Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Privacy policy

Last updated 15 November 2026

Who we are

Securissima, Kenmare, Ireland, operates Provetry and is the controller of the personal data described here, except where we act for a customer as its processor (see “Data we process for our customers”). Contact: hello@provetry.com.

This website

This site sets no cookies and uses no trackers. The free CRA check and the free tools (such as the SBOM generator and the CVSS calculator) run in your browser: what you enter or the files you choose are not sent to us. The EPSS tool asks FIRST's public service for the scores of the identifiers you enter, from your browser. If visit statistics are enabled, they are cookieless and anonymous (Umami), and store no IP address.

What we collect in the application

  • Account data: e-mail address, name, password hash, optional second-factor secret, language, and the workspaces you belong to with your role. If you add passkeys: their public keys, the names you give them and when they were last used (the private key never leaves your device). Legal basis: performance of the contract.
  • Workspace data: the products you describe (name, kind, your role as manufacturer, importer or distributor, class, dates, support period, supplier, notes), their releases and the SBOMs built from your files (component names, versions, package identifiers, licences and hashes), the vulnerability findings, your decisions about them (VEX) with who made them and when, reporting cases and drills, the answers to the readiness check, the technical documentation and disclosure policy you write, correction targets, and the evidence journal. Notes, documents, the SBOMs and your decisions' justifications are stored encrypted. The files you upload are read and then erased; they are never kept. Mostly not personal data; where it identifies a person (for example a name in a note or a document), legal basis: performance of the contract.
  • Members and invitations: the e-mail addresses you invite, with the role given, until the invitation is accepted or expires (7 days). Legal basis: performance of the contract.
  • API keys: a hash of each key (never the key itself), its name, its scope and when it was last used. Legal basis: performance of the contract.
  • Alert channels: the e-mail addresses that receive the alerts of a workspace and, when you add one, the address of a Slack or Microsoft Teams webhook, stored encrypted. When alerts are posted there, our server sends the product name and versions, the components concerned with their versions, the vulnerability identifiers, their severity and the fixed versions, the title of reporting cases and drills for their deadline reminders, and a link to the application. Slack (Salesforce) and Microsoft are then your own providers. The webhook address is deleted with the channel or the workspace. Legal basis: performance of the contract.
  • Imports from GitHub: when you import a release from a GitHub repository, our server asks GitHub, Inc. (United States) for the lock files of that repository, on your behalf. A token you give for a private repository is used for those requests only: it is neither stored nor logged. The address of the repository and the commit are recorded in the evidence journal with the release. Legal basis: performance of the contract.
  • Ticket trackers, on the Pro and Consultant plans, when you connect one: the repository, Jira site and project or Linear team, and the token (with, for Jira, the e-mail address of its account), stored encrypted and used only to open, comment and close tickets in your own tool. Each ticket carries the product name, the component and its version, the vulnerability identifier, its severity, its public summary and the fixed versions; the code host, Atlassian (Jira) and Linear are then your own providers. Removing the tracker deletes the token at once. Legal basis: performance of the contract.
  • Questionnaires received: the questions you paste, the answers proposed and the ones you write, the name of the questionnaire, its due date and language, and the answers you keep in your library, all encrypted. Nothing is sent to whoever asked. Kept until you delete them, and deleted with the workspace. Legal basis: performance of the contract.
  • Security packs and public pages, when you share them: what you chose to show (products, documents, the SBOM if you allow it), the link (stored encrypted, with a hash to recognise it), its expiry, and the number of views with the date of the last one; no information about the visitors. Legal basis: performance of the contract.
  • Your logo, on the Consultant plan, when you add one for your reports. Legal basis: performance of the contract.
  • Evidence journal: dated entries of what happened in your workspace (releases, decisions, reports, with who did it). To prove their date, a fingerprint of the journal (a hash, which reveals nothing of its content) is sent to an independent time-stamping authority (FreeTSA), whose answer is kept with the journal. Legal basis: performance of the contract.
  • Account activity log: who did what in the workspace and when (sign-ins, changes, exports), kept 12 months (the record of a confirmed subscription longer, for accounting). Shown in the application on the Pro and Consultant plans, and recorded on every plan. Legal basis: our legitimate interest, and yours, in the security of the account.
  • Audits and reviews: when you order a CRA readiness audit or use the Reviewed reports add-on, the certified security professional who reviews the report reads what your workspace holds for the product or the case concerned, under a duty of confidentiality. We keep the order (product, amount, invoice reference, status). Legal basis: performance of the contract.
  • Payment data: handled by our payment provider; we receive a customer reference, the type and last four digits of the card or account, the billing name and address and the VAT number for invoicing. Legal basis: performance of the contract and our legal obligations (accounting and tax).
  • Usage data: our servers keep technical logs (IP address, time, requested page, status) for security and troubleshooting, for at most 30 days. Sign-in attempts and other sensitive actions are counted by e-mail address and by a shortened hash of your IP address, for 2 days, to stop password guessing and abuse. Each sign-in session records the browser used and that hash, until it ends. Legal basis: our legitimate interest in keeping the service secure.

