DORA
Last updated on October 24, 2026. Document History
This DORA Addendum supplements the Balsamiq Terms of Service or other agreement under which Balsamiq provides access to our cloud-based products and services.
For financial entities subject to DORA, where this Addendum conflicts with the Terms of Service, this Addendum prevails. Where it conflicts with the Data Processing Agreement, including its Standard Contractual Clauses, the Data Processing Agreement prevails.
1. Introduction & classification
DORA (Digital Operational Resilience Act) is a European law focused on operational resilience of financial institutions and the ICT services they use.
This Addendum applies only to Balsamiq Cloud, our cloud-based SaaS product.
This Addendum does not apply to:
- Balsamiq Wireframes for Desktop, which is locally installed, customer-operated software (not an ICT service under DORA).
- Balsamiq for Jira Data Center and Balsamiq for Confluence Data Center, which are customer-operated software that stores project data within your organization’s Atlassian instance.
- Balsamiq for Jira Cloud and Balsamiq for Confluence Cloud, which store projects on the Atlassian platform. Atlassian is the ICT provider under DORA for the platform. Editing sessions, autosave and real-time collaboration run on Balsamiq’s servers, which keep only the temporary copies described under “Atlassian integrations” in our Privacy Policy, and the image links you create.
Balsamiq Cloud is used for ideation, communication, and documentation within product and design workflows. Balsamiq does not perform operational activities for financial institutions or support any “critical or important functions” under Article 3(22) of Regulation (EU) 2022/2554.
Balsamiq is therefore classified as a non-critical ICT third-party service provider under DORA.
This Addendum provides the contractual information required under Article 30 (Key Contractual Provisions) for non-critical ICT services and may be used for due-diligence assessments in place of proprietary questionnaires.
2. Scope of DORA obligations for vendors
Most obligations under DORA apply to financial entities themselves, not to ICT providers.
Only the baseline contractual elements of Article 30 apply to non-critical providers such as Balsamiq.
✅ What applies to Balsamiq
- High-level security and data protection commitments
- Data location disclosure
- Subprocessor transparency
- Incident notification to customers
- Cooperation with customer-led incident assessments
- Access, export, and deletion of customer data
- Reasonable exit and termination support
- Clear description of services
❌ What does not apply
The following DORA obligations apply only to financial entities and/or critical ICT providers:- ICT third-party risk strategy and governance (Article 28)
- ICT outsourcing register (Article 29)
- Classification of critical or important functions
- Notification to supervisory authorities
- Oversight of critical ICT providers (Articles 31–39)
- Concentration-risk assessment
- Multi-vendor strategy
- Conflicts of interest assessment
- Due-diligence duties imposed on financial entities
3. How Balsamiq meets the applicable DORA requirements (Article 30)
| DORA requirement (Article 30) | How Balsamiq meets this requirement |
| Description of ICT services | Balsamiq Cloud enables teams to create, edit, store, and share wireframes and design documentation. Descriptions of functionality, technical requirements, and customer responsibilities are available in the Terms of Service, Privacy Policy, and product documentation. |
| Locations for data hosting and processing | Balsamiq Cloud stores customer data in secure data centers via AWS, located in:
A current list of subprocessors is maintained on our Subprocessors page. New subprocessors are notified in advance, with a right to object, as described in our Data Processing Agreement. Changes to hosting locations are communicated as required by applicable law. Our Data Processing Agreement applies to all customers and is incorporated into the Terms of Service. |
| Availability, integrity, and confidentiality of data |
Balsamiq implements industry-standard security practices, including:
See details by requesting our SOC 2 report. |
| Access, recovery, export, and deletion of customer data | During an active subscription: Customers can export project data (BMPR, PDF, PNG, and others) at any time through standard product functionality. Upon Space closure or termination: Customer Data is available for export for 30 days after Space closure, and is deleted within 60 days after Space closure. If a Space Owner deletes the Space, there is no export period, and it is deleted within 60 days. If Balsamiq suspends or terminates an account for cause (as defined in Section 9.3 of the Terms of Service), Balsamiq will send the Space Owner the Space's projects as BMPR files, if they ask within 30 days of the suspension or termination, unless prohibited by law. Backup data and logs may persist for up to 90 days before permanent deletion. Our customer data commitments are further defined in the Terms of Service and Privacy Policy. |
| Service level descriptions | Balsamiq Cloud service levels and support commitments are described in the Terms of Service. For customers with a cloud-based Enterprise plan, we offer specific Enterprise SLAs regarding uptime and support commitments.
We also maintain a public status page. |
| Incident notification and assistance | If an incident affects the confidentiality, integrity, or availability of customer data, Balsamiq will:
|
| Cooperation with competent authorities | Where required by applicable law, Balsamiq will reasonably cooperate with EU financial regulators or supervisory authorities regarding information relevant to the customer’s use of Balsamiq Cloud, to the extent such information is accessible to Balsamiq. |
| Termination rights | Customers may terminate their Balsamiq Cloud subscription at any time in accordance with our Terms of Service. This means customers already have the contractual right to discontinue use of Balsamiq Cloud whenever required, including if a regulator instructs you to stop using a service under DORA or if continued use presents unacceptable ICT or operational risk. |
| Reasonable exit assistance | Upon termination, Balsamiq will:
|
4. Additional security and compliance information
See our legal resource center or request our SOC 2 report for details.
Security
- SOC 2 Type II compliant (via external audit)
- Encryption in transit and at rest
- Access control and least-privilege principles
- Secure development and change-management practices
- Vendor risk management program
Data protection
- GDPR compliant
- Subprocessor list publicly available in our Privacy Policy
Payments
- Balsamiq does not store, process, or transmit cardholder data
- All Balsamiq Cloud and Balsamiq for Desktop payments are handled by Stripe, a PCI-DSS Level 1 compliant merchant
- All Balsamiq for Jira and Balsamiq for Confluence payments are handled by Atlassian, a PCI-DSS compliant merchant
Business continuity & resilience
- High-availability cloud architecture
- Redundant infrastructure
- Backups and recovery procedures
- Documented business continuity processes
Incident response
- Formal incident response plan
- Monitoring and alerting
- Customer notification for relevant incidents
5. Contact for regulatory or due-diligence inquiries
Please refer to the resources on this page as you fill out your security and compliance forms.
If you have additional questions, you can contact us at support@balsamiq.com.
Document history
- 24 October 2026: Customer Data is available for export for 30 days after Space closure (as defined in the Terms of Service) and deleted within 60 days of it, as the Terms, the Privacy Policy and the DPA say; it used to say deletion typically within 30 days of account closure. A Space deleted by its Space Owner has no export period and is deleted within 60 days. After a suspension or termination for cause, the Space Owner can ask for the Space's projects as BMPR files within 30 days. For financial entities subject to DORA, this Addendum prevails over the Terms of Service, and the DPA prevails over it. Exit assistance gives the same 30-day export window. The subprocessor and DPA notes now point to the Subprocessors page and the DPA. Section 1 used to say the Jira and Confluence integrations operate on Atlassian’s cloud infrastructure, with Atlassian as the ICT provider; it now lists the Data Center apps as customer-operated, and says that for the Cloud apps, editing runs on Balsamiq’s servers, which keep temporary copies and image links.
- 17 December 2025: First version.