Security, audit logs, and data protection

This page answers common procurement and security-review questions about how CVD Portal protects tenant data.

Where is my data hosted?

Customer data is stored in Germany. The application, the PostgreSQL database, uploaded assets and backups run on Hetzner infrastructure there. Analytics run on PostHog EU Cloud. Optional AI features, such as AI triage, CRA document drafting and the support assistant, send the text they analyse to AI providers outside the EU/EEA. The Trust page at cvdportal.com/trust lists each subprocessor and its region.

How do I change my password?

Open Settings, Account, and use the Password card. Give your current password and the new one twice. The new password must be at least 8 characters. Use this when an admin created your account with a password they sent you, so you can replace that shared secret without waiting for an email. If you sign in with Google, GitHub, or SAML SSO, the card is not shown, because your identity provider holds the password.

A password change ends every session on the account, this one included, so you are signed out and sign in again with the new password. Each change writes a "Password changed" entry to the audit log. If you cannot sign in at all, use the "Forgot password" link on the login page instead.

Does resetting a password sign out other devices?

Yes. Completing a password reset ends every session that account already had, on every device and browser, within about half a minute. Anyone still signed in elsewhere is returned to the login page and has to sign in again with the new password. This is what makes a reset an effective response to a session you think someone else may hold, rather than only a credential change.

Is the audit log immutable?

Yes, in a verifiable way. Every state-changing action writes an audit entry that is linked into a per-tenant SHA-256 hash chain. Database-level controls reject any update or deletion of stored entries, and an automated job re-verifies every chain daily and alerts on any break. Tenant administrators cannot alter or delete audit entries.

Retention has two tiers. Operational entries (logins, page views, API calls) are kept for 12 months. Entries forming the CRA Article 14 evidence chain (classification decisions, notifications sent, remediation decisions) are kept permanently.

Can I export my data?

Yes. A company admin can export the account data at any time, on any plan, under Settings, Account, Export your data. You can download it as one HTML file, as CSV files in a ZIP, or as one JSON file. The export holds the data your company gave to the platform, such as submissions, products, evidence records and the audit log. The audit log part holds the 10,000 most recent entries, with their chain hashes, so you can show that the history was not changed.

The export does not hold password hashes, 2FA secrets, API-key hashes or webhook secrets. It also does not hold the contents of the files that you uploaded, only their records. Keep your original files.

What happens to my data if I delete my account?

Account deletion is available to company admins under Settings, Account. It is a hard delete under GDPR Article 17. All personal data, submissions, settings, and operational logs are erased. One exception applies. Your CRA Article 14 evidence entries are preserved in pseudonymised form, with personal identifiers removed and email addresses replaced by one-way tokens, so your regulatory compliance record survives the erasure. This is disclosed in the Privacy Policy and the DPA.

A partner who manages your workspace can request its deletion. Each company admin gets an email, and the workspace is deleted after 14 days unless an admin cancels the request in Settings, Account. Disabling partner access also cancels it. A partner can delete a workspace at once only when nobody at your company has activated an account.

Is data encrypted at rest?

Submission bodies (description, steps to reproduce, impact) and researcher contact details (contact email, PGP key) are encrypted at the application layer with AES-256-GCM. Integration credentials such as webhook signing secrets and TOTP seeds are encrypted with the same standard. The encryption key lives in an environment variable on the application host. This protects against a database read and not host compromise. There is no key rotation tooling. Passwords are hashed with bcrypt and API keys are stored as SHA-256 hashes, so neither can be read back. Backup archives are encrypted before leaving the host and the decryption key is held offline. Disk-level volume encryption is on the public roadmap on the Trust page.

Does the platform keep AI requests and answers?

Yes, for 30 days. When an AI feature answers a request, for example the support assistant, an AI draft or AI triage, the platform keeps the text that the model received and the text that it returned. Both are encrypted at rest with AES-256-GCM, with the same key as the submission fields. Once a day, a second AI model from a different provider family compares each answer with its source text and records whether the source supports the answer. Only platform administrators can see the results. Each record is deleted 30 days after it was made.

The second model is one of the AI subprocessors on the Trust page, and some of these are outside the EU/EEA. The Privacy Policy gives the legal basis for this check and tells how to object to it.

Are there backups?

Yes. The database is backed up daily. Archives are encrypted before leaving the primary host and stored off-host, and restore drills are exercised periodically. Enterprise customers can request current RPO/RTO targets and the most recent restore test date under NDA via security@cvdportal.com.

Is there a DPA and a subprocessor list?

Yes. The standard Data Processing Agreement (GDPR Article 28) is published at cvdportal.com/dpa. The authorised subprocessor list, including purpose, data categories, region, and transfer mechanism for each vendor, is maintained at cvdportal.com/trust#subprocessors and forms Annex III of the DPA. Tenants get 30 days' notice before a new subprocessor with material access to submission data is added.