Privacy notice

Amendment of 26 October 2026: the paragraphs on the ordering page and on payment (section 5) name card payment with 3-D Secure, Apple Pay and Google Pay through Stripe as the only way to pay; the ordering form no longer keeps a purchase order number or a chosen way to pay. Amendment of 19 October 2026: section 6 (online appointment booking, now with a free choice of time, the page on which you move or cancel your appointment, and the calendar services used) and section 10 (Google Calendar and Google Meet, Apple iCloud). The terms and the data processing agreement are unchanged. Amendments in this version (11 October 2026): section 2 (when the language cookie is set, the country that selects the first language, the entries the ordering page keeps in your browser, Stripe’s cookies in the payment step) and section 5 (payment by card through Stripe, Apple Pay and Google Pay). Earlier amendments: sections 3, 4, 5, 8, 9, 10 and 11 were amended on 6 October 2026; section 10 was amended again on 7 October 2026 (notice on the use of the NVD API). 1. Controller and roles Neithra Technologies – Fabian Lorenz (sole proprietorship), Thaler Weg 2a, 51647 Gummersbach, Germany — [email protected]; phone: +49 2266 4889976 (Germany), +1 332 287 9966 (USA). Data-protection enquiries: [email protected]. We act in two roles. As controller we process the data needed to run this website, your account, orders and invoices, conversation requests and terminations (sections 2, 3, 5, 6, 7, 9 and 14). As processor, under the data processing agreement, we store the content your organisation puts in the workspace on your organisation’s instructions only (sections 3, 4 and 8). 2. Visiting this website, cookies Every request to this site reaches our server through the network of Cloudflare, Inc. (Cloudflare Tunnel), which also operates our DNS. Cloudflare and the hosting provider (netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data centre Nuremberg, Germany)) process the technical data your browser transmits (IP address, time, requested page, user agent) to deliver the page and to keep the service secure (Art. 6(1)(f) GDPR). Server logs are kept for no longer than 30 days. This site loads no advertising scripts and uses no cross-site tracking; visits are measured without cookies as described in section 14. Its fonts are delivered from our own server, so no third-party font service is contacted. We set two cookies, and only where you trigger them: • Language (“attesly-lang”) — set when you choose a language: with the language links at the bottom of the page, by opening the home page with a language in its address (/?lang=…) or with the language switch in your account (plan-ordering area, setup assistant and workspace overview). It is also set when you sign up or log in, and then records the language of the page on which you did so. A click on a plan button sets no cookie; the language of the order is carried in the address. The cookie stores the language code (en, de, fr or it) so that the site keeps showing that language, and expires after one year. A page with a language in its address (for example /de/pricing) is always shown in that language. Other pages use the language stored in this cookie; without it they follow the country your request comes from (German for Germany, Austria, Switzerland and Liechtenstein; French for France and Monaco; Italian for Italy, San Marino and Vatican City), then your browser’s language setting, and are otherwise shown in English. The country is supplied with the request by Cloudflare, which derives it from your IP address; we use only the two-letter country code and do not store your IP address for this purpose. The legal pages exist in English only. • Session (“stavor_session”) — set when you log in. It holds a random identifier that keeps you signed in, cannot be read by scripts on the page, is removed when you log out and expires after 30 days at the latest. Both cookies are strictly necessary to provide the function you asked for (Section 25(2) no. 2 TDDDG); they are not used for tracking and need no consent. The processing of the data they carry is based on Art. 6(1)(b) GDPR for the session and Art. 6(1)(f) GDPR for the language choice. On the ordering page, the company details you type (company name, billing address, VAT identification number, billing email) are kept in your browser’s session storage for that tab, so that a reload does not empty the form. This entry is not a cookie, is never sent to us or to anyone else, is removed when the order is completed and disappears when you close the tab; your confirmations and card details are never stored in it. After a card payment, a second entry in the same storage notes that the confirmation of that order has been shown in this tab, so that the page opens it only once; it holds the order reference, no personal details, and disappears when you close the tab. Both entries are strictly necessary for the function you are using (Section 25(2) no. 2 TDDDG). If you pay by card, Stripe sets its own cookies and similar entries in your browser to process the payment and to prevent fraud. They are set only in the payment step – in Stripe’s payment form on the ordering page or on Stripe’s own payment page – and only after you have continued to that step; they are strictly necessary for the payment you asked for (Section 25(2) no. 2 TDDDG). Our public forms (the request for a conversation, the termination form and the vulnerability intake) are protected against automated submissions without third-party services and without cookies: your browser solves a small computation when you submit, the form contains an invisible field, and the time between showing and submitting the form is checked. For the request for a conversation we also keep time-limited counters keyed by a hash of your IP address and of the email address you enter. A termination is never refused or discarded because of these checks, and it also works without JavaScript; if a check looks automated, this is only noted on it for our review (Art. 6(1)(f) GDPR, our legitimate interest being to keep the forms usable and free of abuse). 