See the system of record before the call.

Every obligation attaches to a product placed on the EU market. The registry holds lifecycle state, classification with reasoning and approver, owners, support period, versions and SBOM status — and shows gaps as gaps.

One deduplicated catalogue across every SBOM, keyed by package URL: which products contain a component, whether it is a direct or transitive dependency, its licence and its current exposure.

An SBOM arrives from CI, the API, the GitHub App or an upload. The original file is preserved with its checksum; components are parsed, deduplicated, diffed against the previous version and matched — every step timestamped.

Ranked by exploitation evidence, not alphabetically. Every row carries the product on the market it affects, the human triage state with its reason, the explicit CRA review answer and the remediation owner.

Priority is explainable: each factor and its weight are shown on the finding, and organisations can tune the weights. Reachability is recorded by a reviewer; Vellaci never infers it.

From a finding to a final report, every step has a person, a timestamp and a recorded reason. Awareness is confirmed by a named person under a written rule — that confirmation, not a ticket timestamp, starts the Article 14 clocks.

Deadlines are computed server-side from the confirmed awareness time in the organisation's timezone. Forms are staged with required, recommended and missing indicators; the manufacturer submits through the ENISA platform and records the submission with evidence.

Private, checksummed files and links tied to products, requirements, findings and cases — with classification, review dates, retention category and legal hold. This is what an auditor or an authority is shown.

An append-only, hash-chained log per organisation: who changed which decision, when, with the previous and new value. Verifiable and exportable; it cannot be edited, not even by Vellaci.