The compliance infrastructure for EU product security.
cramio is built for PSIRT leaders, compliance officers, and engineering teams who need to meet EU Cyber Resilience Act obligations without slowing down product development. We provide a single control plane for SBOM intelligence, vulnerability management, incident response, and evidence-grade reporting — from detection to ENISA submission.
The CRA changes everything for product teams.
The EU Cyber Resilience Act (Regulation 2024/2847) introduces mandatory cybersecurity requirements for all products with digital elements sold in the EU market. Starting in September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours and maintain continuous vulnerability handling throughout the product lifecycle.
For most organizations, this means building entirely new processes: SBOM generation and maintenance, CVE monitoring, incident classification, tiered reporting preparation for ENISA, and tamper-evident evidence retention for audits.
cramio was built because we saw product security teams struggling to map CRA requirements to their existing toolchains. Vulnerability scanners don't understand reporting deadlines. Ticketing systems don't produce ENISA-compatible submissions. Spreadsheets can't prove chain of custody.
We built the missing layer: a purpose-built compliance platform that connects your SBOM pipeline, vulnerability feeds, and incident workflows into a single system of record that regulators and notified bodies can trust.
Runner architecture
Customer-side agents generate SBOMs locally and send only metadata and findings to the control plane. Your source code never leaves your infrastructure.
CRA-first workflows
State machine-driven incident management aligned to CRA Article 14 reporting windows: 24h early warning, 72h notification, a vulnerability final report after a corrective measure is available, and a severe-incident final report within one month.
Audit-grade evidence
SHA-256 hash-chained Evidence Vault with authority receipt capture when available. Append-only controls make later alteration detectable for regulator review.
What we deliver
Our values
Transparency
We show exactly what data we process, how we store it, and who has access. No black boxes.
Sovereignty
EU-first hosting. Your compliance data stays in the jurisdictions you choose, not ours.
Speed
CRA deadlines are measured in hours, not weeks. Every feature is optimized for time-to-compliance.
Trust
Immutable evidence, cryptographic integrity, and audit trails that regulators can independently verify.
Company
Headquarters
Mainzer Strasse 235, 53179 Bonn, Germany
EU/EEA coverage with regional hosting options
Focus
EU Cyber Resilience Act compliance
SBOM management, vulnerability handling, CRA reporting