Is anything you ship being exploited right now?
Drop in your SBOM. We check every component against CISA KEV, ENISA EUVD, OSV and EPSS and tell you whether a CRA Article 14 clock would start. It takes about fifteen seconds.
In force Article 14 has applied since 11 September 2026. Reporting is live.
What this tells you, and what it does not
It is the real engine
The same parser, the same feeds and the same matching our paying customers run. A free tool that disagreed with the paid one would be worse than no tool.
It is a snapshot, not a clock
This answers today. The known-exploited lists change weekly and Article 14 asks you to file an early warning within 24 hours of becoming aware, which no one does by re-uploading a file by hand.
We store nothing
No account, no copy of your file, no record of its contents. It is parsed in memory and discarded when the request ends.
The clock does not run once a quarter
Upload the SBOM once and we watch it. When a component you ship turns up in the exploitation feeds we open a case, start the 24h, 72h and 14-day clocks on your confirmation, draft the ENISA notifications in the platform's own field names, and keep a hash-chained evidence trail.