Information for Financial Entities — DORA¶
MazeVault's position under Regulation (EU) 2022/2554 (DORA) and materials for fulfilling the financial entity's obligations towards an ICT service provider
Version: 1.0.0
Classification: Confidential
Owner: Managing Director, MAZEVAULT s.r.o.
Last Updated: 2026-05-01
Review Cycle: Annual and upon any change to the contractual documentation or legal framework
Service provision model and allocation of responsibility
MazeVault is provided as licensed software operated at the Customer (on-premises or in the Customer's own cloud tenant), not as a hosted service.
- The Provider (MAZEVAULT s.r.o.) develops the Product, releases updates and security patches, and provides upstream product support to the Partner. It does not operate the financial entity's infrastructure, does not host the Product or data, and by default has no access to the Customer's environment or data (License Terms Art. VII; DPA Art. 2.3).
- The Partner is a non-exclusive reseller and the Customer's sole contractual contact for technical support; both the SLA and the DPA are concluded with the Partner (SLA Art. 1.2, 3.1).
- The Customer operates the Product in its own infrastructure and manages access, encryption keys, backups and recovery (License Terms Art. IV, VII).
The Provider does not guarantee the availability of the Application as a whole, infrastructure availability, RTO, RPO or data recovery (SLA Art. 1.3; License Terms Art. IX). Such a commitment towards the Customer may be assumed only by the infrastructure operator under a separate contract.
| Area | Provider | Partner | Customer |
|---|---|---|---|
| Hosting and infrastructure | No | If acting as operator | Yes |
| Availability, RTO/RPO, backups, DR | Not guaranteed | Per its own contract with the Customer | Yes |
| Access to Customer data | No standard access; diagnostics only on a documented instruction (DPA 2.3) | Per the scope of support/operation | Full control |
| Updates and patches | Releases | Assists with deployment | Deploys within the time limits under License Terms Art. V |
| Incident / vulnerability notification | → to the Partner; directly to the Customer only under DPA 2.3 | → to the Customer | → to the competent authority |
1. MazeVault's Position under DORA¶
| Question | Answer |
|---|---|
| Is MazeVault a financial entity? | No. |
| Is MazeVault an ICT third-party service provider (Art. 3 point 19)? | Yes — it provides the financial entity with software and its ongoing maintenance (updates, security patches, upstream support). |
| Type of ICT service for the register of information | Software licensing (without SaaS) — the software is deployed and operated in the Customer's environment. Additionally, maintenance/upstream support of the Product. The exact classification according to the taxonomy of the implementing regulation on the register of information is performed by the financial entity. |
| Is MazeVault designated as a critical provider (CTPP, Art. 31)? | No. |
| Does the service support a critical or important function (Art. 3 point 22)? | Assessed exclusively by the financial entity. Given the nature of the Product (management of keys, certificates and secrets), it is likely that it does — see Section 4. |
| Where is the financial entity's data processed and stored? | Exclusively in infrastructure operated by the Customer (on-premise or own cloud tenant), at a location of the Customer's choice. The Provider does not host the data. |
| What data does the Provider process? | Only technical license server metadata (installation identifier, license status, version, timestamps, license administrator contact e-mail) and, where applicable, diagnostic data made available during upstream escalation (DPA Art. 2.3–2.4). Details: Personal Data Protection. |
2. Data for the Register of Information (Art. 28 para. 3)¶
The financial entity maintains a register of information on all contractual arrangements with ICT service providers. The Provider supplies the following data for this purpose:
| Item | Data |
|---|---|
| Provider name | MAZEVAULT s.r.o. |
| Identifier | Company ID (IČO) 24517194; registered with the Municipal Court in Prague, file no. C 441375; EUID / LEI on request |
| Registered office / country | Kubelíkova 1258/43, Žižkov, 130 00 Praha 3, Czech Republic |
| Provider type | Independent software vendor (not part of the financial entity's group) |
| Financial entity's contractual counterparty | License: directly the Provider (by acceptance of the License Terms). Order, SLA, DPA: the Partner. |
| Type of ICT service | Software licensing (without SaaS); maintenance and security patches; upstream support to the Partner |
| Country of service provision | Czech Republic (development, release of updates, upstream support) |
| Country of processing / storage of the financial entity's data | According to the Customer's infrastructure — the Provider does not store the data |
| Subcontractors supporting the service | See Subprocessor and Supplier List: license server hosting (EU), source code and build management platform, the Provider's external development suppliers bound by contract and confidentiality |
