Security & Compliance

This page answers what a security or procurement review usually asks, plainly, including where there isn't yet an answer to give.

Jurisdiction

During the beta, Vault42 is operated by a sole trader registered in the Czech Republic, with no US parent company. We plan to transfer it to a Czech limited company as it grows. The infrastructure that hosts your repositories sits entirely within the EU, so the US CLOUD Act and similar extraterritorial legal demands give no US authority a way to compel us to hand over your code. A small number of sub-processors work for us outside the hosting layer (payment processing, for example); none of them can access your repositories, and they are listed on our sub-processor page.

Two US laws are usually raised in procurement reviews. The CLOUD Act lets US law enforcement require a US provider to disclose data it holds, wherever that data is stored. Section 702 of the Foreign Intelligence Surveillance Act (FISA) lets US intelligence agencies require the same providers to assist with surveillance of non-US persons, without an individual warrant and without notifying the customer. Both apply because of who controls the provider, wherever the servers are located. Vault42 will have no US entity, and the servers hosting your repositories will sit entirely within the EU, so neither law gives a US authority a way to compel us to hand over your code.

Infrastructure

Vault42 will run on Scaleway, a European infrastructure provider, across data centres in Paris, Amsterdam, Warsaw and Milan. The servers that store and serve your repositories are owned, operated and governed entirely within the EU, and your code is stored and processed only on EU infrastructure.

Backups and recovery

Backups will run daily and be kept for 30 days. Every backup will be replicated to a second EU region, and the restore procedure will be documented and tested regularly, not only written down.

Data protection

A Data Processing Agreement is available on request, and we publish a sub-processor list.

Certifications

Vault42 holds no third-party security certifications at this time, such as ISO 27001 or SOC 2. This page will be updated if that changes.

Data protection officer

Vault42 does not currently process data at a scale or of a kind that requires a Data Protection Officer under GDPR Article 37. For data protection questions, contact privacy@vault42.eu directly.

Contact

Email privacy@vault42.eu.