CetraLog checks your software bill of materials against live vulnerability and exploit data, records every triage decision in a signed audit ledger, and drafts the Article 14 reports the EU Cyber Resilience Act requires. Your code never leaves your network.
Until the CRA applies in full on 11 December 2027
A manufacturer that learns of an actively exploited vulnerability in its product has 24 hours to file an early warning with its CSIRT and ENISA, and 72 hours for the full vulnerability notification. Both clocks start at awareness, not at the fix. The final report is due 14 days after a fix is available.
Article 14 reporting has applied since 11 September 2026. The rest of the CRA follows on 11 December 2027.
The build produces an SBOM. A local anonymizer hashes proprietary component names before anything is sent.
Each component is checked against OSV.dev and the CISA KEV catalog. VEX triage removes findings that do not apply.
Every action is hash-chained into a signed ledger. Generate the Article 14 early warning, vulnerability notification and final report, and CSAF 2.0 advisories.
Proprietary code stays inside your perimeter. Only sanitized metadata reaches CetraLog.
CycloneDX 1.4 to 1.7, validated against BSI TR-03183-2 on import.
Components matched by PURL against OSV.dev and the CISA KEV catalog.
Mark findings not affected, fixed or under investigation. Justifications are kept for audit and exported as CSAF 2.0.
For each actively exploited finding, CetraLog drafts the 24-hour early warning, the 72-hour vulnerability notification and the final report, covering every content element Article 14(2) requires, and tracks each deadline.
Every compliance action is hash-chained with a SHA-256 receipt.
Tenants stay separate and exchange only signature-verified SBOMs.
Built around EU CRA, BSI TR-03183-2, CISA KEV, NIST SP 800-161 and CSAF 2.0.
I'm Victor Bieszka, a software engineer in aviation and aerospace. In that industry, proving that a system is safe takes enormous rigour. For the software supply chain underneath it, almost no equivalent tooling exists.
The Cyber Resilience Act brings that kind of rigour to every software vendor in the EU: a 24-hour reporting clock and an audit trail that has to hold up.
CetraLog is a solo venture, EU-based and EU-hosted. As a design partner you work directly with the person writing the code.
A 30-minute walkthrough, from ingestion to a signed report.