TRACEABLE COMPLIANCE INTELLIGENCE
Scanner findings to auditor-ready proof — every issue traced from finding to scan-verified fix. ISO 27001, NIS2, CRA, SOC 2.
Your data never leaves your premise · Self-hosted · EU-first
WHY CVET
The findings already exist. The proof doesn’t. It’s scattered across 10+ tools, screenshots, and spreadsheets — then rebuilt by hand before every audit.
CVET turns that scramble into one continuous, auditor-ready record.
“A lot of time was spent manually organizing screenshots, reports, and approvals.”
What practitioners told us
1–6 months
Typical audit-prep time practitioners reported
10+ tools
Evidence sources teams juggle before an audit
€10–50k/yr
Budget teams allocate to fix this
WHY NOW
Three EU mandates. One enforcement wave. Click any card to learn what it means for your team.
Jan 2025
Enforcement began
Digital Operational Resilience Act
ICT-risk evidence for EU financial entities — auditable on demand.
Banks, payment processors, insurers, and crypto providers must prove continuous vulnerability management and remediation traceability. Supervisory authorities can request evidence at any time.
160,000+
Organisations in scope
Network & Information Security Directive
160,000+ orgs across 18 sectors. Board-level accountability is mandatory.
Covers energy, transport, healthcare, digital infrastructure, and more. Boards are personally liable for non-compliance. Fines up to €10M or 2% of global turnover.
24 hrs
Vulnerability reporting window
EU Cyber Resilience Act
24-hour vulnerability reporting + SBOMs for any product sold in the EU.
Security-by-design obligations, coordinated vulnerability disclosure, and full enforcement by December 2027. If you sell software in Europe, this applies to you.
EU-first
Data residency by default
EU Data Residency & Sovereignty
EU buyers want evidence to stay in Europe. US-only tools lose deals.
GDPR Article 25 data protection by design, Schrems II implications, and growing demand for European cloud infrastructure (Hetzner, Scaleway, OVH). CVET is EU-hosted by default.
THE PLATFORM
Automation without traceability is just faster guesswork. CVET traces every finding to a control, every fix to a deploy.
Every scanner's output — Trivy, Semgrep, Snyk, SARIF — normalised in one place.
One control satisfies ISO 27001, NIS2, CRA and SOC 2 at the same time.
Every risk traced from finding to scan-verified, on a tamper-evident log.
Coverage matrix, CycloneDX SBOM and point-in-time evidence, on demand.
FRAMEWORKS
HOW IT WORKS
Watch one finding become evidence — this is the actual record CVET builds, not a diagram.
STEP 01 · INGEST
Bundled Trivy + Semgrep scan it — or ingest Snyk, Checkov, SARIF/OCSF. Every finding lands in one normalised record.
STEP 02 · MAP
Auto-mapped to ISO 27001, NIS2, CRA and SOC 2 — and honest about it: definitional mappings are labelled apart from inferred ones.
STEP 03 · VERIFY
Every event is appended to a hash-chained log. A finding is only closed by a fresh scan — never by a human claim.
STEP 01 · INGEST
$ cvet scan github.com/acme/payments-api
trivy · sca · 1 finding
STEP 02 · MAP
CONTROL MAPPING
“By definition” = backed by the knowledge base. Inferred mappings are labelled as inferred — never dressed up as certainty.
STEP 03 · VERIFY
EVIDENCE CHAIN · APPEND-ONLY
verified_resolved can only be written by a fresh scan — never by a human claim. That is the integrity guarantee.
We’re building in the open. Join the waitlist for founder pricing and first access at launch.