Security and trust
How we will protect the list of your vulnerabilities.
Vulnward is itself a product subject to the CRA. We will apply to our product what we help you do. This page states what is true today, and what is planned. Your installed base (customer references, versions, countries, contacts) is imported separately, from your systems, and protected as described below.
What will leave your CI
Sent
The release's CycloneDX SBOM
Dependency manifests (optional)
Product name, version, commit
Never sent
Your source code
Your secrets and CI variables
The data your product processes
Report a vulnerability
Write to the address listed in our security.txt file. Acknowledgement within 2 business days; we coordinate disclosure with you.
The Vulnward product, at launch
| Subprocessor | Purpose | Location |
|---|---|---|
| Scaleway | Hosting, database, evidence storage | France (Paris) |
| Zitadel | Identity and authentication | EU region |
| Resend | Alert emails (no vulnerability details) and advisories to your customers (personal link only) | US company; sent from its EU region (Ireland) |
| AI model provider (Claude) | AI suggestions, never code, secrets or your customer list | Processing in the EU |
| eIDAS qualified timestamp provider | Timestamps on key moments: receives only a fingerprint, never the content | France (selection in progress) |
Isolation
Each organization is isolated at the database level (row-level security), on top of application checks.
Authentication
Two-factor authentication required for owners and administrators; enterprise SSO planned.
Evidence
Object-lock storage and a hash-chained audit log.
AI
AI suggests, your teams decide. Nothing is sent to an authority or to your customers without human action.
Your customer list
Pseudonymous mode available; names and contacts encrypted; never sent to AI or written to logs.
Advisories to your customers
The email only contains a personal link; vulnerability details stay behind that link, which expires.
This website, today
This website sets no cookies and contains no advertising trackers. The assessment form sends your answers by email to the founder and sends you an acknowledgement; they are not stored in a database.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of this website and form processing | Functions run in Paris; US company (EU-U.S. Data Privacy Framework) |
| Resend | Delivery of the form's emails | US company; sent from its EU region (Ireland) |
| Google (Gmail) | The founder's inbox | US company |
| Bunny Fonts | Web fonts, without cookies | Slovenia (EU) |
Our own SBOM will be published here with the first release of the Vulnward CLI.