Question 1

I just maintain client WordPress sites. Is the CRA actually my problem?

Accepted Answer

Possibly — and that's the honest answer. The CRA puts obligations on manufacturers, importers and distributors of products with digital elements placed on the EU market. Whether a bespoke client website is itself a regulated product is debated; a one-off site run for a single client looks more like a service. But the moment you ship a plugin/theme, resell commercial software, or maintain a product 'made available on the market', duties can attach. Safe posture: keep the evidence so that if you're in scope you can prove due diligence — and if you're not, you've lost nothing.

Question 2

My sites are bespoke, one per client. Are those 'products with digital elements'?

Accepted Answer

A truly one-off site delivered as a service sits at the edge of scope. But most agency sites aren't pure one-offs — they bundle commercial plugins and themes (which are products with digital elements), whose manufacturers and sometimes their distributors/maintainers carry CRA duties. Proofwright inventories exactly what's running so you can see which components are regulated and who's responsible.

Question 3

I only install plugins and themes I didn't build. Does that make me a manufacturer?

Accepted Answer

Generally no — you're not the manufacturer of someone else's plugin. But you can still act as a distributor or maintainer, and a 'substantial modification' of a product can make you its manufacturer. Bundling, configuring and maintaining a stack is where agency responsibility lives, which is why the evidence trail matters even if you wrote none of the code.

Question 4

Aren't open-source plugins and their stewards exempt?

Accepted Answer

There's a lighter regime for open-source software stewards, and the Act exempts stewards from administrative fines for certain infringements. But that doesn't exempt you — the agency deploying and maintaining that software commercially for paying clients. The components may be open source; your maintenance service is commercial.

Question 5

We're a 3-person micro-agency. Do the fines and deadlines still apply?

Accepted Answer

The deadlines apply regardless of size. On fines, the CRA tells authorities to weigh the size of the operator and exempts micro/small enterprises from certain reporting-deadline penalties — but 'we're small' is not a blanket exemption, and the reporting obligations from 11 Sep 2026 still land.

Question 6

A client is a US company with an EU storefront. Does the CRA reach the product?

Accepted Answer

The CRA follows the product onto the EU market, not the vendor's HQ. If a product with digital elements is made available in the EU, it's in scope and someone in the chain (manufacturer, importer, distributor) carries obligations. Your job is to know which parts of your stack that applies to.

Question 7

What actually changes on 11 September 2026 vs 11 December 2027?

Accepted Answer

11 Sep 2026 = reporting obligations switch on: you must report actively exploited vulnerabilities and severe incidents (24h / 72h / 14d) via the ENISA Single Reporting Platform. 11 Dec 2027 = full application: essential cybersecurity requirements, conformity assessment, CE marking and technical documentation all apply. The reporting clock is the near one — and the one this site counts down to.

Question 8

If I'm not ready by the deadline, do fines start the next day?

Accepted Answer

Obligations apply from the dates, but enforcement is by national market-surveillance authorities and is risk- and complaint-driven, not a midnight switch. The real exposure is being unable to show due diligence when an incident, audit or enterprise customer asks — which is exactly what evidence-in-advance protects against.

Question 9

Is the €15M fine per incident, per client, or per company?

Accepted Answer

Article 64 sets maximums of €15,000,000 or 2.5% of total worldwide annual turnover (whichever is higher) for the most serious breaches, €10M / 2% and €5M / 1% for lesser ones. They're ceilings applied to the economic operator and weighed against the nature, gravity and duration of the infringement — not a fixed per-site charge.

Question 10

Who would actually come after my agency?

Accepted Answer

National market-surveillance authorities in each member state, coordinated EU-wide, acting on incidents, complaints or audits; ENISA receives the incident and vulnerability notifications. There's no 'CRA police' knocking — there's an authority that can ask you to prove you did the work.

Question 11

A plugin on a client site is being actively exploited. What do I do, and how fast?

Accepted Answer

For an actively exploited vulnerability: early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure being available — all via the ENISA Single Reporting Platform. Proofwright's incident workflow pre-fills each step from your inventory, so you're filing, not scrambling.

Question 12

What's the Single Reporting Platform — do I report there or to my national CSIRT?

Accepted Answer

You report once through the CRA Single Reporting Platform (SRP). It's addressed to the CSIRT of your main establishment and made available to ENISA simultaneously — one submission, not many. Proofwright produces the SRP-ready package.

Question 13

A client had a breach over the weekend. Walk me through the first 24 hours.

