No. Only the CycloneDX SBOM — the list of components and versions — is uploaded. Your source stays in your pipeline.
We raise a RED alert when a vulnerability is on the CISA Known Exploited Vulnerabilities catalog or ENISA’s EUVD — i.e. known to be exploited in the wild — and it affects a component in a version you still ship. Everything else is prioritised by EPSS, not alarmed.
The facts in every Article 14 report come only from your SBOM and the vulnerability databases (KEV, OSV, EUVD, EPSS). The AI only drafts the connective narrative, every field is marked with its source, and nothing is submitted until you review and mark it.
CycloneDX and SPDX. Generate one in CI (for example with Syft) and upload it.
A one-line GitHub Action, or a single curl command for GitLab, Jenkins or any other CI. New product versions are picked up automatically.
Our servers and object storage are hosted in the EU (France). See our Trust page for the full picture on how we handle your data.
No — it complements them. Dependabot patches your default branch; Dependency-Track analyses SBOMs; Vanta/Drata handle SOC 2 / ISO evidence. None of them watch the versions you have released for exploited-in-the-wild vulnerabilities or prepare an Article 14 report in 24 hours. See our comparison pages.
Yes. Free covers one product with continuous monitoring and RED alerts. Paid plans add the Article 14 report drafts, advisory PDFs, CSAF/VEX export, fire drills and more. Every paid plan includes a 14-day full-Growth trial.
Your evidence vault stays exportable, and an optional Archive plan keeps it read-only after cancellation. No lock-in — take everything with you or leave it archived.
