Our disclosures under the Cyber Resilience Act
Manufacturer disclosures · Regulation (EU) 2024/2847
This page is reachable without a sign-in and without the app. It contains the information the Cyber Resilience Act requires from us as a manufacturer — the support period for our products, the route by which you can report a vulnerability to us, and our assessment of which products fall under the regulation at all.
Manufacturer
Techlogia, Inhaber Jaciel Antonio Acea Ruiz
Sole proprietorship
Prinzenallee 38
13359 Berlin
Germany
These details are identical to the master data in our product file and go unchanged into a declaration of conformity under Annex V.
Products and support period
Under Art. 13(8) CRA the manufacturer determines a support period; we state its end date here as Art. 13(19) requires. During that period vulnerabilities are handled and security updates are provided. We also list the products we assess as not covered by the CRA — including the reasoning, because “not listed” and “assessed and not affected” are two different things in an audit. The list is extended as we go.
CRA-Akte
In scopePre-launchSelf-hosted compliance system under Regulation (EU) 2024/2847. Runs on the customer's own infrastructure; the manufacturer has no access to the instance.
- Not yet placed on the market
- Planned placing on the market:
- Support period
- –
- Classification
- Neither important nor critical — Annex III and Annex IV, neither applies
- Assessment
- Supplied for payment in the course of a commercial activity, with intended data exchange over a network. No exception under Art. 2(2)–(7). No remote data processing within the meaning of Art. 3(2): the product runs entirely on the customer's side; the manufacturer operates no component and has no access.
Techlogia Labs App
In scopeMobile application for the Techlogia Lab learning platform, distributed via the Apple App Store.
- Support period
- –
- Classification
- Standard — no category under Annex III or IV applies
- Assessment
- In scope. Distribution via the App Store takes place in the course of a commercial activity — the fact that the app is free of charge does not change this (Art. 3(22)). The backend at techlogia.de/api is remote data processing (Art. 3(2)) and is assessed as part of this product, not as a product of its own.
TimeAM
In scopeTime tracking and shift planning: iOS app, available in the Apple App Store.
- Support period
- Support period under Art. 13(8): to be determined and published here. Article 14 already applies.
- Classification
- Standard — core function is time tracking, no category under Annex III or IV applies
- Assessment
- In scope. The app is made available through the App Store in the course of a commercial activity; being free of charge does not change this (Art. 3(22)). Where it uses a backend, that is remote data processing (Art. 3(2)) and is assessed as part of the product. Reporting route as for our other products: security@techlogia.de.
techlogia-cli
In scopeCommand-line tool (npm package “techlogia”) for the Techlogia Lab learning platform: read modules, start sessions, manage classes.
- Support period
- –
- Classification
- Standard — no category under Annex III or IV applies
- Assessment
- In scope. The tool is open source and free of charge, but it provides access to a platform through which we offer other services for payment (recital 15); the exemption for free and open-source software that is not monetised (Art. 3(48), recital 18) therefore does not apply. The Lab interface is remote data processing for this tool (Art. 3(2)).
Mr.inkPrint App
In scopeWithdrawn from the market on 2 November 2026Mobile shop application for print-on-demand products (iOS).
- Support period
- No support period under Art. 13(8): no new version. Article 14 continues to apply to copies already supplied.
- Classification
- Standard — no category under Annex III or IV applies
- Assessment
- In scope (Art. 3(22)). The app was withdrawn from the market on 2 November 2026; no new versions will be released. The reporting obligations under Article 14 continue to apply to copies already supplied (Art. 69(3)): we will continue to report actively exploited vulnerabilities and severe security incidents.
TextGenius
Out of scopeWindows program for AI-assisted text improvement, free and open source.
- Support period
- No support period under Art. 13(8) — product not in scope
- Assessment
- Out of scope. Free and open-source software that we do not monetise: no price, no paid support, no use of user data (Art. 3(48), recital 18). If any of this changes, the regulation applies from that day.
Dreamline
Out of scopeOpen-source self-hosted tool that manages memory and dreams for AI assistants.
- Support period
- No support period under Art. 13(8) — product not in scope
- Assessment
- Out of scope. Free and open-source software that we do not monetise: no price, no paid support (Art. 3(48), recital 18). If any of this changes, the regulation applies from that day.
LiedAtlas
Out of scopeOnline service for documenting commercial music use, operated on our own infrastructure; currently paused.
- Support period
- No support period under Art. 13(8) — product not in scope
- Assessment
- Out of scope. No product with digital elements is made available (Art. 3(22)); the service runs on our own infrastructure and, as an online service, is not covered (recital 12).
Techlogia Lab
Out of scopeWeb learning platform for Linux and IT security, operated on our own infrastructure.
- Support period
- No support period under Art. 13(8) — product not in scope
- Assessment
- Out of scope. No product with digital elements is made available for distribution or use (Art. 3(22)). The platform is an online service on our own infrastructure (recital 12). Where our app and our command-line tool use the Lab interface, we assess that interface as their remote data processing.
Reporting a vulnerability
If you find a security vulnerability in one of our products, please report it to the address below. We acknowledge receipt within 48 hours. The full process, the rules for responsible disclosure and the scope are set out in our coordinated vulnerability disclosure policy.
Machine-readable under RFC 9116: /.well-known/security.txt
Read the vulnerability disclosure policyWhat applies from 11 September 2026
Since that day Article 14 CRA applies: manufacturers report actively exploited vulnerabilities and severe security incidents via the single reporting platform (Art. 16), simultaneously to the CSIRT designated as coordinator and to ENISA, within 24 hours as an early warning, within 72 hours with a notification, and subsequently with a final report. Our internal process for this is defined in writing; the owner is responsible. A trial run took place on 8 August 2026.
Bill of materials (SBOM)
For the products in scope we maintain a bill of materials of third-party components in CycloneDX format. It forms part of the technical documentation and is not published generally — nor does the CRA require that. Market surveillance authorities receive it on request; other legitimate requests should go to the security address above.
Why there is no CE marking here
CE marking under the Cyber Resilience Act is tied to the date the remaining provisions take effect: 11 December 2027. Until then we do not apply CE marking under this regulation to our products and issue no declaration of conformity under Annex V. We consider this the more honest route: affixing a mark whose assessment procedure is not yet complete would be the worst possible start for a company that offers an evidence tool. The groundwork is under way: scope assessment and bill of materials are in place for the Techlogia Labs App and the CRA-Akte; for the other products in scope we will prepare them, together with the risk assessment and evidence package for each product, by 11 December 2027.
Status of this page
These details are maintained as soon as anything about them changes. The leading source is our product file; this page reflects its status.
The tool behind it: CRA-Akte