Your repo.CRA-ready. – CRA compliance software for software manufacturers

For standard CRA products, manufacturers can generally use an internal conformity assessment. We automate and maintain the technical security checks, risk assessment, evidence and documentation needed to support that process. The manufacturer's formal legal responsibilities remain with the manufacturer.

No. CVE monitoring is one input. We combine repository analysis, software inventory, vulnerability intelligence, code security, supply-chain monitoring, security testing, product context and CRA requirements.

Our default architecture is designed to avoid permanently storing customer source code. Repositories are accessed with minimal permissions and analyzed in isolated environments.

Security agents continuously test approved environments and investigate potential attack paths. The goal is not just to detect theoretical issues, but to determine which weaknesses are actually relevant to your product.

Yes. Our goal isn't to replace every scanner you already use. Enterprise customers can feed existing security findings and evidence into the platform.

Not initially. We start with standard software products where internal CRA conformity assessment is possible. Important and critical CRA product categories require additional conformity procedures and are handled separately.

The CRA (Regulation (EU) 2024/2847) entered into force on 10 December 2024. The reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026. All other obligations apply from 11 December 2027.

Actively exploited vulnerabilities and severe incidents affecting the security of your product. An early warning is due within 24 hours of becoming aware, a notification within 72 hours. The final report follows no later than 14 days after a corrective or mitigating measure is available (vulnerabilities) or within one month of the notification (incidents). Reports go to the competent CSIRT via ENISA's Single Reporting Platform.

Generally not. Pure software-as-a-service is not a product with digital elements under the CRA; depending on your company, NIS2 may apply instead. The exception: remote data processing solutions of a product with digital elements – for example the cloud backend without which an app or device cannot perform one of its functions.

Yes. Manufacturers must create a software bill of materials in a machine-readable format covering at least the top-level dependencies. It does not have to be published, but it belongs in the technical documentation and must be provided to market surveillance authorities on request. Nuowei generates the SBOM automatically for every connected repository and keeps it up to date.

The reporting obligations do: they apply to all products with digital elements made available on the market, including those placed on the market before 11 December 2027. The other requirements apply to products placed on the market from 11 December 2027, and to earlier products if they are substantially modified afterwards.

Observe is free for up to 4 repositories. Defend costs EUR 99 per month for up to 8 repositories, plus EUR 5 per additional repository; Enterprise is custom. No seats, no developer licences. Enterprise is priced individually. Nuowei launches in November 2026; you can join the waitlist now.

Up to EUR 15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements and the obligations in Articles 13 and 14. Up to EUR 10 million or 2% for other obligations, and up to EUR 5 million or 1% for incorrect or incomplete information. Micro and small enterprises are not fined for missing the 24-hour early-warning deadline.