Cyber Resilience Act — our own compliance
Last updated: 2026-09-16
Eurtifact is a product with digital elements within the scope of Regulation (EU) 2024/2847, the Cyber Resilience Act. The reporting obligations in Article 14 apply to manufacturers from 11 September 2026. This page states how we meet them for our own product.
1. Manufacturer
Legal entity: Yildiz Tech, trading as Eurtifact
Chamber of Commerce (KvK): 42030302
Address: Ligusterbaan 1, 2.22, 2908 LW Capelle aan den IJssel, Netherlands
Main establishment (CRA Art. 14(7)): Netherlands — the Member State where decisions relating to the cybersecurity of our product are taken
Security contact: security@eurtifact.eu
2. Reporting of actively exploited vulnerabilities and severe incidents
We operate a documented reporting workflow covering both triggers in Article 14: an actively exploited vulnerability contained in our product, and a severe incident having an impact on its security as defined in Article 14(5).
| Deadline | What we submit |
|---|---|
| Within 24 hours of becoming aware | Early warning notification, including the Member States where the product is made available and, for incidents, whether unlawful or malicious acts are suspected |
| Within 72 hours | Vulnerability or incident notification: nature of the issue, initial assessment, corrective and mitigating measures taken by us and available to users |
| 14 days after a corrective measure is available (vulnerabilities) 1 month after the 72-hour notification (incidents) | Final report: severity and impact, root cause or threat type, details of the security update, applied and ongoing mitigation |
Notifications are submitted through the Single Reporting Platform established under Article 16, to the electronic notification endpoint of the CSIRT designated as coordinator in the Netherlands, simultaneously accessible to ENISA.
Coordinating CSIRT: NCSC-NL (Nationaal Cyber Security Centrum), Netherlands
3. Informing users
Under Article 14(8) we inform impacted users — and where appropriate all users — of the vulnerability or incident and of any mitigation they can deploy. Advisories are published in plain language and, where appropriate, in machine-readable form as a CSAF advisory with VEX statements for the affected components.
Advisories are issued from security@eurtifact.eu to the technical contact registered for each tenant, and published on this site.
4. Coordinated vulnerability disclosure
If you have found a vulnerability in Eurtifact, report it to security@eurtifact.eu. Our machine-readable security contact is published at /.well-known/security.txt in accordance with RFC 9116.
- We acknowledge reports within 2 business days.
- We provide an initial assessment within 10 business days.
- We coordinate a disclosure timeline with the reporter and credit them unless they prefer otherwise.
- We will not pursue legal action against researchers who report in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate.
5. Software bill of materials
We provide a CycloneDX SBOM for the Eurtifact platform itself on request. It is generated by the same pipeline our customers use, and signed with the same mechanism.
Current SBOM: Available on request from security@eurtifact.eu
6. EU jurisdiction
All infrastructure processing customer data operates inside EU jurisdiction, on Hetzner Online GmbH infrastructure in Nuremberg, Germany. There are no third-country transfers and no dependency on non-EU cloud providers in the artifact path.
7. Scope of this statement
This is a manufacturer's self-declaration of its reporting posture under Article 14. It is not a conformity assessment, and it does not assert conformity with the essential requirements in Annex I, which apply from 11 December 2027. We publish our progress towards those requirements as it is made, rather than in advance of it.