Reporting Desk
The Reporting Desk watches the components in your products for actively exploited vulnerabilities, alerts two named people, runs the 24-hour, 72-hour and 14-day clocks, and prepares the reports you submit to ENISA. Hosted in Germany.
For manufacturers of products with digital elements sold in the EU.
Fleet Service
CVE-2023-44487 · HTTP/2 Rapid Reset
Early warning due in 23 hNotification in 71 h · final report 14 days after the fix
The obligation
Security of the Reporting Desk
General information, not legal advice.
Through the web interface or the API from any CI pipeline, in CycloneDX or SPDX JSON. We never see your source code.
Components are matched against OSV advisories, and exploitation is checked against CISA KEV and ENISA EUVD.
E-mail and webhook to your two named contacts, with escalation if nobody acknowledges.
Guided forms for each deadline, ready to copy into ENISA’s platform, with the submission recorded.
A tool that shows you a clean result for components it cannot judge is not telling you the truth. You always see what is covered.
Monitored today: npm, PyPI, Maven, Go and NuGet.
Debian and Alpine packages are shown as not monitored, with the reason, until release-aware matching is available: an advisory names one distribution release, and matching does not compare releases yet.
The release gate runs on bills of materials from real open-source projects, and every version comparison is checked against the feeds’ own version lists: 57,283 comparisons in the five supported ecosystems, with no disagreement.
Deadlines are stored with the case, the audit log is append-only in the database, and an alert that reaches nobody raises an alarm with us.
Your bills of materials, cases and reports stay in German data centres. E-mail is delivered by an EU provider, named in the data processing agreement.
Your uploaded bills of materials, case records and the audit log download as files whenever you want them.
Priced per company, with product bundles, because CRA obligations attach to products.
€149 per month
Up to 3 products, fully covered.
€449 per month
For a product portfolio and a team.
€990 per month
For manufacturers with many products.
Prices exclude VAT. Two months free with annual billing.
The application, in the language you read it in. These pictures are the demonstration data, not a customer’s.
Nothing in these pictures belongs to a customer: they are taken from our demonstration account, which is why the banner says so.
No. The Reporting Desk supports the technical process. Whether and how the CRA applies to your products is for you and your legal counsel to decide.
You do, through your own EU Login on ENISA’s Single Reporting Platform. We never submit for you: we prepare the text and record when you submitted it.
In data centres in Germany, operated by the German hosting provider STACKIT. E-mail notifications are delivered by Brevo, an e-mail provider in the EU. Details and safeguards are in our Data Processing Agreement.
The documentation shows how to generate one in your build pipeline with established open-source tools, and how to upload it with one API call.
The case opens and your first contact is alerted. If nobody acknowledges, the second contact is alerted. Acknowledging works straight from the e-mail, and the link works once.
Twenty minutes, your bill of materials, and an honest answer about what we would watch and what we would not.