Triaro is a planned hosted service for businesses that make software or devices. It is planned to take in vulnerability reports, help you track the CRA reporting deadlines for the cases you decide are reportable, and compare your supported releases against their SBOMs. It supports your compliance work. It does not certify compliance or give legal advice. Decisions, and responsibility towards the authorities, stay with you. Features, availability and price may change, and joining the waitlist is not an order.
You will open a case for an actively exploited vulnerability or a severe incident you have decided to report. Triaro will show the CRA reporting deadlines you may need to meet, counted from the dates you enter. You decide whether and when a deadline applies.
You will upload an SBOM for each release you support. Triaro will compare it with public vulnerability databases and show you matches to review. Coverage is not complete, so it does not replace your own monitoring.
Triaro will prepare a draft report from your records. You review it, decide, and submit it yourself through the authority's reporting channel. Every decision stays with you.
