For consultancies and managed service providers

Run the reporting duty for your clients

Most of the companies this Regulation catches will not run it themselves. They will hand it to whoever already runs their security, their compliance or their infrastructure. The Partner plan is one console over up to 10 client workspaces, each with its own inventory, its own clocks and its own evidence.

What the plan is

• Growth for up to 10 client workspaces
• White-label evidence packs and disclosure pages
• Partner console
• The Readiness Pack included, for every client workspace

€499 a month, excluding VAT; annual billing is ten months for twelve. Each client workspace carries the Growth limits. The pricing page has the comparison.

Whose name is on it

In the Partner workspace, the evidence pack handed to an authority, the disclosure page security researchers land on, and the Trust Center pages customers read under it carry the brand name you set. Client workspaces run on the Growth terms, so their packs and pages carry the client’s own name. The verification code on a pack resolves on the public verifier either way, so the chain of custody is checkable by anyone; what changes is whose name is on the cover.

Your clients’ customers and suppliers

Each client workspace carries the Growth features, so the questions that arrive from a client’s own customers can be answered from the same record: an expiring link to the SBOMs of a product’s supported versions, a verifiable supplier attestation pack, drafts and reminders for the notice windows their supply agreements impose (contractual, and not Article 14 deadlines), and upload links that ask a client’s own suppliers for their SBOMs. A market-surveillance authority’s request is answered the same way, with one verifiable pack. How each one works.

Referrals

A partner workspace has a code. Anyone who signs up through https://www.declara.dev/start?ref=your-code is attributed to you in the console, whether or not you manage their workspace. The credit is recorded the moment they give us an address — joining the waitlist counts — and it is recorded against that address rather than against their browser, so it survives an ad blocker, a private window, and reading on a phone before signing up on a laptop. Whoever introduces somebody keeps the credit; a later link does not move it.

One cookie is set on the way through, and it lasts the visit rather than ninety days: it only has to carry your code across a redirect. Nothing else is set — no consent banner, no third-party pixel, and nothing that follows anybody around.

There is no revenue share to describe yet. When there is, it will be on this page in numbers, and not before.

What Declara will not do for a client

File. ENISA’s platform has no API and a named person submits each report. What the console gives you is every filing drafted, every clock computed from awareness, and the record that it happened; the submission is yours, on the client’s behalf, with their authorisation on the platform.

This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.