Securing your supply chain shouldn't cost more than a breach.

Any company that builds or ships software — from startups and SaaS providers to enterprises, agencies, and hardware makers with embedded code.

If your team develops products with digital elements for the EU market, CRACI helps you stay compliant with the Cyber Resilience Act without slowing down development.

An SBOM (Software Bill of Materials) is a complete inventory of every component your software is built from. CRACI generates a provably complete SBOM — including all transitive dependencies — directly from the CI runner, so you know the version you ship is the actual version described by the SBOM. CRACI supports SPDX, CycloneDX, and other industry-standard formats.

No. You pay only for build minutes. There is no monthly fee and no charge per SBOM: every build gets its SBOM, and CRACI keeps re-checking the SBOMs of what you ship against new vulnerabilities.

CRACI provides its own build runner, because the SBOM is recorded inside the runner that does the build, so it cannot run on third-party runners. On GitHub Actions, CRACI is the runner and your runs still show up in the GitHub UI. GitHub Actions is supported today; other CI systems are on the roadmap.

SBOMs export as CycloneDX or SPDX, including transitive dependencies and the vulnerabilities found in their components. The API returns SBOMs, network traces and provenance. There is no report export.

Build minutes are billed at $0.002 per vCPU-minute (€0.0017). A 2-vCPU Linux x86 runner costs $0.004 per minute, against $0.006 per minute for GitHub's standard 2-core Linux runner, about 33% less. CRACI meters per second while GitHub rounds each job up to a whole minute, so pipelines with many short jobs save the most. See GitHub Actions pricing for every runner size, the full comparison with GitHub-hosted runners, or what free CI minutes leave out.

As a CI runner, CRACI is one of the most affordable. At $0.002 per vCPU-minute, metered per second, it lists below GitHub-hosted runners on x64 and below CI platforms that bill per minute, level with Blacksmith on x64. See CI runner prices compared.

As a security tool, CRACI has no license right now. Most supply chain security tools charge per developer, from $16 to $70 per developer per month at 25 developers, on top of the runner minutes. CRACI charges only for build minutes, and those minutes also buy the runner. See supply chain security pricing compared.

Enterprise plans are custom — reach out to talk to sales directly.