Skip to content
Declara
⌘K
compliance-owner

Publish a product's Trust Center

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 13(8), Article 13(20), Annex V and Annex VI as of . It is not legal advice. Review process.

A customer evaluating your product asks the same things each time: how long it is supported, what class it is in, whether there are advisories, where to report a flaw. The Trust Center answers them on one public page per product, under your disclosure page, at an address you control.

Everything on the page is what you chose to publish. Declara states nothing about the product on its own account and makes no claim of conformity. The page says who is responsible for it.

Before you start

  • A Starter, Growth or Partner plan, on a workspace that is trialing, active or in its payment grace period. On any other plan, or once the workspace is read-only or cancelled, your settings are kept and nothing is public.
  • A published disclosure page. The Trust Center lives under it, and a product is not visible while the disclosure page is not.
  • The owner or an admin role (vdp.manage).

Steps

  1. Open the product, then Trust Center.
  2. Check the Address. The preview shows the resulting URL under your disclosure page. Add a Summary of up to 600 characters if you want one.
  3. Under What the page shows, choose Product class, Support period and Publish VEX statements.
  4. Press Save settings, then Publish. Publishing needs saved settings.
  5. Open the address in a private window to see what a visitor sees.

To take it down, press Unpublish. The page returns the same "not found" as an address that never existed.

What is public, and what never is

The page can show:

  • the product's name and your summary
  • the product class and the conformity assessment route that follows from it, if you chose to show them and the class is determined
  • the support end date, and each supported version with its own end date, if you chose to show them (Art. 13(8)). A product you have marked end of support stays visible, with a note that support has ended
  • security advisories about the product that you have published and listed, as CSAF 2.0. Advisories from practice drills are never included
  • VEX, only if you turned it on
  • the simplified declaration of conformity (Annex VI), only once you have confirmed a declaration (below)
  • a link to your disclosure page and its contact address (Annex I Part II(5))

It never shows components, alerts, matches, cases, risk assessments, triage rationale, other products, or a product that is paused or archived. The page loads only the fields listed above; it does not read the rest.

Each product also has a machine-readable index at /products/<address>/manifest.json.

Public VEX is an opt-in with a cost

Turning on Publish VEX statements publishes a file that names the components each statement is about. Be sure you want a stranger to see which packages you ship.

Only settled statements are included:

  • not_affected and fixed are published, with the standard wording for the justification. Anything you typed as free text is replaced or left out.
  • affected is published only once a published advisory lists that vulnerability, so the file never discloses an unfixed flaw ahead of your advisory.
  • under_investigation is never published. It is somebody's open work.

The file is served as OpenVEX, or as CycloneDX with ?format=cyclonedx. See Export VEX for the private export.

Confirm the declaration of conformity

Under EU declaration of conformity you can attach the declaration you drew up under your sole responsibility (Art. 13(20), Annex V): upload a PDF (up to 10 MB), or give an https:// address where you publish it. Then tick the confirmation that this is the declaration you signed, and save.

  • Who confirmed it, and when, is stored and recorded in the audit log.
  • Only then does the page show the simplified declaration (Annex VI) pointing at it. An address entered without the confirmation is not published.
  • The declaration Declara drafts is never published here. It is a draft for you to complete and sign elsewhere, and nothing copies it into these fields.
  • A confirmed declaration also goes into a market-surveillance pack and fills item 6 of the user information.

Declara does not check the document. Confirming it is your act, not ours.

What you should see

The settings card shows Published with the date it first went live. If your disclosure page is not published, it says so, and the Trust Center is not visible. Public pages refresh within moments of a change to the product, the disclosure page or the plan; a cached copy can linger briefly.

Related