EU Cyber Resilience Act · Article 14
Cravault watches your released software for actively-exploited vulnerabilities and turns each alert into a ready-to-file Article 14 report — with the clock already running.
No credit card · 10 minutes to your first SBOM
We match the SBOMs of your released versions against CISA KEV and ENISA EUVD — so you learn the moment a component you ship starts being exploited, not just what is broken in your default branch.
Every RED alert starts the Article 14 timer — early warning (24h), notification (72h), final report (14d) — with SLA reminders to Slack, email and Telegram.
Each alert produces a pre-filled Article 14 report: facts pulled from your SBOM and the vulnerability databases, the narrative drafted for your review, every field marked with its source.
Human-readable advisory PDFs for your users, CSAF 2.0 + CycloneDX VEX exports for your customers, and an append-only evidence vault for auditors.
One GitHub Action — or a single curl line for GitLab/Jenkins. Your source never leaves your pipeline; only the CycloneDX SBOM is uploaded.
KEV, EUVD, OSV and EPSS, across every supported release you still sell — not just the latest.
When something you ship is actively exploited, you get a RED alert and an Article 14 report draft — with the clock already running.
Not sure it works? Run a fire drill anytime — rehearse the whole alert-to-draft flow on your real SBOM, without waiting for a real incident.
Answer a few questions or drop in your SBOM. Nothing is stored.
Answer a few questions to find out whether the Cyber Resilience Act applies to your product — and when the deadlines hit.
Upload an SBOM, see how many components are affected by an actively-exploited vulnerability (CISA KEV / ENISA EUVD).
Check that your CycloneDX or SPDX SBOM parses and how complete its PURLs are.
Unlimited users on every plan. 14-day full-Growth trial. Cancel anytime.
€0 /mo
1 product · monitoring & alerts
€79 /mo
3 products · Article 14 drafts + advisory
€199 /mo
10 products · CSAF/VEX + fire drills + API
€449 /mo
30 products · DPA, SSO, audit-pack export
We're onboarding a small group of design partners before launch. Drop your work email and we'll send you an invite when your spot opens.
We'll email you a link to confirm — no spam, unsubscribe anytime.
Built by people who dogfood it: every Cravault release is monitored by Cravault, on the same Article 14 timelines we ask our customers to keep.
Read our security & disclosure policy →