What happens to your SBOM

The JSON file (CycloneDX or SPDX) is received by the server for the duration of a request. CRAFT extracts components from it: name, version, PURL if present, declared origin.

The content is not used to build a file path, a command, or an indexable page.

Public PURLs

Package identifiers from public ecosystems (npm, PyPI, Maven, crates, Go, etc.) are sent to api.osv.dev for vulnerability correlation.

Internal PURLs

PURLs of private hosts, intranets or non-public ecosystems are not transmitted.

Raw file

The complete SBOM is not sent to OSV, nor to Umami, nor to a marketing partner.

Today, the prototype does not persist the file: no database, no stored object, no archive copy. The SBOM is read in memory, analysed, then discarded at the end of the request.

The result is displayed in your browser. It is associated with a non-guessable, non-indexed URL, and disappears when the tab is closed. Sharing that URL does not transmit the result to another device.

Technical events (visit, upload, result, contact, campaigns) may be measured via Umami, without the SBOM content or nominative data. An anonymous browser identifier may be stored locally to count unique visitors. The IP address is used to rate-limit, in memory, for approximately one minute.

The host (Vercel) may retain infrastructure logs (request, status, duration) according to its own policy.

When CRAFT retains SBOMs for product follow-up (registry, evidence, monitoring), default retention will be limited, with announced automatic deletion: 30 days for as long as the product remains a prototype without a paying account. This page will be updated before any change, and a link will remain visible before upload.

You may choose not to upload a file and write to us instead. You may remove unnecessary fields (authors, emails, comments) before sending. You may generate a sample SBOM rather than that of a marketed product.

General policy: privacy. Terms: terms of use.