MazeVault's position as a supplier to entities regulated by the Cybersecurity Act and materials for supplier assessment
Version: 1.0.0
Classification: Confidential
Owner: Managing Director, MAZEVAULT s.r.o.
Last Updated: 2026-05-01
Review Cycle: Annual and upon any change to the contractual documentation or legal framework
Service provision model and allocation of responsibility
MazeVault is provided as licensed software operated at the Customer (on-premises or in the Customer's own cloud tenant), not as a hosted service.
- The Provider (MAZEVAULT s.r.o.) develops the Product, releases updates and security patches, and provides upstream product support to the Partner. It does not operate the Customer's infrastructure, does not host the Product or data, and by default has no access to the Customer's environment or data (License Terms Art. VII; DPA Art. 2.3).
- The Partner is a non-exclusive reseller and the Customer's sole contractual contact for technical support; both the SLA and the DPA are concluded with the Partner (SLA Art. 1.2, 3.1).
- The Customer operates the Product in its own infrastructure and manages access, encryption keys, backups and recovery (License Terms Art. IV, VII).
The Provider does not guarantee the availability of the Application as a whole, infrastructure availability, RTO, RPO or data recovery (SLA Art. 1.3). Use of the Product does not in itself establish the Customer's compliance with the Cybersecurity Act or NIS2 (License Terms Art. IX).
1. MazeVault's Position
| Question |
Answer |
| Is MAZEVAULT s.r.o. an obliged entity under Act No. 264/2025 Coll.? |
No. It does not meet the criteria of a regulated service (neither the size thresholds nor a regulated sector). The Provider reviews this assessment annually; if there is a change, it will notify the Partner and the Customers. |
| Is MazeVault registered with NÚKIB? |
No — the registration obligation does not apply to it. |
| In what role does it act towards a regulated Customer? |
Supplier (provider of software and its maintenance). Obligations towards the Customer arise exclusively from the contractual documentation, not directly from the Act. |
| Who fulfils the obligations towards NÚKIB (registration, incident reporting, security measures)? |
Exclusively the Customer as the provider of the regulated service. |
2. Materials for Supplier Assessment
A regulated entity must assess the risks associated with significant suppliers before concluding a contract and on an ongoing basis, and must reflect security requirements in the contract. For this purpose, the Provider makes the following available:
| Material |
Where |
Note |
| License Terms, List of Required Software |
Publicly — see Contractual Documents |
Binding wording |
| SLA, DPA, Order |
Through the Partner |
Concluded by the Customer with the Partner |
| Description of the allocation of responsibility |
This page; DORA |
|
| Technical description of the Product's security features |
Security section |
Encryption, RBAC, authentication, audit log, key management — description of actually implemented features |
| Supported configurations and technical requirements |
List of Required Software (Annex 5); Requirements |
|
| List of sub-processors and suppliers |
Subprocessor and Supplier List |
|
| SBOM (software bill of materials) for a released version |
On request at info@mazevault.com |
Generated automatically with every release |
| Vulnerability scanning results for a released version |
On request, to the extent that does not compromise the security of the Product (DPA Art. 10.1) |
Scanning of components and dependencies is performed at the build of each version |
| Security advisories |
To the Partner and Customers with an active license |
See Handling of Incidents and Vulnerabilities |
| Security contact person |
info@mazevault.com (Provider); Partner contacts according to the Order |
|
Answers to common security questionnaire questions are in Section 6; the Provider answers a questionnaire in the Customer's own format individually.
3. Contractual Assurance of Supplier Requirements
Requirements that a regulated entity generally must contractually secure towards a significant supplier, and where they are addressed in the contractual documentation:
| Requirement |
Contractual arrangement |
| Scope of the supplier's access to information and systems |
Provider without standard access (License Terms Art. VII; DPA Art. 2.3, 2.5); Partner's access according to the scope of support/operation (DPA Art. 2.2) |
| Supplier's security measures |
DPA Annex B (technical and organisational measures of both the Partner and the Provider) |
| Security of the supplied software, updates and patches |
License Terms Art. V; SLA Art. 10 and the patch table (target release: critical within 48 h, high within 7 days, other within 90 days); List of Required Software |
| Incident and vulnerability reporting |
License Terms Art. XI (Customer → Partner and Provider within 72 h); SLA Art. 8.2, 10.2 (Provider → Partner, advance warning within 4 h for an actively exploited vulnerability); DPA Art. 7 (personal data breach within 24 h) |
| Communication channels and contact persons |
Order and SLA Art. 13; escalation SLA Art. 12 |
| Right of inspection / audit |
DPA Art. 10 — materials on request; audit by an independent auditor at most once a year with 20 business days' notice; without restriction in the event of reasonable suspicion or on the instruction of a supervisory authority |
| Supply chain (subcontractors) |
DPA Art. 8 (notice 30 days in advance, objection within 15 business days); Subprocessor and Supplier List |
| Notification of changes |
Changes to the License Terms 30 days in advance (Art. XII); end of support for a version 3 months in advance (License Terms Art. V) |
| Contract termination and exit |
License Terms Art. X; DPA Art. 11; data permanently in the Customer's infrastructure |
| Liability |
License Terms Art. IX |
| Confidentiality |
License Terms Art. VIII (5 years after termination; without limitation for source code and security mechanisms) |
| Liability insurance |
License Terms Art. XII — the Provider maintains professional and product liability insurance; confirmation upon a reasoned request |
If the Customer requires provisions beyond this framework (e.g. under the implementing decree for its regime of obligations), these are agreed by an addendum to the Order — contact the Partner.
