EU compliance

PicPrep meets the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Below are the EU declaration of conformity with the CE marking, and the information the Regulation asks every manufacturer to give users, including the support period.

EU declaration of conformity

[DRAFT - to be reviewed, then signed by the manufacturer before the first sale in the EU (task T061)]

Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex V. Declaration No. PP-CRA-[number].

1. Product with digital elements: PicPrep, a desktop application for preparing photographs for publication. Type: software. Versions covered: 1.0.0 and every later version released under the same name. Each version is identified by its version number, shown in Help → About and in the installer's file name.
2. Manufacturer: [Full name], [postal address], Israel. Email: support@getpicprep.com. Website: https://getpicprep.com. No authorised representative is appointed.
3. This declaration of conformity is issued under the sole responsibility of the manufacturer.
4. Object of the declaration: PicPrep, for macOS (Apple silicon and Intel), Windows (x64) and Linux (x64), distributed as a download from https://getpicprep.com to licence holders.
5. The object of the declaration described above is in conformity with the relevant Union harmonisation legislation: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements.
6. Harmonised standards, common specifications or certification: none applied. No harmonised standard under Regulation (EU) 2024/2847 had been published when this declaration was issued. The essential cybersecurity requirements of Annex I are met by the solutions described in the manufacturer's technical documentation.
7. Conformity assessment procedure: internal control (Module A, Annex VIII Part I), as PicPrep is neither an important nor a critical product with digital elements. No notified body was involved.
8. Additional information: support period: security updates for each copy until at least five years after its purchase; the end date is stated at purchase. Single point of contact for vulnerabilities: security@getpicprep.com.

Signed for and on behalf of: [Full name], manufacturer

Place and date of issue: [place], [date]

Name, function: [Full name], owner

Signature: [typed name]

Information for users

The information the EU Cyber Resilience Act asks every manufacturer to give the people who use their product (Regulation (EU) 2024/2847, Annex II). It applies to every version of PicPrep.

Manufacturer

[Full name], [postal address], Israel. Email: support@getpicprep.com. Website: https://getpicprep.com.

Reporting a security problem

Single point of contact: security@getpicprep.com, or Help → Report a security problem inside PicPrep (sent privately). The coordinated vulnerability disclosure policy is at https://getpicprep.com/security/.

The product

PicPrep, a desktop application for macOS, Windows and Linux. Its version number is shown in Help → About and in the installer's file name.

What it is for

PicPrep prepares photographs for publication: you choose photos, arrange them into posts and slides, add a watermark, and export images or short videos. It works on your own computer, by one person at a time.

Security properties:

• Your photos stay on your computer. PicPrep reads your photos from folders you open and never changes them. Exports are written as new files, and an existing file is never overwritten unless you ask.
• Works offline. Everything works without a network connection.
• Network use. PicPrep contacts the network only for its licence, for updates, to check for the end-of-life file, and to send a report you choose to send. The privacy notice at https://getpicprep.com/legal/privacy.html lists each call.
• Local only. Its internal server listens only on your own computer and answers only PicPrep's own windows.
• The assistant cannot change anything. An AI assistant connected to PicPrep can view and propose, but cannot edit, delete or change settings.

Known risks

• Photo files from untrusted sources. Opening a photo or video file crafted by an attacker could exploit a flaw in the image or video decoders inside PicPrep. Keep PicPrep updated, and be careful with files from people you do not know.
• Turning off automatic updates leaves you without security fixes until you install them yourself.
• An unsigned macOS build cannot update itself. Until the macOS app is signed, macOS will not install an update automatically. Download each new version from your account instead.
• Other programs on your computer. Anything else running under your user account can read your files, including PicPrep's drafts. PicPrep cannot protect against malware already on your computer.

EU declaration of conformity

The full EU declaration of conformity, with the CE marking, is at https://getpicprep.com/compliance/.

Security support

Every copy of PicPrep receives security updates, free of charge, until at least five years after its purchase, whether or not the subscription is still active. The end month and year for your copy is shown at purchase and in Settings → Licence. During that period, vulnerabilities are handled as the policy at https://getpicprep.com/security/ describes.

Using PicPrep securely

Installing

• Download PicPrep only from https://getpicprep.com or the link in your purchase email.
• On macOS, macOS checks the developer's signature when you open the app the first time.
• Keep your operating system up to date, and turn on its disk encryption (FileVault, BitLocker or LUKS) if your photos are private.

Updates

• Security updates install automatically by default, on macOS and Windows.
• PicPrep shows a notice when an update is ready. You can restart now or let it install when you quit. You can also postpone a single update.
• On Linux, PicPrep shows a notice with a download link. Install the new version yourself.

How changes affect your data

• Your drafts, settings and licence are kept in PicPrep's user folder, separate from the app. Updating or reinstalling never touches them, and a newer version reads every older version's drafts.
• Exports go only into the folder you choose.

Turning off automatic updates

Settings → Licence → "Install updates automatically". Security updates then wait until you install them yourself.

Removing PicPrep and your data

1. If you have a licence, first release this computer in Settings → Licence, so the licence can be used on another computer.
2. Uninstall the app as you would any other: drag it to the Bin on macOS, use Settings → Apps on Windows, or use your package manager on Linux.

3. Delete PicPrep's user folder. This removes your drafts, settings, licence and any unsent reports:

   • macOS: ~/Library/Application Support/picprep
   • Windows: %APPDATA%\picprep
   • Linux: ~/.config/picprep
4. Your photos and your exports are ordinary files in your own folders. PicPrep never moved them, and removing PicPrep does not delete them.

Deleting the user folder also resets PicPrep to the way it was when first installed.

Software bill of materials

The software bill of materials (SBOM), which lists every component in each release, is not published. It is kept for each release and provided on request to security@getpicprep.com.