All five documents, written for your product and kept current.
One questionnaire, once. Out comes the file you have to hold, ready to sign — and it stays right as the standards underneath it land.
That works out at €32.50 a month, against €59 a month after the founding period closes. The rate holds for as long as you stay subscribed — it does not step up at renewal.
Start for one productYou sign in with your email first, then subscribe from inside the app. That order is deliberate: the subscription attaches itself to your account, so your documents are never stranded under a different address.
That is €708 a year — what this becomes once the founding offer closes. Buying the year now saves €318 and holds that rate for as long as you stay.
Not on sale yet. Annual is the only way in during the founding period.
One payment, four editable documents, downloaded straight away — the Annex I risk assessment with one row per requirement, the Annex V declaration, the disclosure policy and the reporting readiness sheet, all with the Official Journal wording already quoted. No account, and the download link never expires.
It is the same three limits as any template: it will not fill itself in, it will not change when the standards land, and it will not keep your dated versions. If those three are what you need, the subscription above is the thing that does them. See what is in the pack.
No conditions, no partial credit, no form to fill in. You’re buying a dated promise from a named person, and that’s the only sensible way to sell one. In the meantime you get the reporting pack, which covers the duty that is already running.
Questions worth asking
Three things a blank template can’t do: fill itself in for your product, change when the standards underneath it change, and keep every dated version for the ten years the law asks for. A free pack bought today is a document you can’t tell has gone stale.
If those three don’t matter to you — because you intend to maintain the file yourself — then a template really is all you need, and ours is €39. We would rather sell you that than have you pay €390 for something you were never going to use.
Because the duty that’s already running is the reporting one, and that part ships to you this week. The founding price and the refund promise are what you get for taking the rest on trust for eleven weeks.
You export the lot — every version, every date — with one button, any time, no conditions. Same if we ever stop operating: everyone gets their full archive. It’s your legal record, not ours.
Probably not. If your product performs none of the security functions listed in Annex III it sits in the default category, which is the largest one, and you self-assess — no external audit, no certification fee. The free check tells you which category you’re in.
No, deliberately. The statutory floor is “at the very least the top-level dependencies”, which an upload clears. We accept CycloneDX 1.6+ or SPDX 3.0.1+ in JSON or XML and validate it against the field list the German BSI guideline sets out.
Graycord, an independent software business in Melbourne, run by one person. Worth weighing before you pay for something unlaunched — which is why the refund is unconditional and the date is a specific day rather than “soon”. Email andy@graycord.com and you get a reply from the person building it.