Ketryx vs CVD Portal
Lifecycle management for regulated software that adds SBOM, vulnerability and traceability workflows for the CRA. How does Ketryx compare to CVD Portal for an EU manufacturer subject to the Cyber Resilience Act?
- Headquarters
- Boston, United States
- Category
- Regulated software lifecycle management
- Pricing model
- Free tier for pre-market companies that raised under $2 million. Paid tiers on request (checked November 2026).
How they compare on CRA-critical features
Six rows comparing regulated software lifecycle management with a CRA disclosure and conformity platform under Regulation (EU) 2024/2847.
Where Ketryx is strong
- +Generates SBOMs from package manifests in CycloneDX and SPDX, with a snapshot per release.
- +Runs continuous GHSA and NVD monitoring with automatic vulnerability advisory drafts.
- +Keeps an immutable audit trail with 21 CFR Part 11 electronic signatures.
- +Links requirements to tests and supports ISO 14971 risk management alongside the CRA.
Where the CRA page stops
- !No CRA product classifier is advertised (checked November 2026).
- !No hosted Article 13 vulnerability intake portal or RFC 9116 security.txt is advertised (checked November 2026).
- !The CRA page promises technical files and names SRS, SDD, risk management file, traceability matrix and SBOM outputs. It does not name an Annex VII file structure or an EU Declaration of Conformity generator (checked November 2026).
- !Article 14 support is described as a structured vulnerability report export. An ENISA Single Reporting Platform workflow with 24-hour, 72-hour and 14-day timers is not advertised (checked November 2026).
- !Hosting region is not published on the pricing or CRA capability pages. The free tier is limited to pre-market teams under $2 million in funding (checked November 2026).
The CRA gap
Ketryx is built for regulated engineering teams that already work under 21 CFR Part 11 and ISO 14971. Its CRA page covers release-level SBOMs, GHSA and NVD monitoring, traceability and structured vulnerability report exports. A manufacturer placing a product with digital elements on the EU market still has further CRA duties. The manufacturer must classify the product under Article 32, justify every Annex I requirement, assemble the Annex VII technical documentation and sign the EU Declaration of Conformity. Article 13 requires a public single point of contact for researcher reports, and Article 14 requires 24-hour, 72-hour and final filings to the ENISA Single Reporting Platform.
Why teams pick CVD Portal for CRA
Five things a CRA conformity and disclosure workspace adds alongside Ketryx.
- 1
Hosted Article 13 intake portal at yourcompany.cvdportal.com with RFC 9116 security.txt on the Free tier, with no funding cap.
- 2
Article 14 workflow with 24-hour, 72-hour and final-report timers plus an SRP-ready submission package on Reporting and higher plans.
- 3
Free public classifier at /classify that determines the product class and the Article 32 conformity assessment route.
- 4
Annex I applicability table, Annex VII technical documentation and the EU Declaration of Conformity generated per product on Compliance.
- 5
Imports the CycloneDX or SPDX SBOM that Ketryx exports, with customer data stored in Germany on every plan.
Frequently asked
What is the difference between Ketryx and CVD Portal?
Does Ketryx host a public vulnerability intake portal for Article 13?
How do Ketryx and CVD Portal handle Article 14 reporting?
Can a medical device or regulated software team use Ketryx and CVD Portal together?
How does pricing compare between Ketryx and CVD Portal?
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Ketryx EU Cyber Resilience Act capabilities
- Ketryx pricing
Vendor pages checked on 9 November 2026.
Connect Ketryx release evidence to your CRA conformity file
Import the CycloneDX or SPDX SBOM from Ketryx, then run Article 13 intake, Article 14 reporting and the Annex VII file from one product record. The Article 13 baseline is €0/month.