. We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform for your internal CVD and CRA-compliance purposes for the duration of your account. You retain all rights in the data you and your researchers upload; you grant us only the licence necessary to host, process, and display that data to operate the service.

Aggregated statistics. We may derive anonymised, aggregated statistics from the use of the Platform, for example the median time to acknowledge a vulnerability report or the share of Article 14 notifications filed within the deadline. Each statistic combines the data of at least 10 customers, gives each customer equal weight, contains no personal data, and does not identify you, your products, or your researchers. These statistics belong to Porta Regulus B.V. We may use them to improve the Platform and publish them for research. They are not part of the exportable data described in section 7.

5. Acceptable Use

You agree not to use the Platform to, and not to permit anyone to:

  • Use the Platform for any unlawful purpose or in breach of any applicable law or regulation.
  • Access, probe, or interfere with another tenant's workspace, data, or portal.
  • Attempt to circumvent authentication, rate limiting, tenant isolation, or the tamper-evident audit log.
  • Upload malware, or content that is unlawful, infringing, or that you have no right to submit.
  • Resell, sublicense, or provide the Platform to third parties except under a separate written partner agreement with us.
  • Scrape, overload, or disrupt the Platform, or use it to send unsolicited communications.

We may suspend or terminate access for a material or repeated breach of this section, where feasible after notice.

6. Data Retention and Account Termination

You can export all data your account has provided (HTML, CSV, or JSON) at any time, on any plan, from Settings, for as long as your account exists. This right is your safeguard against the deletion described below.

If your subscription or trial ends and your account has no active subscription, we retain your data for a grace period of at least 90 days during which export remains available. After that grace period, and after at least 30 days' prior notice sent to your account email, we may permanently delete the account and its data. Deletion is irreversible.

We do not delete an account that is in use. An account is in use while somebody signs in to it. We send the notice described above only once the grace period has passed and no sign-in has occurred for 90 days.

Two categories of records survive deletion because a legal obligation requires it. Records forming your CRA Article 14 evidence chain are retained in pseudonymised form, with personal identifiers removed, as described in our Data Processing Agreement. Billing and tax records are retained for the period required by law. No other data is kept.

7. Switching and Data Portability (EU Data Act)

This section sets out your switching rights under Chapter VI of the EU Data Act (Regulation (EU) 2023/2854). The details of each step, the full list of exportable data, and the information on jurisdiction and international access are on our EU Data Act page, which forms part of these Terms.

  1. You can ask us in writing, at security@cvdportal.com, to switch to another provider, to move your data to your own infrastructure, or to erase your data. If you switch, give us the name of the destination provider. You can start this at any time. There is no notice period.
  2. The switching process ends no later than 30 calendar days after your request. During that transitional period the Platform keeps working under these Terms. We give reasonable help to you and to the third parties you authorise, keep the service running with due care, tell you about any known risk to continuity, and keep your data secure in transfer and in storage. You can extend the transitional period once, for the period you choose.
  3. If 30 days is technically not possible, we tell you within 14 working days of your request, explain why, and propose another transitional period of no more than 7 months. The service continues during that period.
  4. Exportable data is every data category listed on the EU Data Act page, in JSON or CSV, and in HTML for reading. You can export it yourself at any time from Settings, or through the API at GET /api/v1/account/export with a key that has only the account:export scope. Every plan can create such a key free of charge. We help with your exit strategy and give you all relevant information.
  5. Two categories specific to the internal functioning of the Platform are not exportable, because exporting them would breach our trade secrets. They are the configuration of our AI features, including prompts and model settings, and our internal security controls and credentials. The aggregated statistics in section 4 are ours and are not exportable data either.
  6. After the transitional period you have at least 90 calendar days to retrieve your data. When that period ends, or when switching has completed, we erase all exportable data generated by you or relating directly to you. The only records we keep are the two categories that section 6 names, because a legal obligation requires them.
  7. These Terms end when switching completes, or at the end of the retrieval period when you ask us to erase your data. We tell you when the contract ends.
  8. We charge nothing for switching or data export, and there are no early termination penalties.

8. Governing Law and Jurisdiction

These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes) are governed by the laws of the Netherlands. The competent court in Amsterdam, the Netherlands, has exclusive jurisdiction, without prejudice to any mandatory consumer-protection rights you may have to bring proceedings in your country of residence.

By registering, you confirm that you have read, understood, and will abide by this Shared Responsibility Agreement.