DORA
Last updated on November 6, 2026. Document History
This DORA Addendum supplements the Balsamiq Terms of Service or other agreement under which Balsamiq provides access to our cloud-based products and services.
For financial entities subject to DORA, where this Addendum conflicts with the Terms of Service, this Addendum prevails. Where it conflicts with the Data Processing Agreement, including its Standard Contractual Clauses, the Data Processing Agreement prevails.
1. Introduction & classification
DORA (Digital Operational Resilience Act) is a European law focused on operational resilience of financial institutions and the ICT services they use.
This Addendum applies only to Balsamiq Cloud, our cloud-based SaaS product.
This Addendum does not apply to:
- Balsamiq Wireframes for Desktop, which is locally installed, customer-operated software (not an ICT service under DORA).
- Balsamiq for Jira Data Center and Balsamiq for Confluence Data Center, which are customer-operated software that stores project data within your organization’s Atlassian instance.
- Balsamiq for Jira Cloud and Balsamiq for Confluence Cloud, which store projects on the Atlassian platform. Atlassian is the ICT provider under DORA for the platform. Editing sessions, autosave and real-time collaboration run on Balsamiq’s servers, which keep the temporary copies, image links, public shares and prototype links described under “Atlassian integrations” in our Privacy Policy, and, if you use the AI features, process your prompts and board content, with the AI providers listed in our subprocessors list, and keep the AI inputs and outputs for 60 days after each request, with backups for up to 35 days after that.
Balsamiq Cloud is used for ideation, communication, and documentation within product and design workflows. Balsamiq does not perform operational activities for financial institutions or support any “critical or important functions” under Article 3(22) of Regulation (EU) 2022/2554.
Balsamiq is therefore classified as a non-critical ICT third-party service provider under DORA.
This Addendum provides the contractual information required under Article 30 (Key Contractual Provisions) for non-critical ICT services and may be used for due-diligence assessments in place of proprietary questionnaires.
2. Scope of DORA obligations for vendors
Most obligations under DORA apply to financial entities themselves, not to ICT providers.
Only the baseline contractual elements of Article 30 apply to non-critical providers such as Balsamiq.
✅ What applies to Balsamiq
- High-level security and data protection commitments
- Data location disclosure
- Subprocessor transparency
- Incident notification to customers
- Cooperation with customer-led incident assessments
- Access, export, and deletion of customer data
- Reasonable exit and termination support
- Clear description of services
❌ What does not apply
The following DORA obligations apply only to financial entities and/or critical ICT providers:- ICT third-party risk strategy and governance (Article 28)
- ICT outsourcing register (Article 29)
- Classification of critical or important functions
- Notification to supervisory authorities
- Oversight of critical ICT providers (Articles 31–39)
- Concentration-risk assessment
- Multi-vendor strategy
- Conflicts of interest assessment
- Due-diligence duties imposed on financial entities
3. How Balsamiq meets the applicable DORA requirements (Article 30)
| DORA requirement (Article 30) | How Balsamiq meets this requirement |
| Description of ICT services | Balsamiq Cloud enables teams to create, edit, store, and share wireframes and design documentation. Descriptions of functionality, technical requirements, and customer responsibilities are available in the Terms of Service, Privacy Policy, and product documentation. |
| Locations for data hosting and processing | Balsamiq Cloud stores customer data in secure data centers via AWS, in the United States (AWS US East-1). Enterprise plan customers may choose to store their saved project files, with their snapshots and the images behind new image links, in the European Union (Ireland, AWS EU West-1) instead. Some data always stays in the United States, whatever that choice, for example account and Space information, the temporary working copy of open projects, image rendering, and the AI inputs and outputs kept by Balsamiq's AI server. Details: Cloud data residency. A current list of subprocessors is maintained on our Subprocessors page. New subprocessors are notified in advance, with a right to object, as described in our Data Processing Agreement. Changes to hosting locations are communicated as required by applicable law. Our Data Processing Agreement applies to all customers and is incorporated into the Terms of Service. |
| Availability, integrity, and confidentiality of data |
Balsamiq implements industry-standard security practices, including:
See details by requesting our SOC 2 report. |
| Access, recovery, export, and deletion of customer data | During an active subscription: Customers can export project data (BMPR, PDF, PNG, and others) at any time through standard product functionality. Upon Space closure or termination: Customer Data is available for export for 30 days after Space closure, and is deleted within 60 days after Space closure. If a Space Owner deletes the Space, there is no export period, and it is deleted within 60 days. If Balsamiq suspends or terminates an account for cause (as defined in Section 9.3 of the Terms of Service), Balsamiq will send the Space Owner the Space's projects as BMPR files, if they ask within 30 days of the suspension or termination, unless prohibited by law. Backup data and logs may persist for up to 90 days before permanent deletion. Our customer data commitments are further defined in the Terms of Service and Privacy Policy. |
| Service level descriptions | Balsamiq Cloud service levels and support commitments are described in the Terms of Service. For customers with a cloud-based Enterprise plan, we offer specific Enterprise SLAs regarding uptime and support commitments.
