SERVICE INTRODUCTION
CRAdle Service Brochure
Reporting obligations · supply-chain security · CRA deliverables — we help manufacturers prepare and record their CRA response in three workspaces.
CRAdle — what the name carries
The name joins CRA and Cradle — a promise to take in, from the very start, the CRA response of manufacturers who are not yet prepared, and to grow together with them.
WHY NOW
The obligation comes twice.
The clock runs even if you become aware of an incident at dawn. If it is not settled who reviews and approves, 24 hours disappear in an instant.
← Swipe sideways →
One home
Once you sign in there is one question — what do I need to do now?
Tasks from the modules you have contracted gather in one list: statutory deadlines → exploit signals → approvals and requests.
Reporting obligations
From the moment you become aware until the case is sealed, we watch the 24-hour clock with you.
From the moment of awareness, the 24h, 72h and final deadlines are calculated and each stage is announced by email. The wizard guides each item in Korean alongside the English submission value, and values lock after sign-off.
It guides you to copy the approved values in the order the SRP asks for them, and once you upload the receipt, an evidence PDF is produced.
Supply-chain security
We build the finished-product SBOM from your suppliers' SBOMs.
When you request an SBOM from a supplier, the supplier accepts and then submits the SBOM of its own parts. The submitted SBOMs are gathered and issued as the finished-product SBOM (CycloneDX · SPDX).
If there is no SBOM, source code is accepted too. Source is used only to find parts in a single-use analysis environment; when the analysis ends it is destroyed and a destruction certificate is issued. It does not remain in the CRAdle repository.
Components in the SBOM are checked against NVD, KEV, EPSS, EUVD and OSV, and a person records whether each is affected. The finished-product SBOM and the per-vulnerability VEX are issued in two editions: internal and for distribution.
CRA deliverables
Start from a template, work through it, and keep it as an approved copy.
Each document has a template and a deadline ready, and the files you upload are managed in the work area as draft → sign-off request → approved copy. When you close a project, the list of approved copies is sealed as a preparation record.
Data access · records
Unless you switch it on, nobody at ACE LABS can see anything.
ACE LABS support is a single switch. While it is off, operators cannot view your company's data, and only machine monitoring and alerts continue.
Judgments, reviews, approvals and submissions are kept in time order, and the system blocks editing or deletion. Evidence PDFs show the SHA-256.
Customer data is separated by row-level security (RLS), and you can choose two-step TOTP for sign-in.
Adoption
You do not have to subscribe to all three modules at once.
Modules are switched on separately for each company — subscriptions are per module, and terms are explained in consultation. Consultation → module and R&R setup → operation.
Even if this is your first time, there is a path — pre-report question guide · SRP preparation guide · training library · help requests.
