Manufacturers
Hardware and software with digital elements placed on the EU market.
Secure by Evidence
Cyber Resilience Platform
AA-sec helps product teams manage security evidence, SBOMs, vulnerabilities, and compliance workflows in one connected lifecycle.
Scope
Does the Cyber Resilience Act apply to what you ship?
The CRA covers products with digital elements placed on the EU market. If you build, ship, import or distribute one, the obligations reach you.
Software vendors
Standalone software supplied in the course of a commercial activity.
Importers
Verification that the manufacturer met its obligations before you place the product.
Distributors
Due care that CE marking and manufacturer documentation are actually in place.
Open-source stewards
A lighter but real regime for stewards of commercially used projects.
Product security and compliance
The people who carry the evidence burden through every release cycle.
The problem
The work already exists. It just isn't connected.
The CRA is not a one-time audit. It runs across the whole product lifecycle, and the proof of that work usually sits in places that never talk to each other.
Every release restarts the search.
- Scanners and build pipelines Tools
- Risk and requirement trackers Spreadsheets
- Technical files and reports Documents
- Security, product and legal Teams
- Assessments repeated per release One-off processes
Who we are
Built by engineers for engineers.
AA-sec comes from people who have carried security and compliance evidence through real release cycles.
Security-critical systems
Experience with regulated and safety-relevant products, not security theory.
Engineering discipline
The platform is versioned, tested and reviewed like the products it serves.
Evidence by design
Decisions, assessments and documents are stored so they can be shown later.
European context
European product, European hosting, EU regulatory scope as the starting point.
The model
One product record. One connected lifecycle.
Product and release are the context. Everything else attaches to them and keeps its history, so the lifecycle continues after the product ships.
AA-sec
Platform
Platform
-
Products & Releases
Every product and release is the context everything else hangs on. Change the release, and the assessments, SBOM and evidence attached to it move with it. -
CRA Assessments
Requirements are assessed against a specific release, not against the company. Answers carry forward, so the next release starts from the last one. -
SBOM
The component inventory for a release, kept as data rather than an export. It is what vulnerability matching and third-party due diligence read from. -
Vulnerabilities
Findings land against the components they affect and stay attached to the release. Triage decisions are recorded with the reasoning, not just the status. -
Evidence
Test results, reviews, decisions and approvals stored where they were produced, collected as work happens rather than reconstructed before an audit. -
Technical Documentation
The technical file assembles from records that already exist: product scope, assessments, SBOM, vulnerability handling and evidence. -
Article 14 Monitoring
The lifecycle continues after release. New findings on shipped products are tracked against reporting duties and their deadlines.
Products & Releases
Every product and release is the context everything else hangs on. Change the release, and the assessments, SBOM and evidence attached to it move with it.
Platform
Every part of CRA work. In one place.
Select a capability to see what it covers.
Scope everything to a release
Products and their releases are the unit of work. Everything else attaches to one.
- Product and release records
- Release-scoped assessment state
- Version history and comparison
- Portfolio overview
Requirements tracked per release
CRA requirements assessed against a concrete release, with answers carried forward.
- Requirement assessments
- Carry-forward between releases
- Open-item tracking
- Readiness per release
Component inventory as data
SBOMs stored as structured data so the rest of the platform can read them.
- SPDX and CycloneDX import
- Component and licence inventory
- Change detection between releases
- Third-party due diligence input
Findings tied to components
Vulnerabilities matched to the components in a release and triaged with recorded reasoning.
- Component-level matching
- Triage with rationale
- Exploitability and severity context
- Status across releases
Proof collected as work happens
Evidence attaches where it is produced, so it need not be reconstructed later.
- Test and review artefacts
- Decision records
- Linking to requirements
- Retrieval by release
The technical file, assembled
Technical documentation built from records that already exist in the platform.
- Technical documentation structure
- Generation from platform records
- Versioned document state
- Export for review
Obligations after release
Post-market monitoring of shipped products against CRA reporting duties.
- Findings on released products
- Reporting deadline tracking
- Notification preparation
- History of handled cases
Connect what you already run
The platform reads from the tools already in your pipeline rather than replacing them.
- REST API
- Pipeline and scanner ingestion
- MCP server for AI agents
- Standard connectors included
Security
Protecting your data is our main job.
Product security information is commercially sensitive. The platform is built so that it stays yours.
Encryption throughout the platform
Data is encrypted in transit, at rest, and inside the platform wherever it is stored.
Separate encryption per organisation
Each organisation has its own encryption keys. A leak stops there.
European hosting
Platform data is hosted in the EU, under European legal and operational context.
Planned annual independent security reviews
An annual independent review cycle is planned. Results are published once a cycle has run.
Demo
Open the product. Click through it.
No sales call needed to understand the workflow.
Browser demoMock dataNo setup
Pricing
One package. It grows with your portfolio.
Starter Package
€490 / mo
- 1 organisation, unlimited users
- 1 product included
- All platform features*
- Standard connectors
* Fair-use safeguards apply only to protect service health and prevent abuse.
Additional product
+€290
per product, per month
Full onboarding package
€3,900
Free on annual
optional, one-time
On-premise
from
€12,000
per year
Prices exclude applicable VAT.
Small Business Program
Very small portfolio? Tell us about your case.
If the standard package is out of proportion to your company and product scale, small-business requests are reviewed individually.
Order & contact
Tell us what you ship. We will show you the rest.
Ask for a walkthrough, a price, or a straight answer, and an engineer replies.