Free SBOM alerts

If you ask for free e-mail alerts on an SBOM without an account, we keep your e-mail address, the name you give the list and the list of components (names, versions, package identifiers), encrypted, to check them every week and write to you; your address is also kept as a keyed hash, to limit the number of lists. Nothing is checked or sent before you confirm the address. The list is erased after 3 days without confirmation, after 12 months unless you keep it (an e-mail reminds you two weeks before), or at once from the link in every e-mail. The legal basis is your consent, which you can withdraw at any time with that link. What was already reported to you is kept only as keyed hashes. To limit abuse, a keyed hash of your address and of your network is kept for 2 days. The e-mails are sent through our e-mail provider.

Public vulnerability sources

To check your components, our servers send their package identifiers to OSV.dev (Google) and, on the Pro and Consultant plans, the names of the components to endoflife.date for their end of support; they send the identifiers of the vulnerabilities found to FIRST for their EPSS scores; and they download the public lists of CISA (Known Exploited Vulnerabilities) and ENISA (European Vulnerability Database). Never your name, your products or anything about you. Answers about public packages are cached for up to 31 days, without any link to you.

If you write to us

We use your e-mail address and message only to answer you and, if you asked for early access, to tell you when Provetry opens. Messages sent to hello@ or security@provetry.com, and our replies, are kept encrypted for two years at most (30 days once deleted), then erased. Attachments you send are not kept on our servers: only their names and sizes are listed with the message; a copy of each message received, attachments included, is forwarded to our own mailbox. Cloudflare (Email Routing) receives these messages for us, as our processor. If we block a sender, their address is kept, encrypted, to filter their later messages. Legal basis: our legitimate interest in answering and following up our correspondence.

Data we process for our customers

A workspace may hold personal data of people other than its members, for example names in documents, the contacts in an imported questionnaire, or the authors of the code it describes. We process that data on the customer's behalf, as its processor, under a data processing agreement available on request; the customer decides what it puts in and is responsible for having a lawful basis.

What we do not do

We do not sell personal data, do not use it for advertising, do not use your data to train any model, and do not share it with anyone other than the sub-processors needed to run the service.

Where it is stored

In the Netherlands, in the European Union, on encrypted storage, with encrypted daily backups kept in the EU. Cloudflare (United States, with EU data processing terms) handles DNS, TLS termination, the web application firewall and the reception of messages sent to our addresses. Our e-mail provider sends the e-mails of the service. Our payment provider processes payment data under its own privacy policy.

How long we keep it

Account and workspace data for as long as the account or the workspace exists; a deleted workspace is erased 90 days later, with its products, SBOMs, findings, documents and cases, and its customer record at the payment provider is deleted too. Releases are kept within the limits of your plan, until you delete them. The results of each daily check 13 months (the last one of each release as long as the release exists). Alert history 6 months. Account activity log 12 months. Sign-in sessions 30 days at most, remembered second-factor devices a year, confirmation and invitation links a day after they expire, sign-in attempt counters 2 days, passkey challenges an hour after they expire, the “Undo” of a decision an hour. Free SBOM alerts as described above. Messages sent to us and our replies 2 years (30 days once deleted). Invoices for the period required by tax law. Server logs at most 30 days.

Cookies

The marketing site sets no cookies. The application sets a session cookie, strictly necessary (30 days at most), a cookie to remember a second-factor device if you ask it to (one year), a cookie for the language you choose (one year), a cookie that hides the getting-started steps once you close them (one year), and, if you choose them, cookies that remember your theme and display density and when you last opened the list of recent events (one year). The payment form, provided by our payment provider, may set its own cookies to prevent fraud. None of them is used to track you.

Your rights

You may access, correct, export and delete your data from your account at any time, and you may ask us to do so by writing to hello@provetry.com. You may object to processing based on legitimate interest, and withdraw your consent where it is the legal basis. You may complain to your national data protection authority; ours is the Data Protection Commission in Ireland.

Changes

We will post changes here and, for material changes, e-mail account holders in advance.