When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Encryption

Narrative case fields (PEC rationale, free-text descriptions) are encrypted at rest with AES-GCM, under a per-org data key.

Audit chain

Every state change on a case, including every field edit, every stage transition and every submission, appends to a hash-chained, append-only audit log. Every case exposes an endpoint to verify its own chain.

Hosting

The application, Postgres, and a reverse proxy run on a Hetzner Cloud server in Germany. Nightly encrypted database backups go to Cloudflare R2, in a bucket with EU jurisdiction.

The application and database are hosted in the EU.

Subprocessors

Transactional email is sent by Resend, from its Ireland region. Resend stores email metadata, logs, and API records in the United States, so Resend is listed here as a US subprocessor.

Reporting a vulnerability

Email security@craclock.com. There’s no bug bounty yet, but every report is read, and responsible disclosure is credited.