How CVD Portal handles your data
Written for the procurement, legal, and security reviewers who diligence us. No marketing language; only what we can evidence. Updated 6 September 2026.
Hetzner, EU region.
Application, database, and backups run on Hetzner infrastructure in the EU. We do not transfer submission data outside the EU/EEA. Operational timestamps are Europe/Amsterdam.
Processor.
Tenants are the data controller for submissions their portal receives. We act as a processor under GDPR Art. 28 terms described in our Privacy Policy.
Policy at /security, machine-readable at /.well-known/security.txt.
Public Registries & Official Designations
Independent verification records and regulatory authority listings for CVD Portal:
Cloud Security Alliance (CSA) STAR Level 1
Public self-assessment against the Cloud Controls Matrix (CCM) v4.0.2 and Consensus Assessments Initiative Questionnaire (CAIQ v4.0.2). Covers all 17 security control domains.
GCVE Numbering Authority (GNA 126)
Officially recognized GCVE Numbering Authority under the European decentralized CVE allocation initiative. Authorizes identifier allocation and coordinated disclosure records.
Subprocessors
These are the third parties that process tenant data on our behalf. We will give tenants 30 days' notice before adding a new subprocessor with material access to submission data.
Subscription billing and checkout
- Data processed
- Company billing contact, invoice history, card fingerprints (card data itself never touches our servers)
- Region
- Ireland (EU); payment data processed under Stripe's EEA data residency posture
Transactional email delivery (acknowledgments, notifications, auth)
- Data processed
- Recipient email, subject line, message body, delivery metadata
- Region
- Delivery infrastructure with EU sending region available; see Resend DPA
Hosting infrastructure (compute, database, object storage, backups)
- Data processed
- All platform data at rest, including tenant and submission data
- Region
- Nuremberg, Germany (compute and database); Falkenstein, Germany (object storage)
DNS, CDN, TLS termination, and DDoS protection in front of all traffic
- Data processed
- Request metadata and content in transit (proxied, not stored)
- Region
- Global edge network; EU Data Localization options; SCCs under Cloudflare DPA
Product analytics on the marketing site and dashboard
- Data processed
- Pseudonymous usage events, page views, device metadata. No submission content.
- Region
- EU instance (eu.i.posthog.com), data stored in the EU
AI inference for optional features (triage assistance, scanner analysis)
- Data processed
- Submission text passed for analysis only when a tenant uses an AI feature
- Region
- United States; SCCs. AI features are optional and plan-gated.
Internal operational alerts to on-call staff
- Data processed
- System health events and truncated error strings. No submission content, no tenant personal data by design.
- Region
- Global; used for operational telemetry only
Self-hosted components
Application runtime
Next.js server, self-hosted on EU-based VPS. Admin access over Tailscale only; no public SSH.
PostgreSQL database
Self-managed on Hetzner infrastructure in Nuremberg, Germany. Submission content (description, steps to reproduce, impact), researcher contact details (email, PGP key) and communication log recipients are encrypted at the application layer with AES-256-GCM. Records created before 6 September 2026 were migrated, so the coverage includes historical reports and not only new ones. The key is held in an environment variable on the application host, so this protects against a direct database read but not against host compromise. The encryption is scoped to those fields rather than to the whole record, and the exact field list is available to reviewers on request. Disk-level volume encryption is on the roadmap below.
Edge & reverse proxy
Caddy with automatic TLS (Let's Encrypt). HSTS preload, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict Referrer-Policy.
Geolocation
geoip-lite library; country-level IP lookup happens in-process. No external request, no third-party analytics.
Security controls
Encryption
- ·TLS 1.2+ enforced on every public endpoint. HSTS with preload.
- ·Application-level AES-256-GCM encryption for submission bodies (description, steps, impact), contact details (email, PGP key) and communication log recipients, plus stored integration credentials (webhook secrets) and TOTP seeds. Records predating 6 September 2026 were migrated to the same scheme. The key lives in an environment variable on the host, so this protects against a database read and not against host compromise. Our key management and rotation position is available to reviewers on request.
