There is no signup form. Signing in creates your account and your first workspace in the same step. This page is the closest thing to an onboarding wizard — it walks you through the four things a wizard would otherwise do for you.
Before you start
You need a way to sign in (Google, or your organization's SSO if it's connected) and, ideally, an SBOM file already exported from your build. If you don't have one yet, the marketing site's SBOM generation guide covers exporting one from common build tools — come back here once you have a file.
Steps
- Sign in. Go to sign-in and authenticate. There's nothing to configure first — signing in for the first time creates your workspace and makes you its owner.
- Land in your workspace. It's empty. That's expected — the next two steps are what fill it in.
- Add your first product. Give it a name; a description is optional. See Add a product if you want the detail.
- Upload an SBOM. Drop in a CycloneDX or SPDX file for that product. Declara detects the format from the file's content, not its extension. See Upload an SBOM for supported versions.
- Wait for the first match. Uploading triggers a match against the NVD, OSV, GHSA, KEV, and EPSS feeds. If anything in your inventory is a Tier A match — the only tier that raises an alert — it shows up in Alerts.
What you should see
Either a Tier A alert appears, or your alerts list stays empty. Both are correct outcomes.
A quiet product is not a broken one. Most SBOMs, most of the time, contain nothing actively exploited. The value of Declara on day one isn't a filed report — it's confidence that if something were actively exploited, you'd know about it. See Understand your first alert for what a Tier A alert actually means and what to do with it, whenever one shows up.