Ecosystem and Pipeline Connectors
CRA Compliance Integrations and Pipeline Connectors
Connect your existing developer tools, issue trackers, and continuous integration pipelines to CVD Portal. Automated connectors eliminate manual data entry and keep your regulatory compliance dossier up to date.
GitHub SBOM Synchronization
Automates nightly repository scanning and component inventory extraction. Ingests CycloneDX SBOMs directly into product records to satisfy CRA Article 10 component tracking requirements.
Atlassian Cloud (Jira and Confluence)
Synchronizes incoming security submissions into Jira projects for engineering triage. Imports specifications, architecture records, and testing procedures from Confluence spaces into technical files.
Real-Time Team Notifications
Delivers immediate notifications for incoming vulnerability disclosures, 48-hour acknowledgment countdowns, and Article 14 authority reporting deadlines across your operational channels.
SARIF Static Analysis Ingestion
Ingests Static Analysis Results Format (SARIF 2.1.0) reports directly from GitHub Actions, GitLab CI, and container scanners. Fingerprints and deduplicates findings in the Pipeline Findings workspace.
FOSSA Dependency Vulnerability Import
Imports the FOSSA issues API export from your pipeline. Each dependency vulnerability arrives with its CVE, severity, package and fix version, and deduplicates in the Pipeline Findings workspace next to SARIF results.
GRC Evidence Pack for Vanta, Drata and Tidal Control
Downloads 12 months of vulnerability handling evidence as a ZIP of a PDF summary and CSV tables. Upload it to the vulnerability management control of the GRC platform. No report content leaves CVD Portal.
ReqIF Export for Requirements Tools
Downloads the 22 Annex I requirements of a product as a ReqIF 1.2 file, with applicability, sign-off, evidence and EN 40000 clauses. Import it into Jama Connect, Polarion, Codebeamer, DOORS Next or ReqView. Stable identifiers let the tool update on re-import.
SonarQube and SonarCloud Quality Gates
Receives automated build webhook events when a Quality Gate passes or fails. Attaches timestamped proof of secure implementation baselines directly to your product technical file.
OpenVEX Reachability Assessment
Evaluates machine-readable vulnerability exploitability exchange statements. Documents unreachable third-party vulnerabilities to establish non-reportability under CRA Article 14.
Request a Custom Integration or Pipeline Connector
Need support for a specific issue tracker, build system, or vulnerability scanner? Tell us which tool your team uses and how it fits into your CRA compliance workflow.
Building a custom integration?
Explore our comprehensive developer documentation for REST API endpoints, OAuth scopes, webhook payload signatures, and Model Context Protocol (MCP) tool schemas.