Live demo

A running instance, with the evidence chain intact

A running Eurtifact instance with a real catalogue: container images and Java libraries mirrored from public upstreams, each scanned, signed, and recorded. Nothing here is seeded or screenshotted — what you see is what the pipeline produced.

Request access See what is in it

Getting in

The demo runs at demo.eurtifact.eu and sign-in is issued per request — one read-only account, usually the same day. Read-only means it: the account opens every screen and reads every record in its tenant, and cannot add an artifact, change a policy, trigger a sync or export an audit bundle.

We keep it behind a request rather than printing the password here for the same reason the registry itself is closed: a mirror that anyone can pull from is not a controlled mirror, and this platform is an argument for control.

Request access sales@eurtifact.eu

What is in there

  • Two ecosystems, one pipeline

    Container images and Java libraries are mirrored from public upstreams and run the identical path: quarantine, scan, sign, attest, then release.

  • Evidence per version, not per product

    Each version carries its own scan result, SBOM and signature, so the answer to "what shipped" is specific rather than approximate.

  • Policy that actually holds things back

    The tenant sets its own risk thresholds. Artifacts that exceed them stay out of the tenant registry, with the reason recorded.

  • A trail you can hand to an auditor

    Lifecycle transitions and policy decisions are hash-chained, and the tenant can export them as an evidence bundle.

Every version carries a vulnerability scan, a CycloneDX SBOM and a Cosign signature, with no exceptions — an artifact that cannot produce all three does not reach a tenant. The tenant runs a risk policy, and the artifacts that exceed it are held back rather than quietly shipped.

Four things worth opening

  1. Command Center

    Scan coverage, compliance standing, and how much of the catalogue the tenant can actually pull. What is held back matters more than what is mirrored.

  2. Artifact Catalog

    Open a widely used runtime image and read its vulnerability breakdown, then open a minimal base image that comes through clean. Same pipeline, different outcome.

  3. Policies

    The tenant rule that decides all of it — thresholds for critical and high findings, and whether exceeding them warns or blocks. Move a threshold and the held-back list moves with it.

  4. Audit Log

    Every transition, hash-chained. This is the part a supplier questionnaire is really asking about.

Want it against your own images?

A walkthrough runs about twenty minutes and can use your allowlist rather than ours. If you are working towards CRA Article 14 or answering NIS2 supplier questionnaires, bring the questionnaire — the session is more useful spent on your evidence than on ours.

Book a walkthrough sales@eurtifact.eu