ForgeCRA · For suppliers
Publish once. Serve every customer.
A customer of yours is collecting component evidence for the Cyber Resilience Act, and pointed you here. ForgeCRA is the neutral exchange: attest once, share with that customer and every other one, under your control. Free for suppliers, permanently.
JOIN THE FIRST SUPPLIER COHORTCRA pushes your customers to demand component evidence from you — repeatedly, per customer, per product.
Answering five portals and fifty questionnaires doesn't scale.
Your SBOM is commercially sensitive. You need to control who sees what.
Upload or generate your SBOM (CycloneDX / SPDX).
One file, the format you already produce
Attest it once — signed, dated, quality-scored.
Signed, dated and quality-scored
Share per-customer with one click. Updates propagate to everyone you've shared with.
Per customer, your call — updates propagate
If a customer sent you here, step three is already half done — they are waiting on the share, and you keep control of what they see.
Illustrative only. The first cohort is run with us directly — there is no self-serve platform yet.
ForgeCRA is not a competing analysis vendor, not owned by one, and never resells your data.
You choose exactly which customers see which products' SBOMs. Free for suppliers, permanently — we charge the side with the regulatory liability, never the side that creates the network.
We're onboarding a first cohort of suppliers now — tell us your formats and your customers, and help set the standard everyone else will have to follow.
Free for suppliers, permanently. You control who sees what, and updates propagate to every customer you've shared with.
JOIN THE FIRST SUPPLIER COHORTTell us your formats and your customers.
Nobody sent you and you want to get ahead of this? Same form — tell us who is likely to ask.
You're a manufacturer collecting evidence, not supplying it? This is your page →