Service Description
Last updated: June 12, 2026
1. Scope
This Service Description supplements the Scanara Terms of Service and defines the availability targets, maintenance windows, incident response times, and other service characteristics of the Scanara platform. In the event of a conflict between this Service Description and the Terms of Service, this Service Description prevails; however, the Provider's liability is governed exclusively and with priority by § 9 of the Terms of Service. In case of discrepancies between the German and English versions of this Service Description, the German version prevails.
2. Subscription Tiers
| Feature | Free | Team | Business | Enterprise |
|---|---|---|---|---|
| Availability Target | No commitment | 99.0 % | 99.5 % | 99.9 % |
| Measurement Period | — | Calendar month | Calendar month | Calendar month |
| Support Response Time (P1) | — | next business day | 4h | 2h |
| DPA (Art. 28 GDPR) | ✓ (electronic) | ✓ (additionally signed copy upon request) | ✓ (additionally signed copy upon request) | ✓ (additionally individual amendments) |
The Data Processing Agreement (DPA) is concluded electronically for all plans — including free use — upon acceptance of the Terms of Service (Art. 28(9) GDPR); details are set out in Section 9 of the DPA.
Availability is measured at the handover point to the internet and calculated per calendar month as follows: Availability (%) = (total minutes in the calendar month − downtime minutes) ÷ total minutes × 100. The Provider's monitoring is authoritative. Excluded from the calculation are: (a) scheduled maintenance within the maintenance windows under Section 3, limited to 8 hours per calendar month — scheduled maintenance exceeding this limit counts as unavailability; (b) force majeure events; (c) disruptions of third-party services outside the Provider's area of responsibility (in particular GitHub, payment providers, external identity providers, DNS or network operators); (d) disruptions caused by the Customer or its systems; (e) suspensions or restrictions pursuant to the Terms of Service; (f) features designated as beta or preview.
The availability targets are performance targets and do not constitute guarantees within the meaning of § 443 BGB. If the availability target is undershot by more than 1 percentage point in any calendar month, the Customer may request a pro-rata credit of the monthly subscription fee for the affected month, capped at 30 % of the monthly fee. The request must be submitted in text form to support@scanara.io within 30 days after the end of the affected calendar month; after expiry of this period, the credit claim is forfeited. The credit is offset against the next invoice; no cash payout is made. The credit is the exclusive contractual remedy for the mere failure to meet an availability target; any further claims of the Customer are governed exclusively by § 9 of the Terms of Service and statutory law. Mandatory statutory rights of the Customer remain unaffected; vis-à-vis consumers (§ 13 BGB), the foregoing limitations apply only to the extent permitted by law.
3. Maintenance Windows
Planned maintenance is scheduled within the following windows where possible:
- Regular maintenance window: Tuesday and Thursday, 02:00–05:00 CET/CEST
- Advance notice: At least 24 hours in advance via email notification (Team plan and above) and status page (all plans)
- Scope: Scheduled maintenance within the maintenance windows is limited to a total of 8 hours per calendar month
- Emergency maintenance: Notification as soon as practicable; no advance notice required where platform or customer data security is at risk
4. Incident Classes and Response Times
| Class | Description | Response Time | Resolution Target |
|---|---|---|---|
| P1 — Critical | Platform fully unavailable; data loss risk | per plan tier, see Section 2 | 8 h |
| P2 — High | Core functions (scan, dashboard) severely impaired | twice the P1 response time per Section 2 | 24 h |
| P3 — Medium | Secondary functions impaired; workaround available | 1 business day | 5 business days |
| P4 — Low | Cosmetic issues, enhancement requests | 3 business days | Next release |
Response times apply to qualified incident reports submitted by email to support@scanara.io during business hours (Mon–Fri, 09:00–18:00 CET/CEST) on Team plan and above. A qualified incident report contains at minimum: the affected organisation, a description of the incident, the time of occurrence, and — where possible — steps to reproduce; the response time starts upon receipt of the complete report. Resolution targets run from the Provider's response to the qualified incident report. Business days are Monday to Friday excluding public holidays in the Free State of Bavaria, Germany. Resolution targets are non-binding target values (best-effort commitments), not guaranteed deadlines.
<!-- canonical retention source: docs/compliance/data-deletion-retention-policy.md — values here must stay in sync -->5. Data Retention Periods
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account data | Duration of contract + 30 days | Art. 6(1)(b) GDPR |
| Scan results and compliance findings | During the contract term, per plan tier: Free 30 days, Team 90 days, Business 365 days, Enterprise 1825 days; 30 days after subscription termination | Art. 6(1)(b) GDPR |
| Invoices and payment records | 8 years | § 147(1) No. 4 AO, § 14b(1) UStG as amended by BEG IV (BGBl. 2024 Nr. 323; effective 1 January 2025) |
| Audit trail (compliance events) | at least 10 years | Art. 28(3)(a) GDPR (processor instruction from Customer); for customers as high-risk AI providers: EU AI Act Art. 18(1) |
| Application logs | 90 days | Art. 6(1)(f) GDPR |
6. Rate Limits
The usage limits published on the pricing page of the website apply (number of AI systems, scan quotas, API calls per month). Scanara reserves the right to temporarily throttle access in cases of abusive usage and will notify the Customer accordingly.
7. Changes to This Service Description
Changes to this Service Description will be communicated to the Customer by email at least 30 days before they take effect. The provisions on amendments to the Terms of Service (§ 12 ToS) apply accordingly.
8. Data Export pursuant to Data Act (Art. 23)
The Provider enables Customers to export their data in a structured, commonly used, and machine-readable format within the meaning of Art. 30(5) of Regulation (EU) 2023/2854 (Data Act); the export scope corresponds to the specification under Art. 25(2)(e) Data Act. Switching support provisions and the transition period are set out in § 5b of the Terms of Service.
Export scope:
| Data category | Included in export |
|---|---|
| AI system definitions and versions | ✓ |
| Assessments (AIRA, FRIA, DPIA, GPAI, Deployer, Conformity Assessment) | ✓ |
| Scan results and findings | ✓ |
| Compliance dossiers (metadata + source artefacts) | ✓ |
| Organisation settings and members | ✓ |
| Audit trail extract (organisation scope) | ✓ |
| Derived data | ✗ |
| Platform rules and algorithms | ✗ |
| Anonymised infrastructure logs | ✗ |
Format: JSON (UTF-8, RFC 8259), embedded in a ZIP archive. Each entity is delivered as a separate JSON file alongside a manifest file (manifest.json) containing the schema version, export timestamp, and Data Act compliance declaration.
Delivery: Presigned S3 URL valid for at least 48 hours; a fresh URL is provided upon request. Data retrieval is possible during the transitional period of no more than 30 calendar days following contract termination, and for a subsequent retrieval period of at least 30 calendar days after the end of the transitional period (Art. 25(2) Data Act).
Machine-readability declaration: These export formats qualify as structured, commonly used, machine-readable, and interoperable formats within the meaning of Art. 30(5) of Regulation (EU) 2023/2854 (Data Act).
9. Backup and Recovery
The Provider performs automated backups of the production database and object storage data. The following target values apply: maximum data loss (RPO) under 1 hour, recovery time (RTO) under 4 hours for single-region failure scenarios. These values are target values (best-effort commitments), not guaranteed deadlines.