4. Incidents and Vulnerabilities
The Provider does not detect incidents in the Customer's environment — it has no access to it. The notification chain and time limits are described in the document Handling of Security Incidents and Vulnerabilities. Reporting incidents to NÚKIB is the Customer's obligation; the Provider will, through the Partner, provide available information on the cause and remediation of the Product defect.
5. What the Provider Does Not Ensure
- operation, monitoring, backup and recovery of the Customer's environment,
- guarantee of availability, RTO, RPO or service credits,
- direct technical support to the Customer (provided by the Partner),
- fulfilment of the Customer's obligations towards NÚKIB,
- advice on the Customer's regulatory compliance (License Terms Art. IX).
6. Answers to Common Security Questionnaire Questions
The answers describe the actually implemented properties of the Product and the actual practices of the Provider. Where something is the responsibility of the Customer as the operator, this is expressly stated. The Provider answers a questionnaire in the Customer's own format individually on the basis of these materials.
6.1 Data Protection and Encryption
| Question |
Answer |
| Do you encrypt data at rest? |
Yes. Security Assets (secrets, private keys) are encrypted in the database with AES-256-GCM; encryption cannot be disabled in the Product. Encryption of disks and backups is ensured by the Customer in its infrastructure. Details: Encryption. |
| Which encryption algorithm do you use? |
AES-256-GCM (NIST SP 800-38D) with a random nonce and authentication tag; key derivation HKDF-SHA256; certificates RSA 2048/4096 and ECDSA P-256/P-384. |
| Do you support HSM / external key management? |
Yes. Integration with Azure Managed HSM / Key Vault, AWS CloudHSM, Google Cloud KMS and HSM via PKCS#11; external secret stores HashiCorp Vault, Azure Key Vault, AWS Secrets Manager. Configured and operated by the Customer. |
| Where is the data stored? |
Exclusively in infrastructure operated by the Customer (on-premise or the Customer's own cloud tenant). The Provider does not host customer data and has no access to it. |
| Is data encrypted in transit? |
Yes. TLS 1.2+ on all interfaces; mTLS between the agent and the server. |
| Who controls the encryption keys? |
The Customer. The master encryption key and the keys in the HSM are generated, owned and controlled by the Customer (License Terms Art. VII). The Provider has no access to the unencrypted content of Security Assets. |
6.2 Access Control and Authentication
| Question |
Answer |
| How do you control access? |
RBAC with 8 built-in roles (Viewer, User, Certificate Manager, Secret Manager, Project Admin, Admin, Auditor, Finance), custom roles and granular permissions; separation of the certificate and secret domains; project-level isolation. Details: RBAC. |
| Do you support MFA? |
Yes. TOTP (compatible with common authenticators) with the option of enforcement for roles or all users. |
| Do you support SSO? |
Yes. Microsoft Entra ID (OpenID Connect), LDAP / Active Directory and Kerberos/SPNEGO. Integration with the Customer's identity provider. Details: Authentication. |
| How is service/machine access managed? |
API tokens with restricted permissions and expiry; agents with an mTLS identity. |
| How is session management controlled? |
Token-based sessions, configurable inactivity timeout (default 30 min), option for an administrator to invalidate a session. |
| Do you perform access reviews? |
In the Product: tools for the Customer (overview of users and roles, audit records). At the Provider: quarterly review of access to the source code, the image registry and the license server; removal of access within 1 business day after the end of cooperation. |
6.3 Audit and Logging
| Question |
Answer |
| Do you have audit logging? |
Yes. Audit records of all security-relevant operations with hash chaining (SHA-256, each record contains the hash of the previous one) — tampering is detectable. Details: Audit Logging. |
| What is the log retention? |
Set by the Customer according to its obligations; the Provider does not guarantee any specific retention (SLA Art. 11). Long-term archiving is ensured by the Customer in a SIEM/archive. |
| Can logs be exported? |
Yes. JSON export with integrity verification; streaming to Elasticsearch/ELK, Splunk (HEC), syslog (CEF/LEEF — e.g. Microsoft Sentinel, IBM QRadar) and webhook. |
| Can log integrity be independently verified? |
Yes, the Customer can verify the hash chain over the export with its own tools. |
6.4 Vulnerability Management and Secure Development
| Question |
Answer |
| How do you handle vulnerabilities? |
Automated scanning of dependencies and container images at every build (Trivy, govulncheck, npm audit) and regular scanning of released versions for new CVEs. Target patch release time limits under the SLA: critical within 48 h, high within 7 days, other within 90 days. |
| How do you manage dependencies? |
Automated tracking of updates (Dependabot / Renovate); changes go through review and CI gates. |
| Do you have an SBOM? |
Yes. An SBOM is generated automatically with every release; the Provider provides it for a released version on request. |
| Do you perform penetration testing? |
Yes. An independent third-party penetration test of the Product was performed in 2026; the Provider provides a summary of results on request to the extent that does not compromise security. The Provider also performs automated security testing in CI. The Customer may test in its own environment (License Terms Art. III). |
| Do you have a responsible disclosure programme? |
