Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Provetry vs sbomify: which one for the CRA?

6 min read

On this page
  1. In one sentence
  2. Side by side
  3. Where sbomify may suit you better
  4. Where Provetry may suit you better
  5. Using both
  6. What to check before choosing
  7. Sources

sbomify is an SBOM management platform, open source and available hosted or on your own servers. It stores your SBOMs by product, scans them for vulnerabilities and publishes them, with VEX statements and security advisories, in a trust center your customers can visit. Provetry covers part of the same ground, but it starts from your lock files and is built around the duties of the Cyber Resilience Act, in particular the Article 14 reporting deadlines. This page sets out what each offers, as of November 2026, from sbomify’s public pages and ours.

In one sentence

sbomify is a place to keep, share and publish SBOMs, VEX and advisories, with a CRA compliance wizard on its Business plan. Provetry takes a product from its lock files to its CRA duties: SBOM at every release, exploited-vulnerability watch, the Article 14 reporting deadlines with drafts for ENISA’s platform, the disclosure policy and the technical documentation.

Side by side

For each service, the plan that includes a feature is given in brackets. Prices exclude VAT. sbomify shows its prices in dollars. “Not stated” means we did not find it on sbomify’s public pages in November 2026; it may exist all the same.

sbomify Provetry
Model Open source; hosted, or self-hosted (Enterprise offers single-tenant or self-hosted) Hosted, in the EU
Price Community free; Business $159 a month billed yearly or $199 monthly; Enterprise on quote Free for one product, then €49, €149 or €399 a month; 20% off yearly
Trial 14 days of Business A free plan for one product
Plan limits 1 product and 5 components (Community); 5 and 200 (Business); unlimited (Enterprise) 1 product (Free); 3, 10 or 50 products
SBOM input SBOMs you provide, CycloneDX and SPDX, including SPDX 3.0 Lock files of 8 ecosystems, or CycloneDX and SPDX SBOMs in JSON; from CI on paid plans
Vulnerability scanning OSV weekly (Community); OSV and Dependency-Track daily (Business) Weekly digest (Free); real-time alerts (Starter)
Known exploited vulnerabilities, EPSS Not stated Watch of CISA KEV and EUVD (Starter); EPSS (all plans)
VEX CycloneDX, OpenVEX and CSAF Records your assessments and exports OpenVEX (all plans); public VEX feed (paid plans)
Advisories and security.txt CSAF 2.0 feed, security.txt CSAF advisories, disclosure policy and security.txt (paid plans)
Sharing with customers Trust center: public (Community), private or on your own domain (Business) A security pack per product with SBOM and VEX, public or by link (paid plans)
Article 14 reporting Not stated Reporting case opened from the moment you became aware, deadlines counted down, drafts that follow the fields of ENISA’s platform (Starter)
CRA reports and documentation CRA compliance wizard: product profile, SBOM compliance, security and vulnerabilities, user information, review and export of a bundle (Business) Guided dossier, draft EU declaration of conformity, conformity report in PDF (Pro and Consultant)
Reachability Not stated Suggestions from your CI, with evidence (paid plans)
Other Cryptography inventory (CBOM), Transparency Exchange API (Business) Security questionnaires answered from your records, correction times against your targets (paid plans)

Where sbomify may suit you better

  • You want to run it yourself, or read the code. sbomify is open source and can be self-hosted.
  • Your SBOMs already exist, produced by your build or received from suppliers, and you need one place to keep and publish them.
  • A public trust center is what your customers ask for, with SBOMs, VEX and certificates such as SOC 2 or ISO 27001 in one portal, possibly on your own domain.
  • You need a cryptography inventory or the Transparency Exchange API.

Where Provetry may suit you better

  • You do not have an SBOM pipeline yet. Provetry builds the SBOM from the lock files you already have, at every release.
  • You want the exploited-vulnerability watch and the reporting deadlines in the same tool. Provetry watches CISA KEV and ENISA’s EU list, lets you open a reporting case from the moment you became aware, counts down the 24-hour, 72-hour and final-report deadlines and prepares each report in the shape ENISA’s platform asks for. We did not find this on sbomify’s public pages.
  • Your team works in French or German. Provetry’s application and help are available in English, French and German, and so is the disclosure policy it generates.

Using both

They read the same formats. A team can keep sbomify as its SBOM store and trust center and use Provetry for the reporting deadlines and the CRA file of the products placed on the EU market, sending the same CycloneDX or SPDX SBOM to each.

What to check before choosing

  • Check how each one counts what you have. sbomify’s plans count products and components, Provetry’s count products; ask how your own portfolio would be counted.
  • Who will write the ENISA reports? Under Article 14, an early warning is due within 24 hours of becoming aware of an actively exploited vulnerability in your product. Decide now which tool, and which person, will produce it.
  • Is your product even in scope? Many SaaS products are not. The free check tells you in a few minutes.

Provetry is not affiliated with sbomify. The facts above were checked on 13 November 2026 against sbomify’s pricing and features pages and its GitHub repository; if something has changed or is missing, tell us at hello@provetry.com and we will correct it.

Sources