See every part inside your firmware, and which ones need an update.
Proofsheet is a web app. Upload the file and it unpacks it, lists every part inside and matches each one against public vulnerability databases. In minutes it generates a report with the parts ranked by risk. Add the Cyber Resilience Act document pack when you need it. No human reviews your file.
Free peek, then from €99. Technical evidence, not a legal certificate.
| Part | Version | Status | Why |
|---|---|---|---|
| Linux kernel | 5.10.110 | Update | A newer 5.10 release has security fixes |
| OpenSSL | 1.1.1k | Out of support | No more public fixes since September 2023 |
| BusyBox | 1.31.1 | Update | Known bugs are listed for this version |
| zlib | 1.3.1 | Fine | No match in public bug lists |
| Dropbear SSH | 2022.83 | Update | A newer release is out |
| Mbed TLS | 3.6.2 | Fine | No match in public bug lists |
Three steps, a few minutes
Upload one file
Firmware image, phone app or desktop program, up to 200 MB. The software reads it and never runs it.
Read the free peek
A one-page report with your top 3 risks, at no cost. If the software cannot read the file, the report says so and you pay nothing.
Download the full report and pack
Pay by card. Download the parts list, the risks ranked by severity and the CRA documents.
What the app generates
- Parts list
- Every part the app finds, as CycloneDX 1.5 and SPDX 2.3 files. This is your SBOM.
- Risks
- Exact versions matched with the NVD. Parts on CISA's known exploited list are marked.
- Ranked by risk
- Every part sorted from highest to lowest risk, in plain English.
- Annex I map
- All 22 points of Annex I, each marked evidenced, partial or open.
- Document pack
- Technical file index, support-period record, reporting guide and policy templates.
Files the app reads
- Firmware images (gzip, tar, zip, cpio)
- Android apps
- Windows, Linux and Apple programs
- JavaScript and WebAssembly
- ZIP archives of any of these
The app cannot open encrypted firmware. If it cannot read your file, the report says so and you are not charged.
When a part is under attack, you have 24 hours
Since 11 September 2026, if a part in your product is being actively exploited, you must send an early warning within 24 hours. Watchdog, a software subscription, keeps matching your parts list against public lists of exploited vulnerabilities and generates the reports for you. You review them and submit them yourself.
How Watchdog worksWhich product class are you in?
A few yes-or-no questions tell you if your product is likely default, important or critical, and what that means for your conformity route. Free, and nothing you answer is stored.
Take the product-class checkPrices
| Plan | Price | What you get |
|---|---|---|
| Free peek | €0 | A one-page report with your top 3 risks, generated automatically. |
| The Label | €99 | The full generated parts list and risk report for one version. |
| The Paperwork | €249 | The Label plus the parts list files and the generated CRA document pack. |
| Watchdog | €79 a month | Software subscription: every release re-scanned, alerts and the 24-hour kit.Opening soon |
| Agency | €299 a month | Agency plan: ten products and your logo on the generated reports.Opening soon |
Pay by card. No call needed. Yearly plans get two months free. See all prices
What stays with you
No software can sign your declaration of conformity, choose your conformity route, set your support period or submit your reports to ENISA. Proofsheet generates the evidence and the drafts. You make the decisions.
Your file is deleted within 24 hours. No human opens it.
Questions people ask
Does this make my product CRA compliant?
No tool can do that. The report is technical evidence for your technical file. You still sign your own declaration of conformity, and some products need an outside notified body.
Who sees my file?
No human looks at it. The software reads it, generates the report, and deletes the file within 24 hours. The report stays for 30 days.
What if you cannot read my file?
The free peek says so, and you pay nothing. This happens with encrypted firmware.
Do I need an account or a call?
No. Upload, read the free peek, and pay by card if you want the full report. Everything runs in the app. Email is only for account and billing help.