Trust & security
We're a security and compliance product, so we hold ourselves to the standard we help you meet. Here's how we handle your data and what we're working towards.
We only ever receive the CycloneDX SBOM — the list of components and versions. Your source code is never uploaded, cloned or seen by us.
Our servers run in France (OVH). Blobs — SBOMs, advisory PDFs, evidence — are stored on our own object storage, not a third-party service.
Traffic is TLS-encrypted in transit. Sign-in is GitHub OAuth with server-side sessions; CI ingest uses per-product tokens that are stored only as salted hashes.
Everything Cravault generates — reports, advisories, exports — lands in an append-only vault with content fingerprints, so your audit history can’t be quietly changed.
Article 14 drafts use an AI model to write only the connective narrative. The facts — product, version, component, CVE, dates, exploitation status — come solely from your SBOM and public vulnerability databases; the model never invents them. Every field shows its source, and nothing is filed until you review it.
Your evidence vault is kept for 10 years on paid plans (90 days on Free). You can export everything at any time — there's no lock-in. After cancellation an optional Archive plan keeps your vault read-only and exportable.
Payments are handled by Paddle as Merchant of Record — they're the seller of record and take care of EU VAT and invoicing.
We build to be GDPR-aligned. SOC 2 and ISO 27001 are on our roadmap — planned, not yet certified; we won't claim a badge we don't hold. A signable Data Processing Agreement (DPA) is planned for the Scale plan.
Found a security issue? See our coordinated vulnerability disclosure policy and security.txt. Reach us at security@cravault.io.
We also dogfood the product: every Cravault release is monitored by Cravault, on the same Article 14 timelines we ask of you.
