CRA evidence for every release, prepared for you.
SBOMs, exploited-vulnerability checks, VEX and ENISA report drafts for device makers with 10 to 249 staff. Your team reviews and signs.
Taking our first founding clients. Or email chhabi@relvault.com
Since 11 September 2026, the reporting duties of Article 14 apply. They also cover products that are already on the market.
11 Sep 2026
Reporting applies
Source: Art. 71, Regulation (EU) 2024/2847
10 Dec 2024
The CRA entered into force
Source: Art. 71, Regulation (EU) 2024/2847
On the market
Products already on the market are covered
Source: Art. 69(3), Regulation (EU) 2024/2847
Reporting applies 11 Sep 2026
The clock starts when you become aware of it.
Within 24 hours of becoming aware.
Within 72 hours, with the details you know.
No later than 14 days after a fix or mitigation is available.
Same first two steps. The last one is slower.
Within 24 hours of becoming aware.
Within 72 hours.
Within one month after the notification.
You decide whether to report, and you file each report. We prepare the drafts.
SBOM
An SBOM lists the software components in a release, with their versions. The CRA asks for at least the top-level dependencies; we list every component we can find. Customers and authorities can ask for it. We build one for each version.
Exploited vulnerability
CISA keeps a public list of such flaws. If a flaw on the list is in your product and you become aware of it, the 24-hour clock starts. With maintenance, we check your SBOMs against the list every day.
VEX
A match on a list does not mean your product is affected. A VEX statement gives the status and the reason. Kavach stamps "not affected" only after your engineer agrees.
For each product family, we prepare the documents that your customers and the authorities can ask for. Each one is filed in your own repository.
A software bill of materials in CycloneDX for each product version, with a note on gaps. SPDX on request.
Every day, we check each SBOM against CISA KEV, the EU Vulnerability Database (EUVD) and OSV.
A draft for each match, with the reason. Your engineer confirms each "not affected" status.
Prefilled templates for the 24-hour early warning, the 72-hour notification and the final report. You file them.
What exists, where it lives, and a list of gaps with owners. With draft policies for disclosure, security contact and support period.
Answers to the CRA questionnaires that your customers send, based on the evidence. You sign and send them.
We do the preparation. Your engineers check it, and your company signs and files.
2 to 3 weeks
To set up one product family
Our aim, not a promise.
4 to 6 hours
Your team's time
An estimate for the whole setup.
Today we do this by hand, with established open-source tools. We automate the repeated steps as we go.
We talk about your products and what your customers ask for. We sign an NDA and a data processing agreement before we see any data.
We list products, versions and support periods. We build an SBOM for each version, from your build or from build files that you send.
We check the SBOMs against exploited-vulnerability lists. We draft VEX, ENISA reports, policies and questionnaire answers.
Your engineers confirm each VEX status. You sign the documents and file each report.
The reporting clock, the evidence it asks for, and how we prepare that evidence for you, in 85 seconds.
We hold as little as possible, for as short a time as possible. This is what we promise.
Your code stays in your own repository where possible. Our access is read-only, and you can remove it at any time.
We sign an NDA and a data processing agreement before we see any data.
Working copies live only on a device that is used for Relvault and nothing else, with full-disk encryption. Never an employer's computer. Never a shared one.
We ask for the data the work needs, and no more.
Not without your written consent.
On every account that touches your work.
We confirm the deletion to you in writing.
If something goes wrong, you hear from us within 24 hours.
A product family is up to 3 related products on one code base.
Setup: you pay 50% at signing and 50% on delivery. Maintenance: invoiced monthly in advance. All prices exclude VAT.
€2,500
per product family, one time
€450
a month, per product family
Relvault is new. The first 3 to 5 clients pay €1,500 for setup instead of €2,500. Their monthly price stays the same for 12 months. In return, we ask for honest feedback and, if you are satisfied, a short testimonial.
We prepare technical evidence. Legal and conformity decisions stay with you and your advisers.
Relvault is run by one software engineer, based in Nepal, who works with clients remotely, in English.
Relvault is new and small. When this site says "we", it means that one engineer. You would be one of the first 3 to 5 clients.
Nepal is 3 h 45 min to 4 h 45 min ahead of Central European Time, so calls fit the European afternoon. The GDPR applies to our work in full.
engineer
Based in Nepal. Works remotely, in English.
No. We prepare evidence. We do not certify products or decide conformity, and we never say that a product meets the CRA. You sign the EU declaration of conformity. Where the CRA requires it, a notified body assesses the product.
No. We do not interpret the law for your case, for example the scope or the product class. When a question needs a lawyer, a test lab or a CRA consultancy, we tell you.
Not always. We can set up open-source SBOM tools in your build pipeline together with your engineers, or run them on build files that you send. We do not ask for long-lived access to your systems. Any access we use is read-only, and you can remove it.
By default, the evidence stays in your own repository. We keep working copies only while the work needs them, encrypted on a dedicated Relvault device in Nepal, and we delete them when the contract ends. We sign an NDA and a data processing agreement before we see any data. We do not put your data into third-party AI tools without your written consent.
Yes, if the work around the SBOM takes your engineers' time. We use your SBOMs as they are and add the rest: the exploited-vulnerability check, VEX drafts, ENISA report drafts, the technical-file index and questionnaire answers.
No. You file it. We prepare the draft and the runbook, so the 24 hours go into the decision and not into the paperwork.
You keep everything. The evidence is in your repository, in open formats (CycloneDX and CSAF). The tools are open source, so your engineers can keep running them. At the end, we hand over a short runbook.
Send a short email. Tell us what your product is and what your customers ask for.
Book a call
