All five documents, written for your product and kept current.
One questionnaire, once. Out comes the file you have to hold, ready to sign — and it stays right as the standards underneath it land.
That works out at €32.50 a month, against €59 a month after the founding period closes. The rate holds for as long as you stay subscribed — it does not step up at renewal.
Start for one productThat is €708 a year — what this becomes once the founding offer closes. Buying the year now saves €318 and holds that rate for as long as you stay.
Not on sale yet. Annual is the only way in during the founding period.
No conditions, no partial credit, no form to fill in. You’re buying a dated promise from a named person, and that’s the only sensible way to sell one. In the meantime you get the reporting pack, which covers the duty that is already running.
Questions worth asking
Three things a blank template can’t do: fill itself in for your product, change when the standards underneath it change, and keep every dated version for the ten years the law asks for. A free pack bought today is a document you can’t tell has gone stale.
Because the duty that’s already running is the reporting one, and that part ships to you this week. The founding price and the refund promise are what you get for taking the rest on trust for eleven weeks.
You export the lot — every version, every date — with one button, any time, no conditions. Same if we ever stop operating: everyone gets their full archive. It’s your legal record, not ours.
Probably not. If your product performs none of the security functions listed in Annex III it sits in the default category, which is the largest one, and you self-assess — no external audit, no certification fee. The free check tells you which category you’re in.
No, deliberately. The statutory floor is “at the very least the top-level dependencies”, which an upload clears. We accept CycloneDX 1.6+ or SPDX 3.0.1+ in JSON or XML and validate it against the field list the German BSI guideline sets out.
Graycord, an independent software business in Melbourne, run by one person. Worth weighing before you pay for something unlaunched — which is why the refund is unconditional and the date is a specific day rather than “soon”. Email andy@graycord.com and you get a reply from the person building it.