CRA Workspace — product, release and evidence operations
Keep product context, customer-specific versions, SBOMs, human vulnerability decisions and reporting records connected.
Workspace Starter
VAT is calculated at checkout from buyer details. Stripe processes payment.
- Amount and product are verified server-side.
- A verified payment webhook activates access.
- We do not store card details.
Workspace Team
VAT is calculated at checkout from buyer details. Stripe processes payment.
- Amount and product are verified server-side.
- A verified payment webhook activates access.
- We do not store card details.
Product → deployment → release → SBOM
Different customers can run different releases or forks. Identify the affected deployment before treating a finding as applicable, assign remediation and retain the evidence of a backport or rollout.
GitLab remains your engineering system
GitLab can remain the source of code, pipelines and findings. Workspace connects selected SBOM and operational records with the relevant product, release, customer and CRA review.
SRP is the submission channel
Workspace retains awareness, legal deadlines, stage responsibility, references and manually supplied submission evidence. It does not claim automatic SRP API access or authority validation.
Work queue and ownership
Assign owners and due dates to retained work items, review the next action and distinguish completed work from evidence still requiring human review. Workspace state is not a guarantee of product security or legal conformity.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.