Accepted Answer

(1) Confirm whether it's a severe incident or an actively exploited vulnerability in a product you maintain. (2) If yes, file the early warning within 24h via the SRP. (3) Pull the affected site's SBOM and remediation history — Proofwright has it dated and sealed. (4) Begin remediation, logging who/when/how as evidence. (5) Prepare the 72h notification. The point of setting this up now is that hour one isn't spent assembling facts.

Question 14

Do I have to report every CVE, or only some?

Accepted Answer

Not every CVE. The duty is for actively exploited vulnerabilities and severe incidents with a security impact — not routine, unexploited findings. Proofwright tracks all of them for evidence but flags the ones that actually start a reporting clock.

Question 15

How does Proofwright get the SBOM from a WordPress site — do I install something?

Accepted Answer

You drop a lightweight Proofwright plugin (the agent) on each client site. It reads core, plugins and themes — and the transitive composer/npm dependencies inside them — and produces SPDX + CycloneDX snapshots. The fleet console rolls them all up.

Question 16

Do you support Drupal, or only WordPress?

Accepted Answer

Both have a native module. On Drupal, download the Proofwright module, unzip it into your site's modules/ folder and enable it, then point it at your console and paste your licence key — it inventories core, every module and theme and pushes a CycloneDX SBOM automatically, on a schedule. Everything downstream — posture score, vulnerability monitoring, evidence and the incident workflow — is identical to WordPress. Any other stack brings its own SBOM (a repo, CI pipeline, container scan, or a one-off upload): same engine, one console.

Question 17

Does the agent slow down or put my client's live site at risk?

Accepted Answer

It's read-mostly and scheduled — it inventories and hashes, it doesn't modify the site or sit in the request path. Scans are throttled and run off-peak; nothing about evidence collection changes how the site serves visitors.

Question 18

What does 'tamper-evident / hash-chained' actually mean — can't I just keep a spreadsheet?

Accepted Answer

A spreadsheet you can backdate, and an auditor knows that. Hash-chaining links each snapshot cryptographically to the one before, with timestamps, so the record can't be silently edited after the fact. That's the difference between 'we say we did it' and proof anyone can verify.

Question 19

Can an auditor or my client verify the evidence without trusting Proofwright?

Accepted Answer

Yes — that's the design. Evidence packs ship with an offline verifier; the hashes can be checked independently, even if Proofwright weren't around. Proof you can't fake, that doesn't depend on us.

Question 20

Everyone gives away the free CRA docs — what's different here?

Accepted Answer

The checklist and the five template documents are commoditised, and none of them prove the work happened. Proofwright is the evidence layer on top: a dated, tamper-evident record of inventory → monitoring → remediation → reporting, per client. Documents are free; the proof is the product.

Question 21

Can I white-label it so clients see my brand, not yours?

Accepted Answer

Yes — on the Agency / Fleet tier the console and the evidence packs your clients see are white-labelled with your brand. They get 'my agency keeps us covered', not a third-party logo.

Question 22

What's the difference between Free, Solo, Pro and Agency?

Accepted Answer

Free (1 site) gives you the SBOM, posture score and all the generated CRA documents — including the Annex II user doc. Solo (1 site) adds the full get-it-done toolkit for a single-site owner: continuous monitoring, snapshot history, the 24h/72h/final incident workflow, and exportable, independently-verifiable evidence packs you hand an auditor. Pro (up to 10 sites) is the same, for makers shipping a few products, plus a CI/CD gate. Agency (up to 500 sites) takes it to a whole book of clients — the fleet console, PKI-signed white-label packs, team roles and a console API.

Question 23

Is there an early-joiner / founding discount?

Accepted Answer

Yes — before 11 September 2026 (the reporting deadline) you can lock the founding rate: Solo €29 (normally €49), Pro €99 (normally €149) and Agency from €499 (normally €999). The founding price holds for the life of your subscription. Prices are EUR per year, excl. VAT — a workflow and evidence tool, not a guarantee of compliance.

Question 24

How is the Agency tier metered?

Accepted Answer

By site, on top of the €999/yr floor (founding €499 before 11 Sep 2026). You're billed for the client sites under management; the resale calculator on the overview shows how that cost maps to what you can charge clients on top.

Question 25

Can I really resell this to clients, and how should I price it?

Accepted Answer

Yes — fold it into your care plans as a CRA/compliance line item. Agencies typically add a per-site monthly charge well above their per-site cost; the resale calculator lets you model the margin. You set the client price; Proofwright is the wholesale cost.

Question 26

What happens to a client's evidence if I stop paying, or a client leaves?

