Skip to content
Declarable

Security

How we handle your data, how to report a problem, and what we publish about our own software.

How we handle your data

  • The app runs in Frankfurt, Germany.
  • Each organisation's data is kept apart from every other's by row-level security in the database.
  • Incident report text, incident notes, CSIRT updates, the reason an incident was closed, unpublished advisory text and alert webhook addresses and secrets are encrypted with AES-256-GCM before they are stored.
  • The files you upload for a release, such as SBOMs and build files, the files you attach to your technical documentation and the scan of a signed declaration of conformity are encrypted with AES-256-GCM before they are stored. A scan uploaded before 10 October 2026 is encrypted the next time we run our sealing step.
  • The SBOMs and build files you upload for a release are deleted after 90 days. Two kinds of file are kept longer: files attached to your technical documentation (the set of documents the Regulation has you keep for each product) stay while that technical file exists, and the scan of a signed declaration of conformity is kept until the later of 10 years after signing and the end of the product's support period.
  • A deleted organisation is purged after 30 days.
  • You can sign in with an email and password, a link we email you and a passkey.
  • Every response tells your browser to reach Declarable over encrypted HTTPS only, never plain HTTP.
  • Each week we back up the database and the files you could not make again, such as issued declarations and their signed scans. The backup is encrypted with a key that is not kept with the app.
  • If a security breach affects your data, we will tell you.
  • Who else handles the data is on our sub-processors page. A data processing agreement is available on request at privacy@declarable.io.
  • We hold no ISO 27001 or SOC 2 certificate.

Report a security problem

Email security@declarable.io. Our security.txt says the same in the standard format (RFC 9116).

Tell us what you found, where, and how to repeat it. Do not read, change or keep other people's data, and do not run anything that slows the service down for others.

What we want reported

  • declarable.io and the signed-in app, including the public pages we render for customers: the trust centre under /t/, product pages under /p/, shared links under /share/, the badge under /api/badge/, and a maker's published advisories, acknowledgements page, hosted security.txt and advisory feeds under /a/.
  • /api/v1, /api/mcp and /api/lookup: the keyed API, the MCP endpoint that AI agents call with the same API key (see agents), and the endpoint the free tools post to. An API key can write decisions to a product's record, not only read.
  • The free tools, which run in your browser and need no account.
  • The files we publish: /.well-known/security.txt and /.well-known/sbom.
  • The CI scripts under /docs/ci/files, which people download and run in their own builds.

What to send somewhere else

  • A flaw in a customer's own product that one of their pages here describes. We publish what the maker told us; we did not build their device. Report it to them, at the contact in their own /a/<org>/security.txt.
  • The services we use — Paddle's checkout, our email sender, Cloudflare's bot check. Each runs its own programme and can fix its own code; we cannot.
  • Volume or denial-of-service testing. Please do not. It costs other people the service and tells us nothing we want to know.
  • Social engineering of us, our customers or our suppliers.

Our disclosure policy

  • We will reply to say we have your report.
  • We will tell you what we decide, and keep you updated until it is fixed.
  • We will not take legal action against anyone who follows this policy in good faith.
  • We don't run a bug bounty and don't pay for reports.
  • We ask for a reasonable time to fix a problem before you publish it, and we will credit you if you want.
The full text, with what each term means, is on the disclosure policy page. The security.txt generator can prepare one for your own product.

Our own SBOM

A tool that checks other people's software lists should publish its own. Ours is at /.well-known/sbom: 990 components, every package in our lockfile, build tools included. It is a 1.6 file, rebuilt from the lockfile each time we deploy.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.