3. Creating and using a workspace As controller we process the account data needed to run your workspace: your name, work email, password hash and organisation details, and the session cookie described in section 2. We send the emails an account needs — confirmation of your email address and password reset links — through our email provider (section 9). The legal basis is Art. 6(1)(b) GDPR for the contracting organisation and Art. 6(1)(f) GDPR for individual team members invited to the workspace, our legitimate interest being to provide the service your organisation has ordered. As processor, under the data processing agreement, we store the content your organisation puts in the workspace — products, software bills of materials, vulnerability findings, cases, documents and the activity log — on your organisation’s instructions only. Names of team members appear in the activity log so that your organisation can prove who did what; your organisation is the controller for that record. Members can switch on email reminders for due Article 14 case steps; these reminders go only to the member who switched them on. Unless an owner or administrator switches them off in the settings, alert emails go to the security contact your organisation has recorded and to its owners and administrators: when a vulnerability report arrives, when the vulnerability check finds a new finding rated critical, when an Article 14 case is opened, and when a step of such a case comes due or is overdue. These emails name the product, the title and the dates concerned; they do not contain the name or address of a person who reported a vulnerability. A workspace role (owner, administrator, member, reviewer or reader) is stored for every member. 4. Vulnerability reports from third parties The public intake page lets security researchers report vulnerabilities to a workspace. Name, email and organisation are optional. The workspace owner is the controller for these reports and must link its reviewed privacy notice before enabling the form; only products separately approved for public listing appear there; we store the reports on its behalf as processor. Attesly sends no email to the person who reported; the workspace's team answers from its own mailbox. An owner or administrator of the workspace can erase the name, email address and organisation of a reporter from a single report on that person's request; the technical content of the report remains part of the workspace's vulnerability record. 5. Orders, invoices and payment Attesly is sold to businesses only. The catalogue plans are ordered online in the plan-ordering area of an account; individual services beyond the catalogue are agreed by a separate written offer. When a plan is ordered we process the company name, billing address, VAT identification number and billing email, together with the plan, the billing interval, the order reference, the person who placed the order and the version of the terms that was accepted (Art. 6(1)(b) GDPR). Invoices and the records needed for them are kept for the statutory retention periods (Art. 6(1)(c) GDPR; Section 147 AO, Section 257 HGB). Every organisation, wherever it is established, pays through Stripe by credit card with 3-D Secure, Apple Pay or Google Pay, in euros, pounds sterling or US dollars depending on its country. Our central Neithra billing workflow processes the order, the invoices issued for each payment as receipts and verified payment allocation. Stripe Payments Europe, Limited, Ireland, and the relevant Stripe payment entity process the billing and payment information needed to provide invoices as receipts, card payments including strong customer authentication (3-D Secure), fraud prevention and payment status under their applicable data protection terms. The payment form is provided by Stripe and appears only after you have continued to the payment step: embedded in our ordering page, for which your browser loads it from Stripe’s servers (js.stripe.com), or on Stripe’s own payment page, to which you are then redirected. You enter your card details directly into Stripe’s form; they do not reach our servers. To show the form, to authenticate the payment and to prevent fraud, Stripe receives your IP address and information about your browser and device, and its form may load further services Stripe uses for this purpose (for example hCaptcha and, for Google Pay, Google). If you pay with Apple Pay or Google Pay, Apple or Google processes your payment data under its own terms; we receive no card data in that case either. Stripe checks the VAT identification number of a company in another EU member state against the EU VIES system. The legal basis is Art. 6(1)(b) GDPR and, for fraud prevention, Art. 6(1)(f) GDPR. We also use Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany, for bookkeeping under a data processing agreement. The payment providers, accounting provider and banks do not receive your workspace product records for this purpose. Payment and billing processing is based on Art. 6(1)(b) and (c) GDPR. Card details are collected and processed by Stripe only; Attesly neither receives nor stores card numbers. 6. Requests for a conversation (/talk) Online appointment booking (video call) When you book a call on this site, we process the details from the form (name, company, email address, optionally phone number and your message), the chosen time, your time zone and the page language, and, where you came from a plan, that plan’s name, solely to arrange and hold this call. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future. No appointment is created merely by viewing the page. Attesly is offered by Neithra Technologies – Fabian Lorenz; the controller is the provider named in the legal notice. All products share one appointment calendar on our own servers in Germany so that no time is booked twice. For the invitation and the video link we use Google Calendar and Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; Google receives your name, email address and the appointment. