Pay for the products you cover
Every plan includes the CRA scope check. Prices exclude VAT.
1 product
- SBOM from your repository or a file
- Weekly vulnerability digest
- CRA scope and class check
- CRA readiness of each product
- Export in CycloneDX
Starter
For a small team with a few products.
€49€39 / month
or €468 a year (€39.00 a month)€468 billed once a year
Get early access3 products
- SBOM at every release (CycloneDX and SPDX)
- Real-time alerts on new vulnerabilities, by e-mail, Slack or Teams
- Exploited-vulnerability watch (CISA KEV, EUVD)
- Reporting clock with ENISA drafts
- Correction times against your targets, with a dated evidence log
- Security questionnaires answered from your product’s records
- A security pack to share with buyers
- Vulnerability disclosure policy and security.txt
- Up to 3 team members
ProRecommended
For makers who must show their file.
€149€119 / month
or €1,428 a year (€119.00 a month)€1,428 billed once a year
Get early access10 products
- Everything in Starter
- Function-level reachability in your CI (npm, PyPI, Java)
- Tickets in GitHub, Jira or Linear
- Guided technical documentation
- Conformity report in PDF
- Components whose support ends before your support period
- Up to 10 team members, and the activity log
Consultant
For firms that look after several clients.
€399€319 / month
or €3,828 a year (€319.00 a month)€3,828 billed once a year
Get early access50 products, any number of clients
- Everything in Pro
- One workspace per client
- Your own logo on reports
- Bulk import of products
Every plan, line by line
| Feature | Free | Starter | Pro | Consultant |
|---|---|---|---|---|
| Watch | ||||
| Products watched | 1 | 3 | 10 | 50 |
| Vulnerability alerts | Weekly digest | As soon as found | As soon as found | As soon as found |
| Exploited-vulnerability watch (CISA KEV, EUVD) | Not included | Included | Included | Included |
| Alerts in Slack and Teams | Not included | Included | Included | Included |
| SBOM export | CycloneDX | CycloneDX, SPDX | CycloneDX, SPDX | CycloneDX, SPDX |
| Releases kept per product | 3 | 50 | 200 | 200 |
| Function-level reachability in your CI | Not included | Not included | Included | Included |
| Tickets in GitHub, Jira or Linear | Not included | Not included | Included | Included |
| Report | ||||
| Reporting clock with ENISA drafts | Not included | Included | Included | Included |
| Correction times, with a dated evidence log | Not included | Included | Included | Included |
| Disclosure policy and security.txt | Not included | Included | Included | Included |
| Prove | ||||
| CRA scope and class check | Included | Included | Included | Included |
| Security questionnaires answered from your records | Not included | Included | Included | Included |
| Security pack to share with buyers | Not included | Included | Included | Included |
| Components whose support ends before yours | Not included | Not included | Included | Included |
| Guided technical documentation | Not included | Not included | Included | Included |
| Conformity report in PDF | Not included | Not included | Included | Included |
| Team | ||||
| Team members | 1 | 3 | 10 | 25 |
| Activity log of the workspace | Not included | Not included | Included | Included |
| One workspace per client, your own logo | Not included | Not included | Not included | Included |
| Storage for your releases | 100 MB | 1 GB | 5 GB | 20 GB |
The audit and the reviewed reports
Produced by Provetry, then read and corrected by a certified security professional (CISSP, OSCP, CEH) before you receive them.
CRA readiness audit
€790 per product
A full gap report against the CRA for one product: scope and class, Annex I requirements, vulnerability handling, disclosure policy and your ENISA reporting procedure. Produced by Provetry, then reviewed and signed off by a certified security expert before it reaches you.
Reviewed reports
€250 per month
Every draft report to ENISA is read and corrected by a certified security expert before you send it. Vulnerability alerts never wait for this review.
Before you choose
Can I try a paid plan first?
Yes: on Free, start a 14-day trial of Pro from the application, with no card. At the end, the workspace goes back to Free by itself unless you chose a plan.
Do you send our reports to ENISA for us?
No. The law puts that duty on the manufacturer, and you keep the final say on whether a vulnerability is actively exploited. On the paid plans, Provetry drafts the early warning, the notification and the final report, counts down the deadlines and reminds you; you submit them through ENISA’s Single Reporting Platform.
Who reviews the reports?
A certified security professional (CISSP, OSCP, CEH) reads every audit report, and every ENISA draft on the Reviewed reports add-on, before it is sent to you.
Is Provetry legal advice?
No. It is a tool and an expert review of your security evidence. For questions of law, such as whether you are the manufacturer or an importer, ask your lawyer.
Does the CRA apply to a pure SaaS product?
Usually not: software offered only as a remote service is generally outside its scope, unless it is the remote data processing of a product you sell. Our free check walks you through the question.
Can we pay yearly?
Yes. Yearly plans cost 20% less than twelve months, and businesses can pay them by bank transfer on invoice, within 30 days, with their purchase order number on the invoice. Otherwise, pay by card or SEPA direct debit. You can cancel a monthly plan at any time.
Where is our data kept?
In the European Union. Read the security page for details.