| Dependency of Product operation on the Provider | The Product verifies the license against the Provider's license server (daily). If the license server is unavailable, the Product continues to operate on the last verified license status. After the subscription expires, a 14-day grace period applies. |
| Duration and termination | According to the Order and License Terms Art. X (subscription with automatic renewal; non-renewal by notice 30 days before the end of the period; termination for material breach after an unsuccessful 30-day cure period) |
| Substitutability | Assessed by the financial entity. Data (certificates, keys, secrets, audit logs) are located in the Customer's infrastructure and are exportable in standard formats (PEM, PKCS#12, JSON). |
3. Contractual Provisions under Art. 30 para. 2 — Where They Are Addressed¶
| Requirement of Art. 30 para. 2 | Contractual document |
|---|---|
| (a) Clear and complete description of functions and services | License Terms Art. I–II; List of Required Software (components of the Application, supported configurations); Order (license variant) |
| (b) Locations of service provision and data processing | Service provided from the Czech Republic; data in the Customer's infrastructure (License Terms Art. IV, VII); sub-processors in DPA Annex C and the Subprocessor List |
| (c) Availability, authenticity, integrity and confidentiality of data | License Terms Art. VII (Customer control of keys, backups), Art. VIII (confidentiality); DPA Annex B (technical and organisational measures); infrastructure availability is ensured by the operator (SLA Art. 1.3) |
| (d) Access to data, its recovery and return upon termination | Data are permanently at the Customer's disposal (License Terms Art. VII); termination procedure Art. X; erasure of data processed by the Partner/Provider DPA Art. 11 |
| (e) Description of service levels | SLA (Annex 1a): support levels according to license variant, P1–P4 classification, response times of the Partner and the Provider, target patch release deadlines. Availability and service credits are not agreed (SLA Art. 1.3, 12.3). |
| (f) Assistance in the event of an ICT incident at no additional cost | The Provider's upstream support and security process are part of the License (SLA Art. 8, 10); work beyond a Product defect may be chargeable (SLA Art. 8.3) |
| (g) Cooperation with competent authorities | Not expressly addressed — see Section 4 (addendum) |
| (h) Termination rights and minimum notice periods | License Terms Art. X; DPA Art. 8.2 (termination of the affected service upon objection to a sub-processor) |
| (i) Participation in security awareness programmes and training | Not agreed — the Provider has no access to the Customer's environment; may be agreed by addendum |
4. Critical or Important Functions — Art. 30 para. 3¶
If the financial entity concludes that the Product supports a critical or important function, the contract must also contain the provisions of Art. 30 para. 3. Status in the standard contractual documentation:
| Requirement of Art. 30 para. 3 | Status |
|---|---|
| (a) Full description of service levels with quantitative and qualitative targets | Partially — the SLA sets response times and target patch deadlines; infrastructure availability is not covered (operated by the Customer) |
| (b) Notice periods and reporting obligations towards the financial entity | Yes — changes to the License Terms 30 days in advance (Art. XII); end of support for a version 3 months in advance (License Terms Art. V); changes to sub-processors 30 days in advance (DPA Art. 8) |
| (c) Implementation and testing of contingency plans and security measures | Yes, within the scope of the role — the Provider maintains measures for development, release and the license server; measures in the Customer's environment are ensured by the operator |
| (d) Participation and full cooperation in the financial entity's TLPT | Not expressly agreed. License Terms Art. III permit tests in the Customer's environment; the Provider's cooperation must be agreed by addendum |
| (e) Unrestricted rights of access, inspection and audit by the financial entity and the competent authority | Partially — DPA Art. 10 provides for an audit at most once a year with 20 days' notice, without access to source code or other customers' data; exception in the event of reasonable suspicion or on the instruction of a supervisory authority. For critical functions, the scope must be extended by addendum |
| (f) Exit strategy with an adequate transition period | Partially — License Terms Art. X; data at the Customer's disposal. A transition period beyond the subscription must be agreed by addendum |
Addendum for critical and important functions
The Provider and the Partner have prepared a template addendum under Art. 30 para. 3 DORA (cooperation with competent authorities, cooperation in TLPT, extended audit rights, transition period upon termination, notification of subcontracting). The addendum is concluded to the Order at the request of the financial entity. Request it from the Partner or at info@mazevault.com.