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). For our own scheduling we also copy the appointment with your name and company to the owner’s Apple iCloud calendar (Apple Distribution International Ltd., Ireland). Confirmation and reminder emails are sent via our email service provider (section 10). You can reschedule or cancel the appointment yourself at any time using the link in the confirmation; it leads to a page on this site (/termin/verwalten/…) that shows only the time, the status and the video link of your appointment. We automatically delete your details 180 days after the appointment; only a record without personal data remains. The booking does not subscribe you to any marketing. Written enquiries The written contact form at /talk lets you send an enquiry separately from booking a released appointment. We process your name, company, business email, optional phone, optional product count, message and page language to answer your enquiry and prepare a possible conversation (Art. 6(1)(b) GDPR, steps prior to a contract at your request). Our own central Neithra contact service records the enquiry before Attesly confirms receipt. A stored receipt does not itself mean an email has been delivered. Contact enquiries are deleted after handling and at the latest twelve months after the last contact unless a contract or documented legal retention duty requires relevant evidence to be retained. Product help and customer support Product-help questions are processed to answer your request. Local product-help questions are not stored as a conversation in the workspace support database; optional central AI conversation retention is described below. To prevent abuse we keep time-limited counters with keyed, hashed client identifiers when a trusted proxy is configured, otherwise a shared counter. A signed-in customer can explicitly save a support case. We then store its subject, messages, case reference, status, workspace and author references to provide and document support (Art. 6(1)(b) GDPR). Workspace members can see their workspace’s cases. The stable customer number is an administrative reference, not an access credential. Cases remain available during an archive/export period and follow the workspace retention and reviewed erasure process in section 11. Account-only deletion removes account links; message text is separately reviewed for personal data and applicable retention grounds. Automatic support uses local product guidance unless the optional central service is enabled and you explicitly tick the AI option for your question. With that consent, the question and up to three preceding question-and-answer pairs from the current support conversation, language, page market and currency, a fresh request identifier and the technical environment are sent through our own Neithra Technologies support service to our AI service providers: Anthropic for answers, with OpenAI as a technical fallback. AI consent covers both recipients; processing outside the EU, including the USA, is possible. Pseudonymous identifiers bind follow-up questions to a limited conversation context in Neithra. Limited central bot cases are cleaned up after 30 days without activity during regular operation. Separately submitted contact emails follow their own retention periods. Processing outside the EU, including in the United States, is possible. The legal basis is consent (Art. 6(1)(a) GDPR); leave the AI option unticked to withdraw consent for future questions and use local guidance. With the separately enabled account-assistance option, an authenticated workspace owner or administrator may additionally consent to sharing the stored plan and access status, available provider payment verification status and check times. A fresh read of the local access status is not a fresh payment verification. Missing or old provider evidence remains unknown. Account binding is checked on the server and only pseudonymous account and caller references reach the central service; model providers receive the limited facts without email addresses or raw account/payment identifiers. Invoice files and product records are not attached. Customer product records, customer numbers, case histories and files are not automatically attached. A saved case does not trigger automatic email delivery or a guaranteed response time. The provider agreements and applicable international-transfer safeguards must be verified before activating this optional service. 7. Terminating a subscription (/cancel) The form at /cancel is reachable without logging in. We process your name, email, the workspace or invoice reference if given, the type of termination and the reason if given, in order to receive the termination and confirm it to you (Art. 6(1)(b) GDPR). We store your declaration, its reference, receipt time and processing status in our database before attempting to send email. We attempt to send a receipt to the address you enter and a notification to our office inbox through our email provider (section 9), and record whether the provider accepted them. A mail failure does not erase your declaration. We keep the termination declaration, its confirmation and our copy as business correspondence for six years from the end of the calendar year in which the declaration was received, unless a longer statutory retention obligation applies (for example Section 147 AO, Section 257 HGB), to be able to prove the termination and its date; they are then deleted or anonymised (Art. 6(1)(c) and (f) GDPR). 