Accepted Answer

The evidence is exportable at any time — you can hand a client their full, verifiable pack on offboarding. You're never holding their compliance hostage, and neither are we.

Question 27

Do I need a plan per client or one account for my whole fleet?

Accepted Answer

One Agency account for the whole fleet, metered by number of sites. Clients live as tenants under your console — you don't juggle a login per client.

Question 28

Where is my data stored — is it in the EU? What about GDPR?

Accepted Answer

Built for an EU audience on EU infrastructure, with GDPR-appropriate handling. The evidence is about software inventory and remediation, not personal data — but the platform is designed to be something you can put in front of a privacy-conscious client.

Question 29

I already use Patchstack / WPScan / a scanner. Does this replace it?

Accepted Answer

It complements them. Scanners tell you what's vulnerable now; Proofwright records what you did about it, over time, in a form you can hand to an auditor. Keep your scanner — Proofwright turns its output into evidence.

Question 30

I host 200 sites on Kinsta / WP Engine — does it work on managed hosting?

Accepted Answer

Yes — it's a standard WordPress plugin agent plus a hosted console, so it runs on managed hosting the same as anywhere. The fleet console doesn't care who the host is.

Question 31

Can I import historical evidence, or does the chain only start at signup?

Accepted Answer

The tamper-evident chain is strongest from the day you start — that's the point, it's dated. You can attach prior records, but they carry 'added later' provenance. The honest takeaway: the sooner you start, the longer your defensible trail — which is why the countdown matters.

Question 32

At audit time, what exactly do I hand over?

Accepted Answer

A per-client evidence pack: the SBOM snapshots, the remediation log (who/when/how), any incident filings and the posture report — all dated, hash-chained and independently verifiable. One export, not a scramble.

Question 33

Is Proofwright itself CRA-compliant — who watches the watchmen?

Accepted Answer

Fair question. Proofwright maintains its own SBOM, monitoring and evidence trail, and publishes its conformity posture — we hold ourselves to the standard we help you meet.

Question 34

When exactly do the CRA obligations start?

Accepted Answer

Key dates: the CRA has been in force since 10 December 2024; vulnerability and incident reporting obligations apply from 11 September 2026; and the full requirements apply from 11 December 2027. Proofwright's compliance calendar tracks these (with iCal export) so the deadlines come to you rather than catching you out.

Question 35

What is an SBOM, and why does the CRA need one?

Accepted Answer

A Software Bill of Materials lists every component in your product. The CRA (Annex I, Part II) expects you to identify and document components and their vulnerabilities. Proofwright builds it automatically in both standard formats — SPDX 2.3 + CycloneDX 1.5 — and now also inventories the npm/yarn front-end dependencies bundled inside plugins and themes, not just PHP/Composer.

Question 36

Which CRA documents does Proofwright generate?

Accepted Answer

Five, each as PDF, Word, HTML or Markdown with version tracking: a Vulnerability Disclosure Policy, the EU Declaration of Conformity (Annex V), Technical Documentation (Annex VII), a Risk Assessment, and Information & Instructions to the User (Annex II). The full document set is on every plan, including Free. Each carries a 'not legal advice' note — they support your posture, they aren't a guarantee of compliance.

Question 37

What's the 'support period', and why does it matter?

Accepted Answer

Under CRA Art. 13(8) you must state how long you'll provide security updates for a product — guidance leans to at least 5 years unless the product's life is shorter. Proofwright records it, surfaces the end-date to users in the Annex II document, and reminds you on the calendar before it lapses.

Question 38

Do the third-party plugins and themes I bundle count?

Accepted Answer

Yes — CRA Art. 13 expects due diligence on the integrated third-party components you ship or maintain. Proofwright's supplier conformity register tracks, per maker, whether they publish an SBOM, a Declaration of Conformity, a security contact and a support period, and gives each a CRA-ready / partial / not-ready status you can export.

Question 39

Is any of my data sent anywhere?

Accepted Answer

Proofwright is read-only and on-site. The SBOM and the evidence chain never leave your site unless you export them. The vulnerability feeds are opt-in and only send component slugs upstream; the AI assistant is opt-in and bring-your-own-key. Nothing is phoned home by default.

Question 40

What happens to paid features if I'm on the Free plan?

Accepted Answer

They show as locked upgrade prompts — nothing breaks, and you keep the full Free set: SBOM, posture score, scope wizard, the CRA roadmap and calendar, the control crosswalk, and all the generated CRA documents. Self-hosted and dev installs default to the most permissive tier so you can evaluate everything.

The questions agencies actually ask.

Still not sure if you're in scope?