Frequently asked questions, short answers

euvex does not say: classifying a product is a legal question, and the answer remains yours. What it gives you to judge: the scope of the RED and its cyber requirements, with the text to back it, and every deadline with its source in the Official Journal, on the key dates.

In the console, an act that does not concern a product is declared “does not apply” for that product: it leaves its EU declaration of conformity.

No. euvex structures, dates and assembles your file; it does not classify your product for you, and it signs nothing. The key dates publish each deadline with its source in the Official Journal, so that you can check it yourself.

Yes, if it is in CycloneDX JSON (versions 1.2 to 1.6) or in SPDX (2.2 and 2.3 in JSON or tag-value, 3.0 in JSON-LD): it imports as it is. The SPDX of Yocto 5.1 and later can be uploaded directly; the .spdx.tar.zst archive of Yocto 5.0 cannot. Components in pkg:generic, which these chains often produce, are looked up in the NVD by CPE; those that offer neither a CPE nor an exact version stay “not analysed”, never counted as clean.

Keep them. A generator takes a photo of a piece of software on the day it runs; exported as CycloneDX JSON, versions 1.2 to 1.6, its SBOM imports into euvex as it is.

What euvex adds is what happens afterwards: the daily recheck and the email on a new vulnerability, the dated history of revisions, the cross-check against the catalogue of actively exploited vulnerabilities for Art. 14, the CRA, RED and Machinery questionnaires, and the EU declaration that brings it all together. The details, part by part.

They do not answer the same question. An organisation-level compliance platform answers “is my company in order”: policies, controls, one entity. euvex answers “this product, in this version, what does its file say”: a product line, its versions, the bill of materials of each, its history and its EU declaration of conformity.

One does not replace the other: an organisation's compliance does not stand in for a file for each of its products, and a product file says nothing about the organisation.

OSV.dev at upload and at every recheck; the NVD, by CPE identifier, for the components OSV does not resolve; ENISA's European database, to attach a vulnerability's European identifier; the CISA KEV catalogue for active exploitation. The details, and the limits of each, are on the Our sources page.

One pass every ten minutes, and each scan is rechecked once a day. A scan can also be rechecked from its page, at most once an hour: against OSV only, and without an email.

No. Zero means that no published vulnerability is known to the sources queried for these components. A flaw that is not yet published is not there, by definition.

Anyone who has a scan's address can see it, without an account: that is what lets you pass it to an auditor. Scan pages are not indexed by search engines. Treat the address like a password.

No. It is read, turned into a bill of materials, then discarded: only the bill of materials and the file's fingerprint are stored.

The application and the database are in Frankfurt, at Vercel and Supabase; emails leave from Ireland, through Resend. Not everything stays in the Union: Cloudflare, an American company, serves the DNS, the scheduled tasks, the anti-bot check and the forwarding of contact addresses, and an encrypted copy of the database is kept for fourteen days at GitHub, an American company.

The details, provider by provider, are in the privacy policyFR (in French).

In the console settings, “Download my data”: a JSON file with the account, the two-factor authentication status, the open sessions, the settings, the products and their declarations, the reporting cases, the alerts, the action log, your support requests, and for each scan the link to its archive. Each scan can also be downloaded as CycloneDX 1.5, or as an archive of all its revisions.

What you have downloaded no longer depends on us. Each scan's archive contains all its revisions in standard CycloneDX, dated at capture. The account export, in your settings, gathers your products, your CRA, RED and Machinery questionnaires, your Art. 14 cases and your alerts in one JSON file. Both can be downloaded at any time, without asking. Keep a copy with your technical documentation, which must remain available for at least ten years.

The account is deleted in the settings, with no grace period: the account, its products, its cases and its alerts are erased. Scans are not: they are detached from the account, their alert address is emptied, and they stay readable through their address. To have a scan erased, write to support: the erasure is real, all its revisions go and its link stops working, including the one given to an auditor. It is refused while an Art. 14 reporting case that is still open depends on it: “Clore le dossier” (close the case) first, from “Signalements” (reporting).

Nothing without you. During the beta no card is asked for, so nothing can be charged, and a beta account will not turn into a paid account on its own: the paid offer will be announced, and subscribed to explicitly.

The price was set on 4 September 2026. It is shown on the pricing page at launch, and in any case to the account that subscribes, before any payment. The billing unit will be the product line, not the version: a new version of a product already covered costs nothing more.

Accounts opened during the beta are entitled to founding member status if they subscribe within the twelve months after the price is shown: half the public price, with no time limit, as long as the subscription is not interrupted. The commitments are written in Article 8 of the terms of useFR (in French).

Not today. An account has one address and one holder; team accounts, with several members and their roles, are not built. A scan can be shared read-only through its link, and every document in the file can be printed.

If that is what holds you back, tell us at contact@euvex.eu: these requests will decide the shape of team accounts.

They are on the pricing page: its frequently asked questions, and a section for your purchasing department. They are not copied here, so that a price is written in only one place.

No. It opens the case, keeps the three deadlines and prepares the content of the reports; submitting them on the single reporting platform, to the CSIRT designated as coordinator and to ENISA, remains your action. The printable file says so, and so does the email.

No. It is “issued under the sole responsibility of the manufacturer” (Machinery Regulation, Annex V, Part A, point 4). euvex assembles it from your parts and flags what blocks it; checking it, completing its particulars and signing it remain yours. The file and the declaration, explained.

It depends on the act, on the product's category and on the standards you apply. euvex is not a notified body and does not replace its involvement when it is required. Under RED, some restrictions in the EN 18031 standards remove the presumption of conformity: which ones.

No. The CRA, RED and Machinery questionnaires give a state of readiness, not a conformity assessment, and euvex does not sign the EU declaration of conformity.

No. The cyber requirements of RED and of the Machinery Regulation concern the device's behaviour: network traffic, secure updates, authentication. euvex does not measure them and does not apply EN 18031 for you: it collects your answers, requirement by requirement, with the evidence you cite. What it measures itself is the software inventory and its known vulnerabilities.

No. It reads a lockfile (npm, pnpm, yarn) or a CycloneDX or SPDX SBOM, never a Git repository. Lockfiles from other ecosystems (bun, Python, Cargo, Go, Composer, Bundler) are not read: the upload recognises them and refuses them with a message.

No. It is an acknowledgement of receipt: euvex does not check that the vulnerability has been fixed.