TRACEABLE COMPLIANCE INTELLIGENCE
Scanner findings to auditor-ready proof — every issue traced from finding to scan-verified fix. ISO 27001, NIS2, CRA, SOC 2.
Your data never leaves your premise · Self-hosted · EU-first
WHY CVET
The findings already exist. The proof doesn’t. It’s scattered across 10+ tools, screenshots, and spreadsheets — then rebuilt by hand before every audit.
CVET turns that scramble into one continuous, auditor-ready record.
“A lot of time was spent manually organizing screenshots, reports, and approvals.”
What practitioners told us
1–6 months
Typical audit-prep time practitioners reported
10+ tools
Evidence sources teams juggle before an audit
€10–50k/yr
Budget teams allocate to fix this
WHY NOW
Three EU mandates. One enforcement wave. Click any card to learn what it means for your team.
Jan 2025
Enforcement began
Digital Operational Resilience Act
ICT-risk evidence for EU financial entities — auditable on demand.
Banks, payment processors, insurers, and crypto providers must prove continuous vulnerability management and remediation traceability. Supervisory authorities can request evidence at any time.
160,000+
Organisations in scope
Network & Information Security Directive
160,000+ orgs across 18 sectors. Board-level accountability is mandatory.
Covers energy, transport, healthcare, digital infrastructure, and more. Boards are personally liable for non-compliance. Fines up to €10M or 2% of global turnover.
24 hrs
Vulnerability reporting window
EU Cyber Resilience Act
24-hour vulnerability reporting + SBOMs for any product sold in the EU.
Security-by-design obligations, coordinated vulnerability disclosure, and full enforcement by December 2027. If you sell software in Europe, this applies to you.
EU-first
Data residency by default
EU Data Residency & Sovereignty
EU buyers want evidence to stay in Europe. US-only tools lose deals.
GDPR Article 25 data protection by design, Schrems II implications, and growing demand for European cloud infrastructure (Hetzner, Scaleway, OVH). CVET is EU-hosted by default.
THE PLATFORM
Automation without traceability is just faster guesswork. CVET traces every finding to a control, every fix to a deploy.
Every scanner's output — Trivy, Semgrep, Snyk, SARIF — normalised in one place.
One control satisfies ISO 27001, NIS2, CRA and SOC 2 at the same time.
Every risk traced from finding to scan-verified, on a tamper-evident log.
Coverage matrix, CycloneDX SBOM and point-in-time evidence, on demand.
FRAMEWORKS
HOW IT WORKS
STEP 01
Bundled Trivy + Semgrep scan it — or ingest Snyk, Checkov, SARIF/OCSF.
STEP 02
Auto-mapped to ISO 27001, NIS2, CRA and SOC 2. Gaps surface instantly.
STEP 03
Auditor-ready packs on demand — every fix scan-verified. Not a spreadsheet.
We’re building in the open. Join the waitlist for founder pricing and first access at launch.