What do teams ask before they choose CVD Portal?
Teams that evaluate CVD Portal ask most about Article 14 reporting, ENISA registration, SBOM checks, CSAF advisories, data protection and plans. CVD Portal covers Article 14, SBOM checks and CSAF export on the Reporting plan.
Key takeaways
- The Reporting plan covers Article 14 reporting, the SRP submission package, SBOM checks and CSAF export.
- Your team registers in the ENISA Single Reporting Platform. CVD Portal prepares and checks each submission.
- Automated SBOM alerts, API upload from CI, the GitHub connector, AI triage and SSO need the Enterprise plan.
- The application, the database and stored data are hosted in Hetzner data centres in Germany.
Last updated 12 October 2026.
Prices and limits on this page come from the pricing page. If the two differ, the pricing page is correct.
Article 14 reporting
How does ENISA registration work? Does CVD Portal do it for us?
No. Your company registers in the ENISA Single Reporting Platform (SRP) itself. Each person who submits needs an individual EU Login account. The first registered user becomes the Primary Authorised Representative and can invite backup representatives.
CVD Portal prepares each Article 14 notification with the fields that the SRP asks for. It checks the content against the ENISA field rules and blocks the export until each mandatory field is complete. Your team then copies the checked content into the SRP and records the SRP reference in CVD Portal. The SRP has no public API today. We are building a direct submission route to NCSC-NL, and we will announce it when it is available.
Plan: Reporting. See How do I file an Article 14 report? and the Article 14 SOP.
What happens when a high-severity vulnerability arrives?
- The report arrives on your public portal, and the acknowledgement SLA starts.
- Your team scores the report with the CVSS 3.1 or 4.0 calculator. The score is kept as evidence.
- Your team records whether the vulnerability is actively exploited. CVD Portal shows exploitation evidence from KEV catalogues, sightings and EPSS, but a person makes the decision.
- Your team records the time it became aware of the exploitation. The deadlines run from that time. The early warning is due within 24 hours and the vulnerability notification within 72 hours. The final report is due 14 days after a fix or mitigation is available. For a severe incident, the final report is due one calendar month after the 72-hour incident notification.
- CVD Portal sends deadline alerts by email and webhook.
- Every action goes into an append-only audit log.
Plan: Reporting. See Article 14, Exploitation signals and CVSS calculator.
Which CSIRT receives our notifications?
The CSIRT of the EU member state where your company has its main establishment. If the main establishment is outside the EU, the rule moves to your authorised representative, then to the importer or distributor, then to the member state with most users. The rule is in Article 14(7) of Regulation (EU) 2024/2847. See also Which CSIRT do I report to under the CRA?.
Can AI triage our reports?
Yes, on the Enterprise plan. On the other plans your team triages with the CVSS calculator and the exploitation evidence prompts. Members can triage, and the Article 14 decision stays with admins. See How do I triage a vulnerability report?.
SBOM and vulnerability checks
Do we upload SBOMs, and does CVD Portal check them for known vulnerabilities?
Yes. Upload CycloneDX or SPDX JSON, or a lockfile, under Settings → SBOM Registry. One SBOM can cover all products, or one product only. The upload also goes into the product's technical documentation for Annex VII point 8.
CVD Portal checks each component by its exact version:
- A component with a package URL (purl) is checked against OSV.dev.
- A component with only a CPE that includes the version, for example firmware or a vendor binary, is checked against the NVD.
- A component with neither can still be checked against OSV.dev when its name shows the ecosystem without doubt, for example a scoped npm package or a Go module path.
Other components are stored but not checked. The page shows how many components the check could not cover.
Plan: Reporting. See SBOM Registry.
Our firmware is C and C++. Will the check work?
Yes, if each component carries a package URL with a pinned version, or a CPE that includes the version. A CPE with a wildcard version is not checked. Make sure your SBOM tool writes versioned CPEs for components that have no package ecosystem. To test it, upload one sample SBOM during your trial and read the count of components the check could not cover.
Will we get an alert when a new vulnerability affects our SBOM?
On the Enterprise plan, yes. A daily scan checks every SBOM again. New findings go out in one email digest per company and as threat_intel.match webhooks. A second daily check tells you when an outside source starts to report exploitation of a vulnerability that affects you. On the other plans, open Supply Chain Intel to see the current matches. See Threat intel and Notifications.
