Securing your supply chain shouldn't cost more than a breach.

Any company that builds or ships software — from startups and SaaS providers to enterprises, agencies, and hardware makers with embedded code.

If your team develops products with digital elements for the EU market, CRACI helps you stay compliant with the Cyber Resilience Act without slowing down development.

An SBOM (Software Bill of Materials) is a complete inventory of every component your software is built from. CRACI generates a provably complete SBOM — including all transitive dependencies — directly from the CI runner, so you know the version you ship is the actual version described by the SBOM. CRACI supports SPDX, CycloneDX, and other industry-standard formats.

These are actively monitored SBOMs — CRACI continuously checks each one against the vulnerability database. You can archive SBOMs so they no longer count against your monthly quota.

CRACI also reports findings to ENISA on your behalf if you have enabled the compliance solution.

CRACI provides its own build runner — SBOM generation has to happen inside CRACI's runner to be accurate and audit-ready, so we can't run on third-party runners. But CRACI integrates natively with your existing platforms: on GitHub, for example, CRACI acts as the runner while your runs still show up in the GitHub UI, and the same works with GitLab, Jenkins, and CircleCI.

Compliance reports can be exported as PDF, HTML, CSV, Excel, or JSON.

Build minutes are billed at €0.002 per vCPU-minute. A 2-vCPU Linux x86 runner costs €0.004 per minute — roughly half the industry standard. Major CI providers typically charge around €0.005–0.008 per minute for a comparable Linux x86 runner (GitHub Actions, for example, is $0.006 per minute for a standard 2-core Linux runner).

Enterprise plans are custom — reach out to talk to the founders directly.