Excalidraw

Digital Operational Resilience Act Addendum (DORA)

Version: 2026-10-14

This DORA Addendum (“Addendum”) supplements the Excalidraw Terms of Use or other agreement under which Excalidraw s.r.o. (“Excalidraw”) provides access to Excalidraw+.

If this Addendum conflicts with the Terms of Use, this Addendum prevails in relation to its DORA commitments. The DPA’s data-protection safeguards and the precedence of applicable Standard Contractual Clauses remain unaffected.

1. Introduction & classification

DORA (Digital Operational Resilience Act) is a European law focused on operational resilience of financial institutions and the ICT services they use.

This Addendum applies only to Excalidraw+, our cloud-based SaaS product, when used by a financial entity subject to DORA.

This Addendum does not apply to:

  • The standalone free Excalidraw editor available at excalidraw.com.
  • Customer-operated deployments of Excalidraw’s open-source software or independently supplied third-party integrations.

Excalidraw+ is used for brainstorming, visual communication, and documentation within product, design, and other collaborative workflows. It is not intended to support “critical or important functions” within the meaning of Article 3(22) of Regulation (EU) 2022/2554.

Excalidraw is therefore classified as a non-critical ICT third-party service provider. This Addendum covers use of Excalidraw+ that does not support critical or important functions, as assessed by the financial institution customer.

This Addendum sets out the contractual provisions required under Article 30(1) and (2) of DORA for that use and may be used for due-diligence assessments, including in place of proprietary questionnaires where accepted by the customer.

2. Scope of DORA obligations for vendors

Most obligations under DORA apply to financial entities themselves, not to ICT providers.

The baseline contractual requirements of Article 30(1) and (2) apply to the use covered by this Addendum.

What applies to Excalidraw

  • Security and data protection commitments
  • Data location disclosure and advance notice of location changes
  • Subprocessor transparency
  • Incident notification and assistance with customer-led assessments
  • Access, recovery, export, and deletion of customer data
  • Service level descriptions, termination rights and exit support
  • Cooperation with competent and resolution authorities
  • Clear description of services and conditions for relevant training participation

Responsibilities that remain with the financial entity

The following remain the financial entity’s responsibilities, to the extent applicable under DORA:

  • ICT third-party risk strategy and governance (Article 28)
  • Maintaining the ICT register of information (Article 28(3))
  • Assessing whether its use of ICT services supports critical or important functions
  • The financial entity’s reporting and notification obligations to supervisory authorities
  • Concentration-risk assessment (Article 29)
  • Multi-vendor strategy
  • Conflicts of interest assessment
  • Due-diligence duties imposed on financial entities

The separate DORA oversight framework for critical ICT third-party service providers applies to providers designated as critical under Article 31.

These distinctions do not limit Excalidraw’s contractual obligations under this Addendum, including its commitments to provide information, assistance and cooperation.

3. How Excalidraw meets the applicable DORA requirements (Article 30)

DORA requirement (Article 30)

How Excalidraw meets this requirement

Description of ICT services
Article 30(2)(a)

Excalidraw+ enables teams to create, edit, store, synchronize, export, and share drawings, diagrams, and visual documentation.

Descriptions of functionality, technical requirements, and customer responsibilities are available in the Terms of Use, Privacy Policy, and product documentation. Personal-data processing is addressed in the DPA and its annexes.

Locations for data hosting and processing
Article 30(2)(b)

Excalidraw+ stores customer data in the United States. Excalidraw personnel access to customer personal data is restricted to the European Union, as described in our DPA.

A current list of subprocessors is maintained in our Trust Center.

Excalidraw will notify customers by email in advance of planned changes to hosting or processing locations. Subprocessor changes are notified in accordance with our DPA.

