Help centre

From sign-up to your first release watched, in five steps.

Name, kind, your role, CRA category and support period: what each field is for.

The files Provetry reads, what it does with them, and supported releases.

The GitHub action and the GitLab template: an SBOM at every tag, sent on its own.

Exploited first, then the rest: EPSS, the fixed version, components at end of life.

Not affected, affected, fixed or under investigation: record your decision and why.

Suggestions from your CI that a vulnerability is loaded, called or never run, with the evidence.

Early warning, notification, final report: drafts, deadlines and what you submit to ENISA.

A certified security expert reads every draft before it reaches you; the early warning never waits.

A pretend exploited vulnerability starts the 24-hour clock, now or by surprise.

The policy the CRA asks for, written from your answers, and a security.txt to publish and renew before it expires.

One page per product for a buyer: support period, SBOM if you wish, VEX feed, disclosure policy, advisories and correction times, behind a secret link.

A public page per product, CSAF 2.0 advisories signed with OpenPGP, and a VEX feed.

Every decision recorded, chained and timestamped, so you can show what you did and when.

How long each vulnerability took to handle, against the targets you set per severity, and the dated evidence log.

Paste a customer’s questions: answers proposed from your product’s records and your library of past answers.

Technical documentation, Annex I requirements and the EU declaration of conformity, as you fill them in.

Who receives what: by product, by severity, or only exploited vulnerabilities and deadlines.

Exploited or severe vulnerabilities become tickets, by hand or on their own, and are updated once dealt with.

Consultant plan: client workspaces, your logo on the technical documentation, and the bulk import of products.

Owner, admin, member, viewer: who can do what, and keys for your CI.

Choosing, changing or ending a plan, the card, VAT, invoices and the Reviewed reports add-on.

One product, paid once, reviewed by a certified expert: what you get and when.

Passkeys, two-factor authentication, trusted devices, changing your e-mail address or password.

What is encrypted, where it is hosted, how to export it and delete the workspace.