The questions a review asks, answered on one page

Where is our project data stored?

On your own device. Crosswalk is local-first: in Chrome and Edge a project is ordinary files in a folder you pick, and in Firefox and Safari it is held in the browser's own storage on that device. Crosswalk does not upload your project to us. If you use our managed AI, what you submit to it (your question, the project context it needs, and any file you attach) passes through our relay to the AI provider, and the relay stores none of it (see below). You can verify it yourself: open the browser's network tab and work for ten minutes.

Do you host anything of ours?

No project data. Two services sit on our side: the licence check (a licence key is validated and a signed entitlement is returned) and, only if you use our managed AI, the AI relay described below: Plus on Essentials and Professional, or the AI drafts of the Lite licence. Both are Cloudflare Workers; the marketing pages and the application bundle are delivered through Cloudflare.

What happens to our data if we stop paying?

Nothing happens to it. The files are yours and stay where they are, readable and exportable. A lapsed subscription leaves the projects readable and exportable; it does not take the data away.

Is there an export, and in what format?

Yes. Projects are plain files, and the application exports the assessment set as Markdown and PDF, plus a project zip. A worked example is published: see the documents at the bottom of this page.

Are you a processor for us?

Only where you use our managed AI: Plus (part of Essentials and Professional, and off until you pick it as the AI provider), or an AI draft on the Lite licence (sent only when you ask for one). Then you are controller and Depre.nl is processor, under the Data Processing Annex to the licence agreement, which is the Article 28 agreement. Without the managed AI we process no project content at all.

What does the managed AI relay do with our content?

It relays the prompt and the project context you submit, from Plus or from a Lite AI draft, to the AI sub-processor and returns the answer. No prompts or responses are stored, no model training, no profiling. Only usage counters are kept: for Plus, the token counts of the monthly allowance, which expire no later than sixty days after the end of the month they belong to; for a Lite licence, its count of AI drafts, which runs for the life of the licence and is deleted no later than twelve months after it ends.

What do you hold about us as a customer?

What the licence agreement names in clause 14.2, as controller, and nothing of your projects:

• Licence operation: to validate and activate a licence, our licensing service receives the licence key and a short label for the device, and checks them against the purchase records Polar holds.
• AI usage metering: if you use our managed AI, the token counts per licence key per month for the monthly allowance of Plus, and the number of AI drafts of a Lite licence.
• The Lite evaluation counters: while the Lite licence includes AI drafts, per Lite licence when it was first opened in the app, how many drafts it used, the dates of the first and the last, and whether the customer later takes a paid licence; kept while the Lite licence exists and up to twelve months after it ends.

Beside these: the licence records, through Polar, the reseller and Merchant of Record, for a purchase by card, or with us for a yearly licence on invoice; and any e-mail you send us. The privacy statement sets out the detail and your rights.

How is the licence checked?

Entitlements are signed, and the application checks them. Changing the stored licence data leaves Crosswalk read-only.

Where are credentials kept?

The managed AI relay holds the AI credentials server-side only, never in the browser. Your own AI key, if you use one, is stored by your browser on your device and sent only to the provider you configured. Traffic is over TLS throughout.

How do we report a vulnerability?

Through the security page, which carries the disclosure policy and the safe-harbour rules. We build a product about vulnerability handling; we hold ourselves to it.

Do you hold a certification?

No. Depre.nl is a small Dutch company and claims no ISO 27001 or comparable certificate. What we can show you is the architecture, the agreement, and the output the product produces.

Do we need to buy the standards you assess against?

For a harmonised standard, no. Once the Commission cites it in the Official Journal it forms part of EU law, and the Court of Justice has held there is an overriding public interest in its disclosure (Case C-588/21 P, Public.Resource.Org and Right to Know v Commission, 5 March 2024, ECLI:EU:C:2024:201). Crosswalk publishes that catalogue in full from the date of citation. For every other standard you licence your own copy from the publisher and Crosswalk shows clause references only; it never reproduces the text.

Which ones are harmonised today?

EN 18031-1, -2 and -3:2024 for radio-equipment cybersecurity, cited under Directive 2014/53/EU by Commission Implementing Decision (EU) 2025/138 of 28 January 2025, with the restrictions that decision names. No CRA harmonised standard is cited yet; the in-app tracker shows where each one stands.

Whose terms apply?

The Crosswalk Software Licence Agreement, governed by Dutch law, presented at the checkout (or with the order, when you buy on invoice) and once more at first activation. A purchase by card is also covered by Polar's buyer terms for the transaction itself.

Can we get out if it does not fit?

Yes. If you do not accept the agreement as presented at first activation, clause 9.2 gives a full refund within fourteen days of purchase, as long as the key has not been activated and no unwatermarked output has been produced. Beyond that, a subscription is cancelled through the Polar customer portal and your projects stay readable and exportable.

Where is Crosswalk offered?

To businesses in the European Union and the European Economic Area, and elsewhere outside the excluded territories. Two exclusions: the United States, because our liability cover does not extend to claims under US law or brought in the US, and countries under comprehensive EU restrictive measures. Canada is not excluded. See the details. Crosswalk is not offered to consumers.

Can we buy for a team, on invoice?

Yes. A licence is for your company, one legal entity, not for one person: any of your employees and contractors may work under it, and a key can be activated in up to 1 browser on Lite, 3 on Essentials and 10 on Professional at the same time, a ceiling against misuse, not a count of users. A yearly licence can be paid on invoice instead of by card (how it works): with the order confirmation and the invoice you receive a licence for 35 days, so work can start the same day; you pay within 30 days, and the licence for the year then replaces it. For volume terms, a single invoice and one renewal date, ask for an Enterprise quote at [email protected].