CRANE
The Open-Source Cyber Resilience Act (CRA) Compliance Platform
Stop managing CRA compliance with spreadsheets.
Track Products • Analyze SBOMs • Manage Vulnerabilities • Manage Tasks • Collect Evidence • Pass Audits
Built for manufacturers, software vendors, consultants, startups, and researchers.
🚀 Open Source • 🔒 Self Hosted • 🇪🇺 CRA Ready • 📦 SBOM Native • 🛡️ Privacy First
Why CRANE?
The EU Cyber Resilience Act (CRA) introduces a new era of cybersecurity requirements for digital products.
CRANE transforms CRA compliance from scattered spreadsheets, documents, and disconnected tools into one integrated platform.
Instead of juggling:
- 📄 Word documents
- 📊 Excel sheets
- 🔍 Vulnerability scanners
- 📁 Evidence folders
- ✅ Release checklists
CRANE centralizes everything in a single, auditable workspace.
📸 Dashboard
Track cybersecurity maturity, products, vulnerabilities, risk assessments, tasks, and lifecycle alerts from one dashboard.
✨ Why Choose CRANE?
| Traditional Compliance Tools | CRANE |
|---|
| 💰 Expensive enterprise licenses | ✅ Completely Open Source |
| ☁ Vendor cloud | ✅ Self-hosted |
| 🔒 Vendor lock-in | ✅ Your data stays yours |
| 📄 Documents everywhere | ✅ One integrated workspace |
| ❌ Generic GRC software | ✅ Built specifically for CRA |
| 📦 Multiple disconnected tools | ✅ Everything in one platform |
🚀 Everything You Need for CRA Compliance
CRANE provides a complete workflow for the Cyber Resilience Act.
- 📦 Product Registry
- 🏷️ Version & Release Management
- 📋 SBOM Analysis (CycloneDX & SPDX)
- 🛡️ Vulnerability Management
- 📈 EPSS Risk Prioritization
- ✅ CRA Compliance Matrix
- 📝 Audit Trail
- 🚦 Release Gates
- ⚠️ Risk Assessments
- 📂 Evidence Repository
- 👥 Team Collaboration
- 🔐 LDAP / Active Directory Integration
- ✅ Task board with assignment, parent/subtask links, comments, history, and archive tracking
- 🔗 Jira Cloud integration with OAuth, issue export, status synchronization, and board-level sync
- 🖼️ Personal profile photos shown on task assignments
📦 Product Inventory
Catalogue products with their CRA scope, classification, obligations, conformity route, and support status.
Product workspace
Open a product to review its tasks, supply-chain traceability, releases, support periods, remote processing solutions, and activity timeline.
🛡️ Vulnerability and Incident Management
Review vulnerability intake, priority findings, overdue remediation, disclosure policies, advisories, SBOM records, and the ENISA / CSIRT reporting queue.
Explore these workflows in the CRANE documentation.
🎯 Built For
| Audience | Benefits |
|---|
| 🏭 Manufacturers | Manage CRA compliance across product portfolios |
| 💻 Software Vendors | Track releases, SBOMs, vulnerabilities, and evidence |
| 🚀 IoT Startups | Affordable alternative to enterprise GRC platforms |
| 👨💼 CRA Consultants | Deploy isolated environments for each customer |
| 🎓 Universities & Research | Ideal for teaching and CRA research |
| 🏛 Critical Infrastructure | Fully self-hosted with enterprise authentication |
⚡ Key Features
| Feature | Description |
|---|
| 📦 Product Registry | Products, versions, releases, lifecycle management |
| 📋 SBOM Analysis | CycloneDX, SPDX, NTIA validation, quality scoring |
| 🛡️ Vulnerability Management | CVEs, EPSS, VEX assessments, patch workflow |
| 🚦 Release Gates | Evidence-based release approval |
| 🇪🇺 CRA Compliance Matrix | Annex I requirement mapping |
| 📝 Audit Trail | Immutable compliance history |
| ⚠️ Risk Assessment | STRIDE & TARA methodology support |
| 👥 Collaboration | Role-based access, tasks, comments |
| 🔐 LDAP / Active Directory | Enterprise authentication |
| ✅ Task management | Jira-style board, drag-and-drop status, assignees, parent/subtasks, comments, and history |
| 🔗 Jira Cloud | OAuth connection, configurable projects/statuses/priorities, issue export and synchronization |
| 📦 Data Export | Portable compliance packages with zero vendor lock-in |
🔒 Privacy First
Unlike cloud-first compliance platforms, CRANE keeps everything under your control.