- ·That encryption is scoped to specific fields rather than to the whole record. The exact field list, and which of them we are extending it to, is available to reviewers on request.
- ·Passwords hashed with bcrypt; API keys stored as SHA-256 hashes, never in recoverable form.
- ·A tenant can publish an OpenPGP key in its security.txt, which lets a researcher encrypt a report before pasting it into the form. The portal does not perform that encryption. A researcher can also supply their own public key so the tenant can reply encrypted.
- ·Backup archives are encrypted before leaving the host, with the decryption key held offline.
Access control
- ·Role-based access (ADMIN, MEMBER) on every tenant workspace.
- ·Tenant data strictly isolated by companyId; cross-tenant access is a hard constraint at the ORM layer.
- ·NextAuth session management with CSRF protection; password hashing via bcrypt.
- ·Enterprise plan: SSO/SAML and EUDI Wallet identity verification (eIDAS 2.0).
Auditability
- ·Every state-changing action writes an append-only audit log with actor, timestamp (ms precision), IP, and country.
- ·Each entry is linked into a per-tenant SHA-256 hash chain. A daily job re-verifies every chain and alerts on any break.
- ·Database triggers reject UPDATE and DELETE on audit rows. Only a controlled retention job may purge operational entries.
- ·CRA Article 14 evidence entries (classification, notification, and remediation decisions) are kept permanently, and survive account deletion in pseudonymised form.
- ·Audit logs surface in the tenant dashboard and are exportable for CRA defense.
Operational security
- ·Secrets never committed to the repository; environment-based configuration.
- ·Dependency scanning in CI; Dependabot-equivalent automated update flow.
- ·No production shell access outside Tailscale; deploy user scoped to application directory.
Data ownership and exit
- ·You own every report your portal receives. We process it on your behalf, we do not sell it, and we do not use it to train models.
- ·Full export of all the data you provide, in HTML, CSV, and JSON, is available on every plan, including Free, for as long as your account exists.
- ·We delete your data on request. Closing your account removes your data within 30 days, except where a legal retention obligation applies. If a trial or subscription ends and the account stays inactive, we may delete it after a 90-day grace period and at least 30 days' prior notice.
- ·Operational audit entries are retained for 12 months. CRA Article 14 evidence entries are retained permanently and, on account deletion, are archived in pseudonymised form so your compliance record survives the erasure of personal data.
Data Processing Agreement
Our standard Data Processing Agreement (GDPR Art. 28) is published at /dpa, including processing details and the subprocessor list above as its annexes. For a countersigned copy or bespoke terms, email security@cvdportal.com.
Security testing
CVD Portal is penetration tested by an independent firm every quarter. The most recent test was completed in May 2026. Enterprise clients receive the full report under NDA. A summary of scope and outcome is available on request via security@cvdportal.com.
Report a vulnerability in CVD Portal itself
We run our own coordinated disclosure process. Report a security issue in CVD Portal through our disclosure policy, or read the machine-readable security.txt.
Incident response
- 01We learn of an incident via internal monitoring, tenant report, or researcher report to security@cvdportal.com.
- 02A responder acknowledges within the SLA on our Security page, scopes impact, and opens an incident record.
- 03Affected tenants are notified without undue delay (and within 72 hours for personal-data breaches, per GDPR Art. 33).
- 04A post-incident write-up is published to affected tenants. Material incidents are disclosed on /status with a resolution note.
Backups & business continuity
Database backups are taken on a defined schedule and stored encrypted off the primary host. We exercise restore drills periodically. Enterprise customers can request our current RPO/RTO targets, the most recent restore test date, and our business-continuity summary under NDA via security@cvdportal.com. We are deliberately not publishing specific numbers here that we cannot continuously evidence.
On the roadmap
Items we have committed to and are tracking publicly:
- →Disk-level (LUKS) volume encryption for the database and backup storage.
- →SOC 2 Type 1 readiness engagement.