Security is the product, not a feature.
cramio handles sensitive vulnerability data, regulatory submissions, and compliance evidence for manufacturers across the EU. We apply the same rigor to our own infrastructure that we help our customers demonstrate to regulators.
No source code exfiltration
Only SBOM metadata and vulnerability findings leave your infrastructure. Source code, build artifacts, and proprietary logic are never transmitted to or stored on our servers.
Tamper-evident Evidence Vault
Evidence records use append-only database controls and SHA-256 hash chaining so later alteration can be detected. This is tamper-evident storage, not independent WORM archival storage.
Documented data boundaries
Customer data is stored in our configured Neon database region. Subprocessors, processing locations, and transfer safeguards are documented contractually; customer-selectable storage regions are not currently offered.
Infrastructure security
Authentication & access control
User authentication uses bcrypt-hashed passwords with a minimum 10-character requirement enforced at registration. Sessions are managed via signed JWT tokens with configurable expiration.
Role-based access control (RBAC) with four tiers — owner, admin, member, and viewer — ensures least-privilege access across all organization resources. API keys support scoped permissions with per-key rate limits.
Data flow & minimization
1. Your infrastructure
SBOMs are generated on your build servers using your preferred tooling (Syft, cdxgen, etc.). Source code never leaves your environment.
2. cramio control plane
Only SBOM metadata (component names, versions, PURLs) and vulnerability findings are transmitted. Database storage is encrypted at rest by the infrastructure provider.
3. Regulatory submission
CRA reports are generated with minimal required fields for ENISA SRP submission. Authority receipts are captured when an operational integration returns one.
Vulnerability disclosure
If you discover a security vulnerability in cramio, we encourage responsible disclosure. Please report findings to security@cramio.eu. We will acknowledge receipt within 24 hours and provide an initial assessment within 72 hours.
We ask that you avoid accessing or modifying other users' data, disrupting services, or publicly disclosing vulnerabilities before we have had an opportunity to address them. We do not pursue legal action against researchers acting in good faith.