Why we exist
CVD Portal is built by Porta Regulus B.V., a Dutch company. The Cyber Resilience Act's Article 14 reporting obligations, which apply from 11 September 2026, land hardest on the SMEs that cannot build disclosure infrastructure themselves. We built the infrastructure so they do not have to.
How we make money
Receiving and tracking vulnerability reports on CVD Portal is free, with no time limit, because we want to be the disclosure layer for thousands of EU manufacturers. We make money when companies upgrade for the full CRA workflow, which adds the Article 14 filing package, their own domain, audit-ready evidence exports and the CRA self-assessment. That's the entire model. We don't sell data, run ads, or harvest vulnerability reports.
What you can expect from us
- 01
No compliance team needed
Guided steps take you from portal setup to a prepared Article 14 notification. You do not need to hire a CRA specialist before you start.
- 02
You make every decision
AI suggests severity, CVSS and duplicates, and drafts CRA documents. A person applies or approves each one. The software never marks a vulnerability as actively exploited, so the Article 14 decision stays with you.
- 03
Open standards with no lock-in
Advisories export as CSAF 2.0, assessments as OSCAL, and identifiers follow CVE and GCVE. Your records stay readable in other tools if you leave.
- 04
The free tier stays free
Receiving, tracking and acknowledging vulnerability reports costs nothing, with no time limit. You pay only when you need Article 14 filing preparation or the CRA self-assessment.
Who operates this platform
How we handle your data, where it lives, and how we test our own security is documented on the Trust and Security page.
Who it is for and who controls the data
What is CVD Portal?
CVD Portal is a vulnerability disclosure and Cyber Resilience Act compliance platform for manufacturers. Each company gets a branded portal where security researchers report vulnerabilities, and a dashboard to triage reports and prepare and track Article 14 notifications. A person submits each notification on the ENISA Single Reporting Platform.
Who is CVD Portal for?
CVD Portal is for manufacturers of products with digital elements sold in the EU, mostly SMEs without a dedicated compliance team. Compliance managers, product security leads and the consultants who onboard manufacturers also use it.
Do I need to be based in the EU to use CVD Portal?
No. The Cyber Resilience Act applies to any manufacturer that places products with digital elements on the EU market, wherever the manufacturer is based. CVD Portal accepts companies from any country and stores customer data in the EU.
Which standards does CVD Portal use?
CVD Portal publishes advisories in CSAF 2.0 with VEX, generates security.txt files to RFC 9116, issues GCVE identifiers as GCVE Numbering Authority 126, and exports CRA assessments in OSCAL.
Who is responsible for the accuracy of vulnerability and compliance data in CVD Portal?
The manufacturer stays legally responsible under the Cyber Resilience Act for its vulnerability reports, risk assessment and EU Declaration of Conformity. CVD Portal drafts and organises the material, and a person at the manufacturer approves it.
Is the CVD Portal free tier free for good?
Yes. The CVD Portal Free tier receives, tracks and acknowledges vulnerability reports with no fee and no time limit. Article 14 filing preparation and the CRA self-assessment are on the paid Reporting and Compliance tiers.
Set up your portal
A branded vulnerability disclosure portal for the Cyber Resilience Act. Free to receive and track reports, with no time limit.
Create my free CVD portalCreate your free CVD portal