Crosswalk is a compliance workbench for the CRA, NIS2, GDPR, the Machinery Regulation and RED. Supplier: Depre.nl, the Netherlands, trading as EU Cyber Laws. This page is meant to be forwarded; every answer links to the document it comes from.
On your own device. Crosswalk is local-first: in Chrome and Edge a project is ordinary files in a folder you pick, and in Firefox and Safari it is held in the browser's own storage on that device. Nothing is uploaded to us. You can verify it yourself: open the browser's network tab and work for ten minutes.
No project data. Two services sit on our side: the licence check (a licence key is validated and a signed entitlement is returned) and, only if you buy Plus, the AI relay described below. Both are Cloudflare Workers; the marketing pages and the application bundle are delivered through Cloudflare.
Nothing happens to it. The files are yours and stay where they are, readable and exportable. A lapsed subscription returns the application to trial behaviour; it does not take the data away.
Yes. Projects are plain files, and the application exports the assessment set as Markdown and PDF, plus a project zip. A worked example is published: see the documents at the bottom of this page.
Only where you use the optional Plus managed-AI add-on. Then you are controller and Depre.nl is processor, under the Data Processing Annex to the licence agreement, which is the Article 28 agreement. Without Plus we process no project content at all.
It relays the prompt and the project context you submit to the AI sub-processor and returns the answer. No prompts or responses are stored, no model training, no profiling. Only usage counters are kept, for the monthly allowance, and they expire no later than sixty days after the end of the month they belong to.
Licence records through Polar, the reseller and Merchant of Record for the purchase, and any e-mail you send us. The privacy statement sets out the detail and your rights.
The full list. Two of the three are engaged only in a specific case, named in the row.
| Party | Role | When |
|---|---|---|
| Polar | Reseller and Merchant of Record: checkout, VAT, licence key delivery, customer portal | On purchase and renewal |
| Cloudflare | Delivery of the site and the application bundle; the licence check and the Plus relay run as Workers | Always, for delivery and licence checks |
| Anthropic, PBC | AI sub-processor for the managed Plus add-on, as named in the Data Processing Annex | Only with Plus, and only when you use the assistant |
A change of AI sub-processor is announced through the product or the website; if you object you can stop using Plus and switch to your own AI key. Bringing your own key means the request goes from your browser straight to the provider you chose, under your agreement with them, and we are not in the path at all.
Entitlements arrive as Ed25519-signed claims that the application verifies against a key built into it. Editing local storage lands you in trial mode. The honest limit: verification runs client-side, so it stops casual forgery, not a patched bundle.
The Plus relay holds the AI credentials server-side only, never in the browser. Your own AI key, if you use one, is stored by your browser on your device and sent only to the provider you configured. Traffic is over TLS throughout.
Through the security page, which carries the disclosure policy and the safe-harbour rules. We build a product about vulnerability handling; we hold ourselves to it.
No. Depre.nl is a small Dutch company and claims no ISO 27001 or comparable certificate. What we can show you is the architecture, the agreement, and the output the product produces.
For a harmonised standard, no. Once the Commission cites it in the Official Journal it forms part of EU law, and the Court of Justice has held there is an overriding public interest in its disclosure (Case C-588/21 P, Public.Resource.Org and Right to Know v Commission, 5 March 2024, ECLI:EU:C:2024:201). Crosswalk publishes that catalogue in full from the date of citation. For every other standard you licence your own copy from the publisher and Crosswalk shows clause references only; it never reproduces the text.
EN 18031-1, -2 and -3:2024 for radio-equipment cybersecurity, cited under Directive 2014/53/EU by Commission Implementing Decision (EU) 2025/138 of 28 January 2025, with the restrictions that decision names. No CRA harmonised standard is cited yet; the in-app tracker shows where each one stands.
The Crosswalk Software Licence Agreement, governed by Dutch law, presented at the checkout and once more at first activation. Your purchase is also covered by Polar's buyer terms for the transaction itself.
Yes. If you do not accept the agreement as presented at first activation, clause 9.2 gives a full refund within fourteen days of purchase, as long as the key has not been activated and no unwatermarked output has been produced. Beyond that, a subscription is cancelled through the Polar customer portal and your projects stay readable and exportable.
To businesses in the European Union and the European Economic Area, and elsewhere outside the excluded territories. Two exclusions: the United States, because our liability cover does not extend to claims under US law or brought in the US, and countries under comprehensive EU restrictive measures. Canada is not excluded. See the details. Crosswalk is not offered to consumers.
Yes. Each person works under their own licence. For volume terms, a single invoice and one renewal date, ask for an Enterprise quote at [email protected].
A question this page does not answer? Mail [email protected] and the answer is added here.