CVD Portal is a compliance platform for manufacturers selling products with digital elements into the EU. From 11 September 2026, the EU Cyber Resilience Act (CRA) requires every manufacturer to operate a coordinated vulnerability disclosure process and to report actively exploited vulnerabilities to ENISA and their national CSIRT within 24 hours, with follow-ups at 72 hours and 14 days.
CVD Portal covers the full obligation chain in one product. Each company gets a branded vulnerability disclosure portal on its own subdomain where security researchers submit reports, backed by RFC 9116 security.txt generation and 48-hour acknowledgment tracking. Incoming reports are triaged with AI assistance, scored with CVSS, and tracked against CRA deadlines. When a report meets the Article 14 threshold, the platform prepares an SRP-ready filing package with the deadlines pre-calculated.
Beyond disclosure, the platform includes product classification under Annexes III and IV, an Annex I requirements workspace, SBOM upload with continuous CVE and KEV monitoring, CSAF advisory export, technical documentation support for Annex VII, and the EU Declaration of Conformity. Consultants and resellers can manage multiple client companies from one account.
CVD Portal is built for EU SME manufacturers without a dedicated compliance team. The intake portal and report status tracking are free. Pro adds remediation tracking, Article 14 filing, analytics, SBOM monitoring, and team members. Enterprise adds API access, the CRA exposure scanner, and EU Digital Identity wallet verification.