Can we send the SBOM from our build pipeline?
Yes, on the Enterprise plan, through the API or the GitHub connector, which reads your repository every night. On the other plans, upload the SBOM by hand after each release. See the API overview.
Can we search all products for one vulnerability?
Yes, on the Compliance plan. See Exposure search.
Advisories
What is CSAF 2.0 advisory export?
CSAF 2.0 is the OASIS standard for machine-readable security advisories in JSON. For a fixed vulnerability, CVD Portal produces an advisory with the product tree, CVE identifiers, CVSS scores, remediation status and VEX status. Your customers' systems can import the file and see if their version is affected. Your portal also publishes advisories at the standard CSAF provider location.
Plan: Reporting. See CSAF export, How do I generate a CSAF advisory? and the user advisory.
Scope and classification
Which of our products does the CRA cover?
Products with digital elements that are placed on the EU market. Some product groups are outside its scope, for example products under the medical device, motor vehicle, aviation and marine rules. Try the free classifier, and read Which products are outside the scope of the CRA? and Which CRA product class is my product in?.
Do we report the same event under the CRA and NIS2?
Possibly. One event can start duties under both laws. CVD Portal covers the CRA duties. See Do I report the same incident under CRA, NIS2 and GDPR?.
We supply a component that another company builds into its product. Who reports?
You report for the product you place on the market. The company that integrates it reports for its own product. Article 13(6) also asks you to tell the maintainers of third-party components about flaws you find in them. See Upstream reporting.
Data and security
Where is our data, and is there a DPA?
The application, the database and stored data are hosted in Hetzner data centres in Germany. Some subprocessors process data outside the EU under Standard Contractual Clauses, for example Cloudflare at the network edge and OpenRouter for the optional AI features. The Trust page lists each subprocessor and its region. The GDPR Article 28 Data Processing Agreement is published at cvdportal.com/dpa, and the subprocessor list is on the Trust page. See Security and data protection.
Can we use single sign-on?
Yes, SAML 2.0 single sign-on is on the Enterprise plan. See Enterprise administration.
Plans and trial
Which plan do we need?
| Plan | Price | What it adds | Team members |
|---|---|---|---|
| Free | €0 | Public disclosure portal, submission tracking, acknowledgement SLA, published policy | 1 |
| Reporting | €99 per month | Article 14 workflow, SRP submission package, SBOM registry, CSAF export, threat intelligence | 3 |
| Compliance | €299 per month | Classification, risk assessment, Annex I checklist, technical file, Declaration of Conformity. Lifecycle support for 3 products, then €99 per month each | 5 |
| Enterprise | Quoted per portfolio | Lifecycle support for 25 products, API and SSO, automated SBOM alerts, trust portal on your own domain | 10 |
Every sign-up includes a 14-day Compliance trial with no credit card. See the pricing page and Billing.
For partners
These answers are for consultancies and authorised representatives that work for manufacturers.
Where are the partner terms?
The partner levels, wholesale discounts and billing modes are on the partner program page. Ask us if your agreement needs different terms.
Where is the training?
The training is public. Start with the Academy and the free CRA manufacturer course. Partner staff take the Partner Academy. These pages are public, so your clients can open the same links.
Can we do the Article 14 work for a client?
Yes. Click Work in in the Partner Console to open the client workspace on a partner seat. You can prepare the Article 14 notification for the client, and every change is recorded under your identity. The client can also do the work itself. See How do I prepare my partner account for client work? and Partner product compliance.
How do we add a client?
Send your client the signup link from the Partner Console, or create the client in the console. The signup link links only new registrations to your partner account. Ask us to link an account that already exists. See How do I onboard a client as a partner?.
Do clients that we add accept the Terms of Service?
Yes. A client that you create accepts the CVD Portal Terms of Service when it opens the activation link and sets a password. A client that signs up through your link accepts the terms when it registers. A partner cannot accept the terms for a client. See How do I onboard a client as a partner?.
Who invoices the client?
You choose per client. With partner invoicing, you set the client's plan in the Partner Console and invoice the client yourself. CVD Portal invoices you at your wholesale rate, and the client sees no payment prompts. With client direct billing, the client buys its own subscription. See Partner client billing.
Did not find your question?
Ask the support assistant in the dashboard, or write to support@cvdportal.com. We add questions that come up often to this page.