5. ICT-Related Incidents (Art. 17–19)¶
The Provider has no access to the Customer's environment and does not detect incidents in it. It supports the financial entity's reporting as follows:
| Situation | Procedure | Contractual basis |
|---|---|---|
| The Customer discovers an incident or a vulnerability of the Product | Reports to the Partner and to info@mazevault.com within 72 hours at the latest; does not disclose until remediation | License Terms Art. XI |
| The Provider learns of a vulnerability of the Product | Initiates the security process; for an actively exploited vulnerability, provides the Partner with an advance warning and mitigating measures within 4 hours; target patch release: critical within 48 h, high within 7 days, other within 90 days | SLA Art. 8.2, 10.2 and the patch table |
| Personal data breach | The Partner notifies the Customer within 24 hours; the Provider notifies the Partner and the Customer within the same time limit if the breach concerns data made available to it under DPA Art. 2.3 | DPA Art. 7 |
| Materials for reporting to the supervisory authority | The Provider provides the Partner with available information on the cause, impact on the Product and remediation; the Product provides an integrity-protected audit log (JSON/SIEM export) | SLA Art. 8; Audit Logging |
Reporting of major incidents to the competent authority under Art. 19 is the obligation of the financial entity. Details: Handling of Security Incidents and Vulnerabilities.
6. Subcontracting (Art. 29, Art. 30 para. 2 point (a))¶
The Provider does not use subcontractors with access to the financial entity's data. The Provider's suppliers relevant to the provision of the service (license server hosting, source code and build platform, external development suppliers) are listed in the Subprocessor and Supplier List. Changes to sub-processors of personal data are notified 30 days in advance with a right of objection (DPA Art. 8).
7. Termination and Exit (Art. 28 para. 7–8)¶
- The Product and all data (certificates, keys, secrets, configuration, audit logs) are at all times in the Customer's infrastructure; no "return of data" from the Provider is technically necessary.
- Export is available at any time during the term of the License in standard formats (PEM, DER, PKCS#12, JSON, YAML) via the user interface and API.
- After the subscription ends, a 14-day grace period follows, after which the Customer removes the Product (License Terms Art. X).
- The Partner and the Provider erase personal data obtained during support in accordance with DPA Art. 11.
- Transition support beyond standard support is agreed with the Partner as a professional service (SLA Art. 8.3).
8. What the Provider Does Not Ensure¶
For the avoidance of doubt in risk assessment:
- operation, monitoring, backup and recovery of the Customer's environment,
- guarantee of availability, RTO, RPO or service credits,
- direct technical support to the Customer (provided by the Partner),
- advice on the Customer's regulatory compliance (License Terms Art. IX),
- qualified trust services under eIDAS (the Product's internal CA is not a QTSP; License Terms Art. VI).
9. Contacts¶
| Purpose | Contact |
|---|---|
| Security notifications, vulnerabilities, GDPR, legal matters | info@mazevault.com (Provider) |
| Technical support, incidents, escalation | Partner — channel according to the Order |