Dependency Firewall offer: 50% off the base fee. See pricing

Trust Repositoryfor the Cyber Resilience Act

Collect SBOMs, VEX and support dates from your suppliers, and share your own with your customers.

Book a demo
  • Built in Sweden and hosted in the EU
  • Supply chain security since 2018

Supported formats and standards

  • CycloneDX
  • SPDX
  • VEX
  • ECMA-428 lifecycle
  • Transparency Exchange API
  • PDF assessments

Nobody can tell which SBOM covered which release

Customers ask what is in your software, which vulnerabilities affect it and how long you support it. You ask your suppliers the same.

  • Every customer asks separately

    Each one sends its own questionnaire about SBOMs, vulnerabilities and support dates.

  • Every supplier sends different files

    SBOMs, advisories, VEX or a PDF, each in its own format and on its own schedule.

  • Email keeps no history

    Nobody can say which version covered which release, or who read it.

What the Cyber Resilience Act asks for

The EU Cyber Resilience Act (CRA) sets cybersecurity requirements for products with digital elements sold in the EU, for the components you source from suppliers as well as the code you write.

  • September 11, 2026

    Manufacturers report actively exploited vulnerabilities and severe incidents.

  • December 11, 2027

    The main obligations apply, including the software bill of materials.

Software bill of materials

Draw up an SBOM in a machine-readable format, covering at least the top-level dependencies.

Collect SBOMs from your suppliers and publish your own, per release, in CycloneDX or SPDX.

Due diligence on third-party components

Exercise due diligence when you integrate components sourced from third parties.

Supplier SBOM, VEX and assessments per supplier and release, each SBOM checked against known advisories.

Vulnerability handling

Handle vulnerabilities throughout the product's lifecycle.

Findings per release, and VEX statements that record whether each one affects the product.

Support period

Tell users how long the product receives security updates.

End-of-support and end-of-security-fix dates per version range, published as ECMA-428 (Common Lifecycle Enumeration) documents.

Reporting

Report actively exploited vulnerabilities and severe incidents.

A per-release record of components and findings, so you know which releases are affected.
CRA compliance use case

Publish to customers and collect from suppliers

Collect documents from your suppliers, share your own with your customers, or both.

Publish to your customers

Your customers and partners fetch the current documents themselves and subscribe to updates. When a regulator asks, you share from the same record.

Trust Portal
A branded portal for your products. Each release lists its SBOM, VEX, release notes and lifecycle dates for download.
You decide who sees what
Make a product public, limit it to signed-in organizations, or restrict it to named access groups such as customers under NDA.
Lifecycle events
End of life, end of support and end of security fixes per version range, published as ECMA-428 documents.
Publishing pipeline
Before a release goes out, build an aggregate SBOM for it, enrich the SBOM with vulnerability data and VEX, or redact it.

Collect from your suppliers

Invite the companies that ship parts of your product or the software you use. They publish into their own space.

Supplier onboarding
Invite by email or by short code. The supplier signs up to its own space and sees only its own products and releases.
Automated or manual intake
Suppliers push SBOM, VEX and other transparency documents from their CI/CD pipeline over the REST API, or upload them in the browser.
Vulnerability checks
Every SBOM is checked against known advisories when it arrives, and again whenever it or its VEX changes. The advisory data updates hourly, and findings are deduplicated per release.
Documents that are not SBOMs
Add a supplier yourself and upload a PDF assessment or a signed statement. Replace it with a real SBOM later without losing the history.

Release history until end of life

Trust Repository normalizes, scopes and versions documents on the way in. Every change creates a new revision, and published revisions do not change after the fact. Each release keeps its own findings, VEX statements, downloads and lifecycle dates.

  • Risk and quality on every release

    Component count, SBOM quality issues, vulnerabilities and licenses per release. Each SBOM is checked against the CISA minimum elements, BSI TR-03183-2 (the CRA guideline) and SPDX license rules, so missing producers, missing hashes and invalid license identifiers show up on the release.

  • Record which vulnerabilities affect your product

    Use the standard VEX (Vulnerability Exploitability eXchange) format to record whether each vulnerability affects your product, and why. Publish it with the release, and add a new analysis whenever your assessment changes.

  • What was published and who downloaded it

    Products, releases, suppliers and subscribers, with portal visitors, active subscribers and downloads over time. Signed-in downloads are recorded per document, and the Activity feed lists what your suppliers have published, with each revision's update reason.

  • Vulnerability context from EPSS, KEV and EUVD

    Severity, EPSS, CISA and EU KEV listings, and the EUVD and NVD records for each finding, next to the VEX history for the release.

Compatible with the Transparency Exchange API (ECMA-TC54) and lifecycle metadata (ECMA-428).

Use cases

Questions

How does Trust Repository help with the EU Cyber Resilience Act (CRA)?
It collects the software transparency information that CRA reporting depends on, including the timelines: SBOMs from your suppliers and your own per release, VEX statements, and end-of-life and end-of-support dates. When you report a vulnerability, you can see which releases contain the affected component. Reporting obligations have applied since September 11, 2026, and the main obligations apply from December 11, 2027.
Can Trust Repository help with audits and customer security questionnaires?
Yes. Each release keeps its documents, findings, VEX statements and lifecycle dates in one record. Every change creates a new revision, published revisions do not change after the fact, and signed-in downloads are recorded per document. When an auditor or a customer asks which components you ship and what you know about them, you answer from that record.
Which transparency documents can suppliers publish in Trust Repository?
SBOM in CycloneDX and SPDX, VEX, end-of-life and end-of-support lifecycle events, release notes and signatures. You can also upload PDF assessments or signed statements by hand for suppliers who have nothing machine-readable.
Do suppliers need access to our systems to share SBOMs?
No. A supplier signs up to its own space and sees only its own products and releases. It needs no access to your CI/CD or repositories, and it cannot see your other suppliers.
What happens to supplier documents if a supplier leaves Trust Repository?
Documents from a product you subscribe to are your data from the moment you subscribe. If the supplier later leaves the platform, you keep them.
Does Trust Repository check supplier SBOMs for vulnerabilities?
Yes. Every SBOM is checked against known advisories when it arrives, and again whenever it or its VEX changes. The advisory data updates hourly. Findings are deduplicated per release, and VEX statements record whether each one affects the product.
Can SBOM and VEX uploads be automated from CI/CD?
Yes. The REST API accepts SBOM, VEX and other transparency documents from any CI system with a scoped token. A token can be allowed to upload without being allowed to publish, and webhooks notify your other systems when something is published.
What if a supplier cannot provide an SBOM?
Add the supplier yourself and upload what you do have. A PDF assessment is stored as a dated record, and you can replace it with a real SBOM later without losing the history.
Which standards does Trust Repository support?
SBOM in CycloneDX and SPDX, VEX, and lifecycle metadata as ECMA-428. Trust Repository is compatible with the Transparency Exchange API (ECMA-TC54).
Where is Trust Repository hosted?
In the EU. Bitfront is an EU company. Single-tenant hosting is available with Enterprise agreements.

Also in the Bytesafe platform

Share a release with your customers

In a 30-minute walkthrough we publish a release with its SBOM, VEX and support dates, and show what your customers see on the Trust Portal.

Book a demo