Availability, authenticity, integrity, and confidentiality of data
Article 30(2)(c)

Excalidraw maintains security measures to protect personal and non-personal customer data, including:

  • SOC 2 Type II compliance (certified via external audit)
  • Encryption in transit and at rest
  • Access controls and least-privilege principles
  • Secure software development and vulnerability management
  • Monitoring and logging
  • Backup and recovery procedures

Our security measures for personal data are further described in our DPA and its annexes.

SOC 2 Type 1 and Type 2 reports are available through our Trust Center.

Access, recovery, export, and deletion of customer data
Article 30(2)(d)

Workspace administrators can export their workspace’s drawings at any time through workspace settings, including after subscription cancellation. After workspace deletion, self-service export is unavailable; customers may contact support@excalidraw.com for assistance, subject to data still being available.

Upon termination, insolvency, resolution or discontinuation of its business operations, Excalidraw will ensure access, recovery and return of personal and non-personal customer data in an easily accessible format, through self-service export or alternative means where necessary.

Service level descriptions
Article 30(2)(e)

Excalidraw+ availability and service interruptions are addressed in our Terms of Use. Continuous availability is not guaranteed.

Customers may contact support@excalidraw.com for assistance. Users and other customer personnel should contact their workspace administrator first for administrative requests. We aim to respond promptly, but response times may vary and are not guaranteed.

Updates and revisions to these service-level descriptions will be communicated to customers by email.

We maintain a public status page.

Incident notification and assistance
Article 30(2)(f)

If an ICT incident affects the customer’s use of Excalidraw+ or the confidentiality, integrity, authenticity or availability of customer data, Excalidraw will:

  1. Notify the customer without undue delay after becoming aware of the incident.
  2. Provide assistance and reasonably requested information needed for the customer’s incident assessments and related regulatory reporting.
  3. Provide relevant updates and reasonably requested information on how the incident was managed and resolved.

This incident assistance is provided at no additional cost. Personal-data breach notifications are also governed by our DPA.

Cooperation with competent authorities

Excalidraw will reasonably cooperate with competent EU financial regulators, supervisory authorities, and resolution authorities regarding matters directly related to the customer's use of Excalidraw+, to the extent such cooperation is required by applicable law and relates to information reasonably available to Excalidraw.

Termination rights
Article 30(2)(h)

Customers may cancel their Excalidraw+ subscription at any time through their account settings, in accordance with our Terms of Use. Cancellation takes effect at the end of the current prepaid subscription period. No minimum advance cancellation notice is required.

Customers may terminate their subscription with immediate effect by written notice to support@excalidraw.com where required by a competent authority or in any of the circumstances specified in Article 28(7) of DORA. This right applies notwithstanding the ordinary cancellation timing above.

Reasonable exit assistance

Upon termination, Excalidraw will:

  • Provide access to and return of customer data as described in the “Access, recovery, export, and deletion of customer data” section above.
  • Handle personal-data retention and deletion in accordance with our DPA.
  • No custom or extended migration support is provided. This does not limit the data-access and return commitments above.

4. Additional security and compliance information

See our Security and Compliance page and Trust Center, or request our SOC 2 reports for details.

Security

  • SOC 2 Type 1 and Type 2 reports
  • Encryption in transit and at rest
  • Access control and least-privilege principles
  • Secure development and change-management practices
  • Vendor security assessment and monitoring

Data protection

  • Personal-data processing and applicable safeguards are addressed in our DPA and its annexes
  • A current subprocessor list is available in our Trust Center

Payments

  • Excalidraw+ payments are handled by Stripe (a PCI-DSS Level 1 compliant merchant). Excalidraw does not store customers’ credit card details

Business continuity & resilience

  • Regular database backups
  • High-availability cloud architecture
  • Redundant infrastructure
  • Documented business continuity processes

Incident response

  • Formal incident response plan
  • Monitoring and logging
  • Customer notification under this Addendum and the DPA

5. Contact for regulatory or due-diligence inquiries

Please refer to the resources below when completing your security and compliance forms. If you have additional questions, contact us at support@excalidraw.com.