Skip to main content

Trust portal for approved viewers

The trust portal lets a company share its Cyber Resilience Act compliance records with specific external people it has approved, such as customers, auditors, and distributors. It is an Enterprise feature.

What viewers see​

Approved viewers sign in at your-company.cvdportal.com/trust and see:

  • Compliance documents: EU digital identity verification status (eIDAS 2.0), published security advisories (CSAF/VEX), the Coordinated Vulnerability Disclosure policy (security.txt), a statement that the audit trail is tamper-evident, and vulnerability database scan verification.
  • Products: For each shared product: its CRA classification and conformity route, the security update period, the draft EU Declaration of Conformity, the Annex VII technical-documentation index, and component vulnerability scan status.

Only the latest frozen snapshot of a product is shared, never live in-progress drafts. Every conformity record carries a notice that it does not by itself constitute a presumption of conformity or a guarantee of compliance.

Enabling and customizing published records​

Under Settings → Trust Portal:

  1. Enable the Trust Portal: Master toggle activates the portal at your-company.cvdportal.com/trust. When enabled, all publication options show as enabled by default so viewers receive full transparency immediately.
  2. Select Global Published Sections: Administrators can uncheck/toggle off any section:
    • EU Digital Identity Verification: Proves corporate legal identity under eIDAS 2.0.
    • Published Security Advisories: Links to public CSAF/VEX advisories required by CRA Article 14.
    • Coordinated Vulnerability Disclosure Policy: Displays RFC 9116 security contact and policy details.
    • Tamper-Evident Audit Log Notice: Confirms all compliance actions are hash-chained.
    • Vulnerability Check Verification Summary: Displays global scan verification (e.g. 0 active KEVs).

Product-level publication settings​

On any product page under the Monitoring tab:

  1. Use "Share on trust portal" to include the product in the trust portal index.
  2. Customize which specific artifacts are published for that product:
    • EU Declaration of Conformity (DoC): Provides official CRA compliance declaration text.
    • Annex VII Technical Documentation Index: Displays file index for technical files.
    • Security Update Support Period: Displays committed end-of-support dates.
    • Vulnerability & SBOM Verification: Shows the count of active CISA KEV vulnerabilities in the product components, from the latest snapshot checked against GCVE, OSV and CISA KEV. A count of 0 shows in green with a check icon. A count above 0 shows in red with a warning icon.
    • CycloneDX SBOM Download: Permits viewers to download the software BOM. Disabled by default.
    • CycloneDX HBOM Download: Permits viewers to download the hardware BOM. Disabled by default.
    • CSAF 2.0 Feed and VEX: Displays machine-readable advisory and VEX links. Enabled by default.
    • Remediation SLAs: Displays committed resolution timelines by severity. Enabled by default.

Supplier security evidence​

Approved viewers see a dedicated Supplier security evidence section on the product page. This section consolidates six security verification rows that OT buyers commonly request:

  1. Security support end date (month and year) under CRA Article 13(8), 13(19), and Annex II(7).
  2. Coordinated Vulnerability Disclosure (CVD) policy and security contact under CRA Annex I Part II(5), (6).
  3. Machine-readable advisories and VEX statements via CSAF 2.0 under CRA Annex I Part II(8) and Article 14(8).
  4. Software Bill of Materials (SBOM) in CycloneDX 1.6 JSON format under CRA Annex I Part II(1).
  5. Hardware Bill of Materials (HBOM) in CycloneDX 1.6 JSON format for physical components.
  6. Remediation SLAs by severity detailing manufacturer resolution commitments.

NIST SP 800-82r4 (initial public draft, September 2026) describes supplier requirements for OT operators in section 3.3. Viewers can download the complete machine-readable evidence package as JSON through the Evidence JSON pack link.

Managing viewer access​

  1. Approve Viewers: People can request access directly from the portal, or an administrator can invite an email address.
  2. Single-Use Magic Links: Approved viewers receive a private magic link. Opening the link sets a signed 7-day session cookie on the tenant host and consumes the token.
  3. Revoking Access: Revoke a viewer at any time in Settings → Trust Portal. Access terminates immediately on their next page load.

Delegating a control (assignments)​

Separately from the trust portal, an admin can assign a single CRA control to an outside person to provide information or upload a document. The assignee gets a magic link to a one-off contribution page, and their submission is filed as evidence for that control. See the Evidence tab on a product page.