Security and confidentiality
What happens to your firmware
Your firmware is stored in Frankfurt, analysed in Germany and deleted after the analysis, even if the analysis fails. Only component name and version go to public vulnerability databases. You and the members of your organisation see the results.
As of 20 October 2026
Your file lies here until it is deleted
The file's path
From upload to deletion
Five steps. The file is stored in Frankfurt and analysed on our servers in Germany; after the analysis it is deleted.
1
Upload
You upload the file in your own LegacyMind account. It is held in our database's storage in Frankfurt.
2
Analysis
The analysis runs automatically on our servers in Germany.
3
Matching
Only component name and version go to public vulnerability databases, never the file.
4
Deletion
The uploaded firmware image is deleted after the analysis, also when the analysis fails. If no analysis starts for an upload, the system starts it itself; if that fails, the upload is deleted after 24 hours at the latest.
5
Result
Components, findings and reports are stored in the database in Frankfurt, visible in your account.
Who sees what
Your results belong in your account
The database checks the permissions itself, row by row: a query from another account gets none of your rows back.
You
The person who uploaded the file sees the results and can change them.Your organisation
Members of your organisation see devices and results and can record a decision for each finding. Only the person who uploaded a device can delete it.Public databases
They learn the component name and version, for example “FreeRTOS 10.1.1”. They do not learn which device or customer the query comes from, and never get the file.
What stays
What stays stored, and for how long
The file is deleted after the analysis. The results stay as long as you need them, and you set how long yourself.
- The file
- Deleted after the analysis, even if the analysis fails.
- SBOM and device data
- Stay in your account, so new vulnerabilities can still be matched to your firmware versions.
- Findings
- Stay until you set a retention period: 30 days to 2 years, under Settings, Privacy (Einstellungen, Datenschutz).
- Imported SBOM
- Your supplier's SBOM file stays stored with the device, as the basis for the ongoing matching.
- Secrets found
- Passwords and keys the analysis finds in the image are redacted after a period you choose: 2 to 90 days.
Confidentiality
What we commit to
The terms of the free check are on the CRA readiness check page.
NDA
On request, we sign an NDA beforehand.No source code
The analysis needs only the file your build produces, or the shipped image. No repository, no access to your systems.Encrypted images
We do not decrypt an image encrypted by its manufacturer. If a file cannot be read, the report states the reason.Data processing
Where we process personal data on your behalf, we conclude, where required, a data processing agreement under Art. 28 GDPR.
Service providers
Who processes data for us
The firmware file sits with only two providers, both with data centres in Germany: Supabase and Hetzner. It never reaches the others, because your browser uploads it directly into storage.
- Supabase
- The platform's database and file storage, data centre in Frankfurt am Main (region eu-central-1).
- Hetzner Online
- The servers the analysis runs on, in Germany.
- Upstash
- The queue of analysis jobs. It holds job data, never the firmware file.
- Scaleway
- Sends the app's email notifications.
- Vercel
- Runs the app interface and this website. What the website collects is set out in the privacy policy (German).
Questions on confidentiality
What manufacturers and service providers ask us
Does our firmware go into a cloud?
For the duration of the analysis it is held in our provider's file storage in Frankfurt, and it is analysed on our servers in Germany. After that it is deleted.
Who sees our results?
You and the members of your organisation. Members can record a decision for each finding; only the person who uploaded a device can delete it.
What does a public vulnerability database learn?
Component name and version, for example “FreeRTOS 10.1.1”. Not your device, not your name, never the file.
Can we set how long results are kept?
Yes, under Settings, Privacy: findings 30 days to 2 years; passwords and keys found are redacted after 2 to 90 days. Without a setting, they stay stored.
Do you sign an NDA?
Yes, on request, before the upload.
Do you analyse encrypted firmware?
We do not decrypt an image encrypted by its manufacturer. Send the unencrypted file from your build.
Start with one image
With an NDA on request. You get the report and SBOM within three working days of the upload.