Security & data protection

All saved application data — accounts, workspaces, registers of information, Article 30 contract schedules, incident logs and vendor passports — is stored in the European Union. Backups stay in the same region.

Register spreadsheets and CSV files dropped into the validator are decoded and checked inside your browser. Nothing is transmitted to us unless you deliberately save the result to your workspace. For a firm handling supplier contract data, that removes the upload step from the risk assessment entirely.

What leaves the browser, and when:

• The file itself: never. It is read from disk by the browser and decoded in the page; there is no upload request in that path.
• LEI codes: only the codes you ask us to verify, passed through our service to the public GLEIF directory. No other column travels with them.
• Checked rows: only when you press “Save to account”, so the record can be reopened later. Stored in the EU, encrypted, and visible only to your workspace.
• Assistant messages: only what you type into the compliance assistant, and only while you are using it.

TLS 1.2+ on every connection, with HTTPS enforced. Data at rest, including backups, is encrypted with AES-256. Passwords are stored only as salted hashes and are never recoverable.

Every record carries the workspace that owns it, and database row-level security policies are evaluated on each query against the signed-in user's membership. A request for another workspace's data returns nothing, whatever the client sends. Isolation is enforced by the database, not by the interface.

Email and password or Google sign-in. Passwords must be at least 12 characters with upper case, lower case, a number and a symbol, and are rejected if they appear in known breached password lists. Inside a workspace there are four roles — owner, admin, member and viewer. Viewers cannot change anything; only owners can transfer or remove ownership. Invitations are tied to the invited email address and expire after 14 days.

All four modules and the assistant require a signed-in session, checked on the server, so the gate cannot be bypassed from the browser.

Daily backups with point-in-time recovery. Saved records are kept until you delete them or close your account; personal data is deleted within 30 days of closure except where law requires retention. Email delivery and security logs are kept for up to 12 months.

We notify affected customers without undue delay, and in any event within 72 hours of confirming a personal data breach. The notification may be provided in phases: it contains the facts known at the time — the nature of the breach, the likely consequences and the steps taken — with follow-up updates as more is established. As your processor we support your own GDPR Article 33 notification to your supervisory authority, and where the incident touches ICT services you record in your register, we give you what you need for a DORA notification.

Email doratools@proton.me with the details. We acknowledge within two working days. Please do not run automated load or denial-of-service testing against the production service.

We hold no ISO 27001 or SOC 2 certificate today, and we will not imply otherwise. Controls are designed against ISO 27001 Annex A, and no independent penetration test has been completed yet. Automated dependency and platform security scanning runs continuously and currently reports no outstanding high or critical findings. If a certificate or test report is issued, it will be published on this page with its date.

We tell account holders before adding a new sub-processor that handles personal data. Full terms are in the data processing agreement.

Do you hold ISO 27001, SOC 2 or an equivalent certification?

No certificate has been issued to date. Controls are designed against ISO 27001 Annex A and we will publish the certificate if and when it is awarded. We do not claim certification we do not hold.

Has the application been penetration tested?

No independent penetration test has been completed yet. Automated dependency and platform security scanning runs continuously and currently reports no outstanding high or critical findings.

Where is customer data stored?

All saved application data — accounts, workspaces, registers of information, contract schedules, incident logs and vendor passports — is stored in the European Union.

Is data encrypted?

Yes. TLS 1.2+ in transit for every connection, AES-256 at rest for the database and backups.

How is one customer's data separated from another's?

Every record carries the owning workspace. Database row-level security policies are evaluated on every query against the authenticated user's workspace membership, so a request for another workspace's rows returns nothing regardless of what the client sends.

Do your staff have access to our compliance data?

Routine operation requires no access to customer records. Privileged database access is limited to named administrators and used only for incident diagnosis or a support request you raise.

How does this connect to our broader risk assessments?

Each module produces an artifact your risk team can drop straight into its existing process: a row-by-row findings report for the register, a DORA contract schedule that attaches to the master agreement, a supervisor-ready incident summary with the statutory deadline timeline, and a shareable vendor passport. Everything exports as CSV or markdown, so it slots into whatever GRC tool or risk register you already run. DORA Workbench does not replace your risk assessment — it does the mechanical, time-consuming part (mapping, validating, formatting) so your team spends its judgement on the decisions that actually need it.

Who validates your template logic?

The template structure — field codes, mandatory flags, code lists — is taken directly from the ESA implementing technical standards (the ITS templates RT.01.01, RT.02.01, RT.02.02, Commission Implementing Regulation (EU) 2024/2634). The validation rules check those fields against the published specs: mandatory presence, ISO date format, country-code shape, and LEI checksum against the GLEIF ISO 17442 standard. No independent third party has audited the implementation, and we do not claim otherwise. The parsing and checking code runs in your browser, so a technical reviewer on your side can inspect it directly rather than taking our word for it.

Are uploaded spreadsheets sent to your servers?

No. Register spreadsheets and CSV files are parsed and validated inside your browser. Nothing leaves the device unless you explicitly save the result to your workspace.

What authentication controls apply?

Email and password or Google sign-in. Passwords must be at least 12 characters with upper case, lower case, a number and a symbol, and are checked against known breached-password corpora. Passwords are stored only as salted hashes.

How is access controlled inside a customer workspace?

Four roles — owner, admin, member and viewer. Viewers cannot write. Only owners can transfer ownership or remove owners. Invitations are matched to the invited email address and expire after 14 days.

What are your backup and retention arrangements?

The database is backed up daily with point-in-time recovery. Saved records are kept until you delete them or close the account; personal data is deleted within 30 days of account closure except where law requires retention. Email delivery and security logs are kept for up to 12 months.

What is your breach notification commitment?

We notify affected customers without undue delay after becoming aware of a personal data breach, and in any event within 72 hours of confirming that a breach has occurred. Because the full picture is rarely clear at first, the notification may be provided in phases: it contains the facts known at the time — the nature of the breach, the likely consequences and the measures taken or proposed — with follow-up updates as more is established. As processor we support your own Article 33 GDPR notification to your supervisory authority.

Will you sign a data processing agreement?

Yes. Our GDPR Article 28 data processing agreement is published and forms part of the terms of service; a countersigned copy is available on request.

Do you use customer data to train AI models?

No. Assistant conversations are not stored in your account and are not used for model training. We ask customers not to paste personal or client-confidential material into the assistant.

Is the service subject to DORA itself?

We are a compliance tooling supplier, not a critical ICT third-party provider designated under DORA. We supply the register entry details you need to list us, and will negotiate an Article 30 schedule where your contract requires one.

How do we report a vulnerability?

Email doratools@proton.me with the details. We acknowledge within two working days. Please do not run automated load or denial-of-service testing against production.