Quickstart

There is no signup form. Signing in creates your account and your first workspace in the same step. This page is the closest thing to an onboarding wizard — it walks you through the four things a wizard would otherwise do for you.

Before you start

You need a way to sign in (Google, or your organization's SSO if it's connected) and, ideally, an SBOM file already exported from your build. If you don't have one yet, the marketing site's SBOM generation guide covers exporting one from common build tools — come back here once you have a file.

Steps

1. Sign in. Start a 14-day trial and sign in with your work email or Google. There's nothing to configure first — signing in for the first time creates your workspace and makes you its owner. No card is asked for.
2. Land in your workspace. It's empty. That's expected — the next two steps are what fill it in.
3. Add your first product. Give it a name; a description is optional. See Add a product if you want the detail.
4. Upload an SBOM. Drop in a CycloneDX or SPDX file for that product. Declara detects the format from the file's content, not its extension. See Upload an SBOM for supported versions.
5. Wait for the first match. Uploading triggers a match against the NVD, OSV, GHSA, KEV, EUVD and EPSS feeds. If anything in your inventory is a Tier A match — the only tier that raises an alert — it shows up in Alerts.

What you should see

Either a Tier A alert appears, or your alerts list stays empty. Both are correct outcomes.

A quiet product is not a broken one. Most SBOMs, most of the time, contain nothing actively exploited. The value of Declara on day one isn't a filed report — it's confidence that if something were actively exploited, you'd know about it. See Understand your first alert for what a Tier A alert actually means and what to do with it, whenever one shows up.

Next

Once a product is being watched, the rest can be set up in any order:

• Invite your team, so the clock reminders reach more than one person.
• Record the product's support period (Art. 13(8)). The watch runs while the product is supported.
• Push SBOMs from CI on every release, and gate the release on a known exploitable vulnerability, or import from Dependency-Track if your SBOMs already live there. All three need the Growth or Partner plan. The first two use an API key; Dependency-Track uses its own server key, set up through an integration.
• Prepare your reporting account on the Single Reporting Platform before you need it, and run a drill.
• See every feature on one page for the duties around the clock.

Related

• Create your workspace and invite your team
• Understand your first alert
• What the CRA requires of you, and what Declara does about it