Meldora

Help

How Meldora works, what the terms used in the portal mean, and how to meet your Cyber Resilience Act obligations step by step.

How the service works

You decide how much you do yourself and where the consultant helps. You pay a fixed monthly fee, and for expert assessments only when you order more of them than your package covers.

  1. You hand over the product's ingredient list (SBOM). Yourself, through your developer or with the consultant's help, after every release. Your developer can automate it. All versions marked as supported are monitored.
  2. Meldora checks the ingredients. Every day we compare them with public databases of known vulnerabilities (US and European, including the list of holes criminals already exploit) and show what matches.
  3. You get a calm alert. First, a note that a match appeared. The e-mail carries only a link to the portal; the details are behind the login.
  4. You decide. Send the match to the consultant, or dismiss it as irrelevant. Urgent ones (actively exploited) can go to the consultant automatically.
  5. The consultant assesses the impact. Checks whether the vulnerable component is used in your product and prepares a report with a clear decision on reporting to ENISA.
  6. When a notification is required. You copy the prepared texts into the ENISA form, submit, and confirm each stage in the report. The order log is your evidence.

Who is responsible for what

The manufacturer (you)

You are responsible for the product, the decisions and the ENISA notification. You submit it yourself, from your own account on the SRP.

The consultant

Assesses the impact of vulnerabilities, prepares the report and the notification texts, advises. Does not decide for you and does not submit notifications on your behalf.

Meldora (the portal)

Monitors components, tracks deadlines, keeps reports and the event log. It does not connect to the ENISA platform; ENISA offers no API.

Article 14 CRA deadlines

  • Early warning24 hours
  • Vulnerability notification72 hours
  • Final report14 days after the fix

The deadlines run from the moment the manufacturer becomes aware of an actively exploited vulnerability in the product. In Meldora that is the moment of the alert, recorded in the log. The whole procedure

Didn't find the answer?

If you are a client, write to the consultant under Messages in the portal or call them (the number is in the portal, in the left column). In an urgent case (actively exploited vulnerability) always call. Not a client yet? Book a free 30-minute call at meldora.pl/demo.

Glossary of all terms