Yes. Reports to info@mazevault.com; request for non-disclosure until the fix is released (License Terms Art. XI). |
| How does development and release work? |
Every change via a pull request with review by a second person; automated tests and security scans as a condition of merging; releases are approved and signed exclusively by the Provider's Managing Director. |
6.5 Incident Response
| Question |
Answer |
| Do you have an incident response plan? |
Yes — the Provider's internal plan for defects and vulnerabilities of the Product and for its own systems; customer-facing description: Handling of Incidents and Vulnerabilities. Incidents in the Customer's environment are handled by the Customer. |
| How quickly will you inform us? |
Through the chain Provider → Partner → Customer. Actively exploited vulnerability: warning to the Partner within 4 h (SLA Art. 10.2). Personal data breach: within 24 h (DPA Art. 7.1). |
| How are incidents classified? |
P1–P4 under SLA Art. 5 according to the impact on confidentiality, integrity and availability; vulnerabilities according to CVSS v3.1. |
| Do you test incident response? |
The Provider performs an annual tabletop exercise and a review after every P1/P2 incident. |
6.6 Continuity and Recovery
| Question |
Answer |
| Do you have a BCP/DRP? |
The Provider maintains a continuity plan for its own activities (development, release, license server) with an annual recovery test. Continuity of operation of the Product, backups, RTO/RPO are ensured by the Customer (SLA Art. 1.3). Details: Continuity of Product Provision. |
| Does operation depend on your systems? |
The Product verifies the license once a day; if the license server is unavailable, it continues to run on the last verified state. After the end of the subscription, a 14-day grace period. No other runtime dependency exists. |
| What resilience does the Product support? |
Deployment in multiple replicas (Kubernetes), active/passive Gateway failover, database replication — all deployed and operated by the Customer. |
| How are backups performed? |
Backups of the database, configuration and keys are performed by the Customer according to the documentation. The Provider backs up only its own license server (daily). |
6.7 Infrastructure and Deployment
| Question |
Answer |
| Which cloud provider do you use? |
For customer data, none — the Product runs in the Customer's infrastructure. The Provider operates only the license server with a server infrastructure provider in the EU. |
| Do you have environment segregation? |
The Provider separates development, testing and release; development environments do not contain customer data (the Provider does not have it). Segregation of the Customer's own environments (non-production/production) is defined by the Customer. |
| Do you use containers? |
Yes. The Product is delivered as container images (Docker Compose, Helm/Kubernetes); images are scanned at every build; signed release artifacts. |
| What are the network requirements? |
See the List of Required Software (Annex 5) Art. 4.3 — mandatory HTTPS, internal ports must not be exposed to the internet, outbound HTTPS to the license server and optional integrations. |
6.8 Governance and Compliance
| Question |
Answer |
| Which regulations apply to you? |
GDPR (controller of license metadata, conditional sub-processor); Cyber Resilience Act (CRA, EU 2024/2847) as a software manufacturer — vulnerability reporting obligations from 9/2026, full compliance by 12/2027. We are not a regulated entity under Act No. 264/2025 Coll. nor a critical provider under DORA. |
| Do you have security certifications? |
No. The Provider does not hold ISO/IEC 27001 certification or a SOC 2 report. It has an established security policy and procedures, which it provides on request (DPA Art. 10.1). |
| Who is responsible for security? |
The Provider's Managing Director as the statutory body and the person responsible for information security and personal data protection. Contact: info@mazevault.com. |
| How often do you review policies? |
Annually and upon a change in the contractual documentation, legislation or organisation. |
| Do you have liability insurance? |
Yes — professional liability in software development incl. cyber risks; confirmation upon a reasoned request (License Terms Art. XII). |
6.9 Personnel and Suppliers
| Question |
Answer |
| Who develops the Product? |
The Provider's Managing Director and external contract developers bound by confidentiality (without time limitation for source code), without access to customer data and without the right to release versions. |
| Do you train personnel? |
Annual familiarisation with the security policy and secure development (OWASP Top 10, handling of secrets) for both the Managing Director and developers. |
| What happens upon termination of cooperation? |
Removal of access within 1 business day; return/deletion of copies of the code; confidentiality continues. |
| Do you use sub-processors? |
For the Customer's personal data, no further sub-processors. The Provider's suppliers without access to customer data are listed in the Subprocessor and Supplier List; changes 30 days in advance. |
| Do you have exit procedures? |
Data is permanently in the Customer's infrastructure and exportable in standard formats; after the end of the subscription, a 14-day grace period (License Terms Art. X); transition support via the Partner. |
| Purpose |
Contact |
| Security notifications, vulnerabilities, GDPR, legal matters |
info@mazevault.com (Provider) |
| Technical support, incidents, escalation |
Partner — channel according to the Order |