Data processing agreement
For customers who keep their own customers’ contact details with us: the agreement that covers that personal data.
Available on request
We have not published the text of our data processing agreement yet. If you need one, email privacy@declarable.io with your organisation's legal name and we will send it to you to review and sign.
What it covers
A data processing agreement is the contract the GDPR asks for when one company handles personal data on another's behalf.
- What personal data we handle for you: the names and email addresses of the customers you must inform about an incident, if you choose to upload that list.
- That we only keep that list with the incident it belongs to. We do not send those people anything: you send the notice yourself, and record with us that you did.
- How long we keep it: until you remove it, until 30 days after you close the incident, or until your organisation is deleted, whichever comes first.
- The other addresses you may give us: email addresses you add to receive your organisation's vulnerability alerts. Those we do email, with the alerts you asked for, until you remove the address or the person unsubscribes.
- How we keep it secure.
- Who else handles it on our behalf: the sub-processors listed below.
- How we help you answer those people's requests about their data, and tell you about a breach.
Annex: sub-processors
| Name | What it does for us | Where its data lives |
|---|---|---|
| Supabase | Database and private file storage: accounts, products, uploaded SBOMs and incident records. | EU region, chosen when the project is created. |
| Resend | Sends every email we send. To our users: sign-in links, team invitations and the two emails about a change of email address; Article 14 deadline reminders, and reminders that a support period or a security.txt file is about to run out; vulnerability alerts, daily digests and weekly summaries, a note when a finding is assigned to you or a suppression is about to expire, and the test emails you ask for; notices about your plan and payments, a data export, a scheduled or cancelled deletion of your organisation and a deleted account; and notices from us about the service, about a change to the legal state your documents are stamped with, about our decision on a mapping report your organisation filed, and about a suspension or a hidden public page. Alerts and reminders also go to any extra address your organisation adds for them. Resend also carries the alerts our own systems send to us when something breaks, which can name the organisation affected. It sends nothing to the customers on an incident’s contact list: we never email them. | EU region, chosen when the sending domain is added. |
| Cloudflare Turnstile | Bot check on the free SBOM check’s “Check for known vulnerabilities” step, the “Report a page” form, and the sign-in page when you create an account, sign in with a password or ask for a sign-in link. | To be confirmed |
| Sentry | Receives error reports so we can fix faults. | EU data region, chosen when the project is created. |
| Plausible | Page statistics without cookies. | To be confirmed |
| Vercel | Hosts the website and app and runs the scheduled jobs. | The app and its scheduled jobs run in Frankfurt, Germany. |
| GitHub | Signs you in with your GitHub account, if you choose to, and passes us the name, email address and profile picture on it. Keeps a second copy of our weekly backup of the database and uploaded files for 35 days. The backup is encrypted before it reaches GitHub, so GitHub cannot read it. Beside it, not encrypted, are two lists: how many rows each table holds, and each stored file by internal id, size and checksum, with file names removed. | To be confirmed |
| Paddle | Takes payment for paid plans. | To be confirmed |
| Name | What it receives | Where its data lives |
|---|---|---|
| OSV (osv.dev, run by Google) | The package identifier of each component that has one, with its version where OSV can compare it, and the version of a Linux kernel in the list. | Not stated by the provider. |
| GitHub (advisory database) | The package type, name and version of each component whose package type GitHub indexes. | Not stated by the provider. |
| ENISA (EU Vulnerability Database, EUVD) | The vendor and product name of each component identified by a CPE or by name alone. | Not stated by the provider. |
These are not companies that handle data for us under a contract. They are public databases our server asks when you use the “Check for known vulnerabilities” step of the free SBOM check. They receive component names, versions and identifiers from your list, never the file, and they see our server, not your IP address.
Files you upload to an account are not sent to them. Uploads are matched against our own copy of those databases.
The same list is kept at /legal/sub-processors.
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.