✅ Self-hosted
✅ No telemetry
✅ No vendor lock-in
✅ No external callbacks
✅ PostgreSQL database under your control
✅ Fully auditable
Your compliance data never leaves your infrastructure.
🌍 Online Demo
Try CRANE instantly without installing anything.
⚠️ Please do not upload confidential or sensitive information into the public demo.
💬 Free CRA Consultation
Every Friday, I offer free consultations focused on the Cyber Resilience Act.
We can discuss:
- CRA Questions & Answers
- Compliance Strategy
- Gap Assessment
- Product Readiness
- How CRANE fits your workflow
📅 Schedule your session:
👉 https://cal.com/crane-2027/30min
Or connect on LinkedIn:
👉 https://www.linkedin.com/in/ali-m-hosseini-216b24121/
⚡ Installation
Prerequisites
- Docker Desktop installed
- Docker running with Linux containers
- Approximately 2 GB free disk space
One-Command Installation
Linux / macOS
curl -fsSL https://raw.githubusercontent.com/cra-norm-engine/crane/main/install.sh | bash
Windows (PowerShell)
irm https://raw.githubusercontent.com/cra-norm-engine/crane/main/install.ps1 | iex
For a detailed guide, see the documentation:
👉 https://cra-norm-engine.github.io/crane/installation.html
🚀 Access CRANE
🔑 Default Login
You'll be prompted to create a new password on first login.
🏢 Production Deployment
For production deployments:
- Use
docker-compose.prod.yml
- Configure strong secrets
- Run behind HTTPS (NGINX, Caddy, Traefik, etc.)
- Install signed releases with
./crane-update apply
- Choose notification-only or automatic security updates in Settings → System updates
- Test
./crane-update rollback and retain backups independently of the CRANE host
Complete guide:
https://cra-norm-engine.github.io/crane/configuration.html
Update and rollback guide: docs/docs/getting-started/system-updates.md
🛠️ Technology Stack
Backend
- FastAPI
- SQLAlchemy 2
- PostgreSQL 16
- Alembic
- Pydantic v2
Frontend
- Vue 3
- TypeScript
- Pinia
- Vite
Security Intelligence
- Trivy
- NVD
- OSV
- EPSS (FIRST.org)
🗺️ Roadmap
✅ Delivered (September 2026)
🚀 Near Term (Q4 2026)
📈 Medium Term (Q1 2027)
🎯 Long Term
🌍 Real-World Scenarios
See practical deployment examples:
https://cra-norm-engine.github.io/crane/scenarios.html
- 🏭 Industrial Manufacturer
- 💡 IoT Startup
- 👨💼 CRA Consultant
- 🎓 Education & Research
🤝 Contributing
Contributions are welcome!
Whether you're fixing bugs, improving documentation, or implementing new features, we'd love your help.
Before opening a large Pull Request, please create an issue to discuss your proposal.
See:
CONTRIBUTING.md
📬 Contact
📜 License
Copyright © 2026 Ali Mohammad Hosseini
Licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).
CRANE is network server software covered by the AGPL. If you modify and deploy CRANE over a network, you must make the corresponding source code available under the terms of the license.
⭐ If CRANE helps your organization, consider giving the project a Star!
Helping the open-source community build a safer digital future under the EU Cyber Resilience Act.
Made with ❤️ for the cybersecurity and open-source community.