8. AI-assisted drafts When a member requests an AI-expanded draft, the application sends the record of the selected product — name, version, classification, markets, support period, SBOM summary, requirement statuses and the free-text fields you have filled in (description, intended purpose, classification rationale, evidence and notes) — together with your organisation’s identity, address, website, security contact, recorded authorised representative and coordinating Member State. Where recorded, the context also includes conformity and certification facts, manufacturer and supplier identities and contact details, customer-operator contacts, and the approved disclosure-policy text. These structured fields can contain personal data. This context is sent to Anthropic, PBC (USA) to generate the text. The application does not load vulnerability reports, reporter records or team-member profiles for this purpose. Personal data entered into product, organisation, policy or free-text fields can nevertheless travel with the draft; review and minimise these inputs before requesting AI assistance. Drafts can also be generated from templates without any transfer. Anthropic processes API data under its Commercial Terms and Data Processing Addendum; under those terms API inputs and outputs are not used to train models. The applicable Anthropic terms and the transfer mechanism are referenced in the data processing agreement. Column help for component lists Where this optional function is offered and an owner or administrator of the workspace has allowed it in the settings, a component list whose columns the fixed rules do not recognise is prepared for a suggestion: the headings of the columns that were not recognised and at most five example rows of those columns, in which recognisable email addresses, telephone numbers and web addresses are replaced by placeholders beforehand (a name or an unusually written number in a cell can remain), are sent through our own central Neithra Technologies service to Google Gemini (Google Ireland Limited, Ireland, and Google LLC, USA). The answer only suggests which heading stands for which column; a person confirms it before anything is imported, and the components themselves are then read by Attesly’s fixed rules. Nothing is sent without that permission, and the columns can always be assigned by hand instead. The permission can be withdrawn in the settings at any time. Processing outside the EU, including in the United States, is possible. As processor we act on the administrator’s permission as your organisation’s documented instruction. 9. Emails we send We send emails through Plus Five Five, Inc. (Resend) (USA), from its EU sending region in Ireland. They are: confirmation of your email address, password reset links, the notice that a workspace has been opened after payment, the Article 14 case reminders a member has switched on, the alert emails to the security contact, owners and administrators of a workspace (section 3), invitations to a workspace, the confirmation of a termination (section 7) and, to our own office inbox, the notification about a conversation request (section 6) and the copy of a termination. Resend processes the recipient and sender address, the subject, the content and delivery information. The content of an account email or reminder is held encrypted in our outbox until Resend has accepted it and is then deleted from the outbox. Resend reports back to us whether an email was delivered, was refused by the recipient’s mail server or was marked as spam; we store that report under Resend’s identifier of the email, without the address and without the content, so that an email that did not arrive is visible to the workspace instead of being lost. We send no newsletters or marketing emails. A workspace invitation is emailed to the address the inviting administrator enters; the link in it is valid for seven days and can also be passed on by that administrator directly. 10. Recipients and international transfers • netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data centre Nuremberg, Germany) — hosting of the server that runs the application, its database and backups; region EU (Germany). Processor under our data processing agreement with the provider. • Cloudflare, Inc., San Francisco, USA — DNS and Cloudflare Tunnel: every request to this site passes through Cloudflare’s network, which terminates the encrypted connection and forwards the request to our server (section 2). Processor; transfer mechanism: the EU standard contractual clauses, as incorporated in Cloudflare’s Data Processing Addendum. • Plus Five Five, Inc. (Resend), San Francisco, USA — delivery of the emails listed in section 9, sent from Resend’s region in Ireland. Processor; transfer mechanism: the EU standard contractual clauses. • Anthropic, PBC, San Francisco, USA — generation of AI-expanded drafts, only when a member requests one (section 8). Processor; transfer mechanism: the EU standard contractual clauses, Module Three (processor to processor), as incorporated in Anthropic’s Data Processing Addendum. • Google Ireland Limited, Dublin, Ireland, and Google LLC, USA (Gemini) — column help for component lists, only where it is offered and an owner or administrator has allowed it (section 8). Receives the headings of unrecognised columns and at most five example rows of them. Transfer mechanism: Google’s data processing terms with the EU standard contractual clauses; Google LLC is certified under the EU–US Data Privacy Framework. • Google Ireland Limited, Dublin, Ireland (Google Calendar and Google Meet) — invitation and video link of a booked call (section 6). Receives your name, email address and the appointment. Processor; a transfer to Google LLC, USA, is possible, which is certified under the EU-US Data Privacy Framework. • Apple Distribution International Ltd., Cork, Ireland (iCloud) — the owner’s own calendar, to which a booked call is copied with your name and company (section 6). • OSV.dev (Google LLC), USA — vulnerability matching of uploaded SBOM components. Receives only package identifiers (name, ecosystem, version or package URL), no personal data. • National Vulnerability Database (National Institute of Standards and Technology, NIST), USA — vulnerability matching of components that carry a CPE name instead of a package URL. Receives only the CPE name (vendor, product and version of the component), no personal data. This product uses the NVD API but is not endorsed or certified by the NVD. The current list of sub-processors, with the transfer mechanism for each, is part of the data processing agreement. 