CetraLog checks your software bill of materials against live exploit data and produces signed, audit-ready reports for the EU Cyber Resilience Act. Your code never leaves your network.
From that day, a manufacturer that learns of an actively exploited vulnerability in its product has 24 hours to file an early warning with its CSIRT and ENISA, 72 hours for the full notification, and 14 days for the final report. The clock starts at awareness, not at the fix.
The rest of the CRA follows on 11 December 2027. Article 14 is the part that starts first.
The build produces an SBOM. A local anonymizer hashes proprietary component names before anything is sent.
Each component is checked against OSV.dev and the CISA KEV catalog. VEX triage removes findings that do not apply.
Every action is hash-chained into a signed ledger. Export CRA notifications and CSAF 2.0 advisories.
Proprietary code stays inside your perimeter. Only sanitized metadata reaches CetraLog.
CycloneDX 1.4 to 1.7, validated against BSI TR-03183-2 on import.
Components matched by PURL against OSV.dev and the CISA KEV catalog.
Mark findings not affected, fixed or under investigation. Justifications are kept for audit and exported as CSAF 2.0.
The 24-hour and 72-hour reporting windows are tracked automatically per finding.
Every compliance action is hash-chained with a SHA-256 receipt.
Tenants stay separate and exchange only signature-verified SBOMs.
Built around EU CRA, BSI TR-03183-2, CISA KEV, NIST SP 800-161 and CSAF 2.0.
I'm Victor Bieszka, a software engineer in aviation and aerospace. In that industry, proving that a system is safe takes enormous rigour. For the software supply chain underneath it, almost no equivalent tooling exists.
The Cyber Resilience Act brings that kind of rigour to every software vendor in the EU: a 24-hour reporting clock and an audit trail that has to hold up. Scanners surface problems. CetraLog turns the response into proof.
CetraLog is a solo venture, EU-based and EU-hosted. As a design partner you work directly with the person writing the code.
A 30-minute walkthrough, from ingestion to a signed report.