We also maintain a public status page. |
| Incident notification and assistance | If an incident affects the confidentiality, integrity, or availability of customer data, Balsamiq will:
|
| Cooperation with competent authorities | Where required by applicable law, Balsamiq will reasonably cooperate with EU financial regulators or supervisory authorities regarding information relevant to the customer’s use of Balsamiq Cloud, to the extent such information is accessible to Balsamiq. |
| Termination rights | Customers may terminate their Balsamiq Cloud subscription at any time in accordance with our Terms of Service. This means customers already have the contractual right to discontinue use of Balsamiq Cloud whenever required, including if a regulator instructs you to stop using a service under DORA or if continued use presents unacceptable ICT or operational risk. |
| Reasonable exit assistance | Upon termination, Balsamiq will:
|
4. Additional security and compliance information
See our legal resource center or request our SOC 2 report for details.
Security
- SOC 2 Type II compliant (via external audit)
- Encryption in transit and at rest
- Access control and least-privilege principles
- Secure development and change-management practices
- Vendor risk management program
Data protection
- GDPR compliant
- Subprocessor list publicly available on our Subprocessors page
Payments
- Balsamiq does not store, process, or transmit cardholder data
- All Balsamiq Cloud and Balsamiq for Desktop payments are handled by Stripe, a PCI-DSS Level 1 compliant merchant
- All Balsamiq for Jira and Balsamiq for Confluence payments are handled by Atlassian, a PCI-DSS compliant merchant
Business continuity & resilience
- High-availability cloud architecture
- Redundant infrastructure
- Backups and recovery procedures
- Documented business continuity processes
Incident response
- Formal incident response plan
- Monitoring and alerting
- Customer notification for relevant incidents
5. Contact for regulatory or due-diligence inquiries
Please refer to the resources on this page as you fill out your security and compliance forms.
If you have additional questions, you can contact us at support@balsamiq.com.
Document history
- 6 November 2026: Locations for data hosting and processing: Balsamiq Cloud stores customer data in the United States (AWS US East-1), and Enterprise customers may choose to store their saved project files, with their snapshots and the images behind new image links, in the European Union (Ireland, AWS EU West-1) instead, with examples of what always stays in the United States and a link to the Cloud data residency page, which has the details. It used to say Enterprise customers may choose the storage location of customer data. Data protection: the bullet about the subprocessor list now links to the Subprocessors page instead of the Privacy Policy.
- 3 November 2026: For Balsamiq for Jira Cloud and Confluence Cloud, what Balsamiq’s servers keep now matches the Privacy Policy’s “Atlassian integrations” section: also public shares, prototype links, and AI inputs and outputs (kept 60 days after each request, backups 35 more), and no longer “only”.
- 24 October 2026: Customer Data is available for export for 30 days after Space closure (as defined in the Terms of Service) and deleted within 60 days of it, as the Terms, the Privacy Policy and the DPA say; it used to say deletion typically within 30 days of account closure. A Space deleted by its Space Owner has no export period and is deleted within 60 days. After a suspension or termination for cause, the Space Owner can ask for the Space's projects as BMPR files within 30 days. For financial entities subject to DORA, this Addendum prevails over the Terms of Service, and the DPA prevails over it. Exit assistance gives the same 30-day export window. The subprocessor and DPA notes now point to the Subprocessors page and the DPA. Section 1 used to say the Jira and Confluence integrations operate on Atlassian’s cloud infrastructure, with Atlassian as the ICT provider; it now lists the Data Center apps as customer-operated, and says that for the Cloud apps, editing runs on Balsamiq’s servers, which keep temporary copies and image links.
- 17 December 2025: First version.