FAQ
Fast answers to questions we hear often.
Is my compliance data sent to mlab.sh?
No. The only call made by default is the hourly license check, which sends the license key, the instance id, the application version and the hostname. No provider, contract, assessment, incident or register data ever leaves your infrastructure.
Three features you turn on call other services, and only send what they need:
| Feature | Calls | Sends |
|---|---|---|
| Identifier checks (off by default) | api.gleif.org | The LEIs of your register |
| Public footprint (when you click Scan) | mlab.sh | The provider's domain name |
| Single sign-on and Documents | Your identity provider, your S3 bucket | Sign-ins, and the documents you upload, to services you choose |
Does it produce a valid DORA register of information?
Yes. tprm.mlab.sh generates all 15 EBA ITS templates (Reporting Framework 4.0) with controlled eba_* codes, runs a referential integrity validation, and builds the deposit-ready xBRL-CSV (.zip) package matching the official structure required by DORA Article 28(3). See EBA export.
What does the free tier include?
Up to 5 ICT providers and 3 users, with dashboard, provider management, contracts and their documents, GDPR processor agreements, risk assessments, third-party incidents, single sign-on and the public footprint scan. The DORA register, EBA export, exit strategies, due diligence, audits, concentration and CTPP analysis, DORA incident classification and analytics are unlocked on the Licensed tier. See Licensing.
Can I bring my own MySQL / ClickHouse?
Yes. Drop the mysql and clickhouse services from compose and point DB_HOST/CH_HOST at your managed instances. The app stays stateless apart from its uploads and logs volumes.
Can I run it fully offline?
For up to 7 days at a time, yes. The signed license is kept in the database for 7 days, across restarts. Beyond that the platform is paused until outbound HTTPS to mlab.sh is back and a check succeeds. Data is never touched or deleted while it is paused.
Can several instances share one license?
Yes, one place each: a license has a number of places, and organisations running one instance per entity or branch use the same key everywhere. A license has 1 place unless your contract says otherwise. See Places.
Is the register reviewed by a regulator before I deposit it?
No - tprm.mlab.sh produces the register and the deposit package; you remain responsible for submitting it to your competent authority. The built-in Validate step replays the EBA's own checks (keys, foreign keys, allowed values and the 58 active business rules) and gives the result as the EBA's detailed-feedback.csv, which catches rejection causes before deposit.
How are the controlled EBA codes handled?
Every typed field in the register uses the official DORA 4.0 controlled vocabularies (eba_CT, eba_TA, eba_qCO, eba_GA, eba_CU, eba_ZZ, eba_CO, eba_BT, eba_RP). You pick a human-readable value in the UI and the correct code is emitted on export.
Can I export just one template?
Yes. From /eba/ you can preview and download any single template as CSV, all raw CSVs at once, or the complete deposit package. The register page (/reg/) also offers a full CSV export and direct print.
Can we sign in with Microsoft Entra ID, Okta or Google?
Yes, with OpenID Connect, per organisation, and accounts are created at first sign-in. SAML is not supported. See Single sign-on.
Where are contract documents stored?
In an S3 bucket you provide (AWS, Scaleway, OVHcloud, MinIO, Silo...), never on the application server. Files up to 2 GB by default. See Documents.
Where can I propose a feature?
Email [email protected]. We read everything; release notes live on the changelog.