11. Retention and deletion Workspace content is kept during the service and for a 60-day export window afterwards unless the customer instructs earlier deletion. Erasure is an operator-reviewed process, not the effect of clicking Archive or Deactivate. We verify instructions and ordinarily carry them out within 30 days, subject to the applicable legal deadlines and specifically documented exceptions. At the end of the export window we review and delete remaining content within a further 30 days unless a documented lawful basis requires retention. Deleted records must also expire from backups under the agreed backup retention schedule; any restoration must reapply the erasure record before service resumes. Login sessions expire after 30 days; unaccepted invitations expire after 7 days. Invoices are generally retained for eight years under § 14b UStG; other accounting and correspondence records follow the statutory period for their category and applicable exceptions. Retained evidence is limited to what is required, restricted to that purpose and reviewed for expiry. Requests for a conversation and termination declarations follow sections 6 and 7. During the service a product is archived rather than deleted, so that the records the Cyber Resilience Act expects to be kept for ten years remain available to your organisation; an archived product is erased together with the workspace as described above. The activity log of a workspace is append-only: an entry cannot be changed or removed while the workspace exists, with one exception — an entry that quotes the personal data of a person who reported a vulnerability is replaced by a redaction note when that data is erased (section 4). If a login has already been deactivated, an authorised customer can request an operator-assisted export through the contact in the legal notice during the export window. Identity and authority are verified before any data is released. 12. Your rights You have the right of access, rectification, erasure, restriction, data portability and objection under Art. 15–21 GDPR, and the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Where processing is based on Art. 6(1)(f) GDPR you may object to it on grounds relating to your particular situation (Art. 21 GDPR). For data in a customer’s workspace, please contact that customer first; we assist them as their processor. 12a. International privacy rights Additional international rights: applicable US state law may give you rights to access, correction, deletion and a portable copy, and rights concerning sale, targeted advertising or certain profiling. Applicability depends on the law, its thresholds and the processing concerned; business contact data is not automatically excluded in California. We do not sell personal data or use it for cross-context behavioural advertising. Browser Do Not Track signals do not change the necessary processing described here; our service does not use cross-site advertising tracking. This is distinct from legally recognised opt-out preference signals such as Global Privacy Control. Send a rights request to the contact in this notice or the legal notice, without needing a paid account. An authorised agent may act with evidence of authority. We verify identity proportionately to the request, normally through the known account or contact address; we request additional evidence only where necessary and do not disclose another person’s data. We explain any refusal and applicable exceptions. You may request a review by replying to that decision; we handle requests and any statutory appeal within the applicable legal deadlines and explain any permitted extension. We do not discriminate for exercising privacy rights. Where UK GDPR or Swiss data protection law applies, their rights and safeguards also remain available; you may contact the UK Information Commissioner (ico.org.uk) or the Swiss FDPIC (edoeb.admin.ch), respectively. For data controlled by a customer, we forward or assist with the request as its processor. Changes to these practices are shown with the updated date of this notice; material changes affecting existing accounts are also communicated through the account or contact address before they take effect, with consent where required. If Canadian privacy law applies, you may also use the same contact to request access or correction, withdraw consent where applicable or complain about our handling; you may contact the competent federal or provincial privacy authority (priv.gc.ca). A professional email address alone does not exclude all related account or usage data from protection. 13. No automated decisions The service computes deadlines and readiness scores from the data you enter. It makes no decisions with legal effect about natural persons. 14. Audience measurement (Umami) We measure how this website is used with the open-source software Umami, which we operate ourselves on a server of netcup GmbH in Germany. Umami sets no cookies and stores no identifier on your device. Your IP address is used only briefly to determine your approximate location (country, region, city) and to form a daily rotating identifier that cannot be traced back to you; it is not stored. We store the pages viewed, referring page, browser, operating system, device type, language, approximate location and events such as opening the checkout or submitting a form. Data is transmitted via Cloudflare, which we use to deliver our websites. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR). Data is deleted after 24 months. If your browser sends “Do Not Track” or “Global Privacy Control”, no measurement takes place. Service name: Attesly.