Your security response centre, on your own infrastructure.
ZenoResponse is where a software vendor's product-security team receives vulnerability reports, triages them, publishes advisories, tells customers, runs the status page and meets the reporting deadlines that European law now sets. One installation serves one vendor, in the vendor's own brand.
The reporting obligations of the Cyber Resilience Act, Art. 14, have applied since 11 September 2026. They cover every manufacturer that places a product with digital elements on the EU market. A mailbox, a ticket tracker and a spreadsheet cannot answer what the law asks within the hours it allows.
An actively exploited vulnerability needs an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a fix. ZenoResponse opens the report, runs the clock and alerts at 50, 80 and 100 per cent.
Essential entities and financial institutions ask their suppliers for SBOMs, advisories, notification times and incident updates. The portal gives each customer exactly that, with evidence.
Every change writes a hash-chained audit event in the same database transaction. Submissions to authorities are recorded once per stage, met or late. Auditors verify the chain offline.
One console for intake, triage, advisories, incidents, SBOMs, VEX and regulatory reports, with a deadline on everything that has one.
Vulnerabilities from researchers, customers, staff and feeds: NVD, OSV, GHSA, CISA KEV and FIRST EPSS. CVSS v3.1 and v4.0 scored on the server. Priority P0 to P4 with its inputs shown.
CycloneDX and SPDX per release, uploaded from CI. Feed records are matched to components by purl and CPE, so a new CVE shows which releases, installations and customers it reaches.
CycloneDX VEX and OpenVEX, imported and published. Customers learn when a vulnerable component is not exploitable in your product. Statements wait for review before they change an analysis.
Draft, review, four-eyes approval and publication, with embargo and pre-notification under TLP. Published from your own CSAF provider with ROLIE feeds and optional OpenPGP signatures.
RFC 9116 security.txt, a policy page and a report form that needs no account and no JavaScript. A 72-hour acknowledgement clock, retention for reporter data and a hall of fame.
Incidents with internal notes and external updates, impact per customer and post-mortems. A public status page with 90-day uptime, maintenance windows, e-mail and Atom subscriptions.
CRA Art. 14, NIS2 Art. 23, GDPR Art. 33 and DORA Art. 19 as configurable regimes, plus your own. Reports open themselves on a trigger, with a draft per stage prepared from the record.
Service-level policies per tier, customer or contract. Quarterly compliance reports as PDF, CSV and JSON, vendor-wide or per customer.
Your products report heartbeats and versions over mutual TLS, so you know who runs which release. Releases carry verified provenance and a signed release statement customers can check.
Everyone who depends on your products gets the view they need, and nothing more.
The admin console: intake, triage, advisories, incidents, SBOMs, VEX and regulatory reports, each with its deadline.
A portal with the advisories that affect them, acknowledgements, their installations, SBOM downloads, signed webhooks and compliance reports. Sign-in by e-mail code or their own OpenID Connect provider.
CI uploads of releases, SBOMs, VEX and evidence with scoped, expiring tokens. Every console action is a documented API call.
A clear policy, a report form without an account, a tracking link and two-way messages with your team.
Machine-readable CSAF advisories, recorded submissions and an audit trail that can be verified offline.
A status page with history and published advisories, server-rendered and in your brand.
A security response centre is needed most during an incident. ZenoResponse is designed for that moment.
Public pages keep answering from their last good render while the database is unreachable, with a clear "data as of" notice.
Your products push signals in. ZenoResponse never reaches into a product, and a signal never blocks the product that sends it.
Unpublished advisories, embargoed vulnerabilities and customer exposure data never leave your infrastructure. Nothing calls home, and it runs air-gapped.
Every route is denied unless allowed. Customer scoping is enforced in the service layer, and an id from another customer answers 404.
Name, logos, colours, fonts and public copy are set at runtime and reach consoles, pages, e-mails and reports. Contrast is checked against WCAG 2.2 AA on save.
One Go binary, one image, one Postgres database. Helm for production, Docker Compose for evaluation. Health checks, Prometheus metrics and JSON logs with personal data masked.
The zrc binary serves the consoles and public pages, runs migrations and verifies the audit chain offline. Feeds can be mirrored or imported as a bundle for air-gapped sites.
# Evaluate with Docker Compose and a fictional vendor
$ docker compose up --build -d
$ docker compose exec zrc zrc demo seed
# Production: install the Helm chart, then create the first owner
$ helm install zrc ./zenoresponsecenter-0.1.0.tgz -n zrc-system -f values-zrc.yaml --wait
$ zrc bootstrap --email [email protected] --vendor-name "Corp Software" --vendor-code CORP
# Check the audit chain offline
$ zrc audit verifyCSAF 2.0, CycloneDX, SPDX, OpenVEX, RFC 9116, CVSS v3.1 and v4.0, EPSS, CISA KEV, OpenAPI 3.1 and RFC 9457. The signal SDK, zrcsignal, is open source under Apache-2.0, with a written wire specification and a conformance test.
Runs without a licence and without contacting us: one product, five organisations and ten installations. A demo seed loads a fictional vendor with 90 days of history.
An offline licence that is never a kill switch. Options for white label, regulatory regimes and single sign-on. OpenPGP-signed CSAF is in every edition. Pricing on request.
ZenoResponse stands on its own and fits with the other Zeno products.
OpenID Connect sign-in for your staff and your customers' users.
Publish the public pages and the signal listener without opening inbound ports.
A platform to run it on, a registry for the image, and an SMTP relay for notifications.
Talk to us about an evaluation or a platform licence for your security team.