# AA-sec context for AI agents

AA-sec is a Cyber Resilience Platform. It keeps the work required by the EU Cyber
Resilience Act (CRA) in one connected record instead of scattered tools, spreadsheets
and documents.

Site: https://double-a-sec.com/
Demo: https://demo.double-a-sec.com/
Contact: contact@double-a-sec.com

## Model

Product and release are the context. Everything else attaches to a release and keeps
its history, so the lifecycle continues after the product ships.

- **Products & Releases**: the unit of work. Assessments, SBOM and evidence attach to a release.
- **CRA Assessments**: requirements assessed per release; answers carry forward to the next one.
- **SBOM**: component inventory stored as data (SPDX, CycloneDX), read by vulnerability matching and third-party due diligence.
- **Vulnerabilities**: findings matched to components in a release, triaged with recorded reasoning.
- **Evidence**: test results, reviews, decisions and approvals stored where they are produced.
- **Technical Documentation**: the technical file assembled from records that already exist.
- **Article 14 Monitoring**: post-market monitoring of shipped products against reporting duties and deadlines.

## Who it is for

Manufacturers of products with digital elements, software vendors, importers,
distributors and open-source stewards placing products on the EU market, together with
the product security and compliance teams that carry the evidence burden.

## Security

- Data encrypted in transit, at rest and inside the platform.
- Each organisation has its own encryption keys; a leak stops at that organisation.
- Hosted in the EU.
- Annual independent security reviews are planned; results are published once a cycle has run.

## MCP

Two servers, documented at https://double-a-sec.com/mcp/

- **Standalone MCP**: free and open source. Gives an agent security and CRA context for a repository it can already read. No AA-sec account needed.
- **Connected MCP**: connects to the AA-sec platform and exposes the organisation, product, SBOM, vulnerability and evidence context the caller is permitted to see.

AA-sec does not supply an AI assistant and does not choose your model.

## Commercial terms

The complete platform is included in every deployment. Price changes with deployment
scale and selected services, never with feature access. Detail at
https://double-a-sec.com/pricing/

### EU Cloud: AA-sec Platform (Starter Package)

- €490 per month on an annual contract, €590 per month billed month-to-month.
- Includes one organisation, unlimited users, one product, every platform capability
  (CRA, SBOM, vulnerabilities, evidence, documents, reporting, API and MCP) and standard
  connectors.
- Each additional product: +€290 per month. Monthly totals on an annual contract: 2
  products €780, 3 products €1,070, 4 products €1,360, 5 products €1,650.
- 6 or more products: volume pricing by agreement.

### On-prem package

- From €12,000 per year, in the customer's own infrastructure, with unlimited products,
  unlimited users and the entire platform.
- Standard on-prem: AA-sec identity and user management, AA-sec storage, standard API
  connectors, deployment and rollout support.
- Integrated enterprise setup: connection to existing identity, login and SSO, storage
  and internal services, engineering workflows and company-specific systems; the
  boundary is scoped with the customer.

### Services (EU Cloud and on-prem, each priced as its own offer line)

- Product onboarding: €3,900 one-time portfolio setup, included with annual contracts.
- Employee training: from €500 per training; role-specific, remote or on-site, scope
  and group size agreed upfront.
- Custom integrations: company-specific, by agreement, quoted before implementation.
- Fire Alarm Test: by agreement; a simulated critical finding moved through the real
  response workflow, with a workflow report and process recommendations.

All prices exclude applicable VAT. Fair-use safeguards prevent abuse.

There is no card checkout. A website request is non-binding; the commercial
relationship starts with a signed contract. Very small portfolios can ask for the
Small Business Program.

## Further reading

CRA practice articles: https://double-a-sec.com/resources/