Cyresora

For manufacturers under the Cyber Resilience Act (reporting from 11 September 2026) and NIS2 entities: every reporting deadline counted in hours from the event the law counts it from, a record of what you sent and to whom, and alerts to your rota.

The problem it solves

A self-hosted NIS2 reporting register matters the day you fall in scope, because the reporting clocks run in hours, each from the event the law counts it from — and an enterprise GRC platform is a lot of machinery for keeping that record straight. Cyresora is $79 once: deadlines counted in hours, what you sent and to whom, vulnerabilities and the rota, in plain PHP on your own server.

Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) sets an early warning within 24 hours for an actively exploited vulnerability or a severe incident; Article 71(2) makes it apply from 11 September 2026, as the Regulation reads on EUR-Lex. Cyresora counts that period and records what you sent. NIS2 sets a 24-hour early warning for essential and important entities (Article 23). When that applies to you depends on your Member State's law.

There is no version of that timetable in which you work out the process while the clock is running. And a single event routinely triggers both regimes at once, each with its own ladder off the same moment of awareness.

• Deadlines tracked in someone's head during the one week nobody has spare attention
• Enterprise GRC or an incident-response retainer, both sized for larger organizations
• No record of what was actually sent, to whom and when, so nothing in the register marks the stage as filed

Every feature

• A live board, counted in hours. Every running deadline, worst first, in hours remaining. During an incident this is the only screen anyone opens, which is why it is the home screen.
• Every breach clock on one incident. CRA, NIS2, GDPR Article 33 and DORA, each counted from its own anchor: the moment you became aware, the moment the personal data breach was confirmed, the moment you classified it as major.
• Recording what you actually sent. To whom, when, through what channel, with their reference and the text kept. That record is what marks the stage as filed in the register, so it is its own permission: a member can work an incident, but declaring that a report went out needs notify.submit. Filing the same stage twice is refused by a unique index, because a duplicate is not a second stage filed.
• A vulnerability register with the switch that matters. Actively exploited, and the date a corrective measure became available — the event the CRA final-report clock waits for. Not a CVE feed and not a scanner: the handful you are actually handling.
• Scope as YOUR determination. Whether a product has digital elements, or whether you are an essential or important entity, is a decision with legal consequences. You mark it, with your reasoning recorded beside it. The register does not decide it and does not guess.
• The rota. Who notifies, who decides, their deputies, out-of-hours numbers, and the national authority each one deals with — the list nobody can find at 2am. With alerts on, the notifiers and their deputies are emailed as each deadline nears.
• The documents. A per-incident report PDF with every ladder and everything sent, plus CSVs of the reporting register one row per stage, the vulnerabilities, and an evidence manifest.
• Alerts and the owner layer. Deadline alerts to your rota by email through your own SMTP, and a signed deadline.alert webhook for SMS or chat — off until you switch them on. Two-factor sign-in · single sign-on through your identity provider (OIDC) · roles with invitation links · append-only audit trail with CSV export · one-click and scheduled backups with a dry-run restore · REST API with OpenAPI and signed webhooks · an MCP endpoint · evidence files on each incident · your logo and colors.
• What to send, drafted. Each stage's report drafted from your incident record under the headings the provision asks for, with the gaps marked. You check it, send it, and record it; Cyresora files nothing.
• Risk register and document hub. Risks filed under the NIS2 Article 21(2) measures, and every version of your policies with its hash, approver and review date.
• Devices from Microsoft Entra ID. Import the admin center's device export; next month's export updates the same rows.
• Updates from inside the app. The Updates page installs a new release with your license key: Ownware's signature is checked, a backup is taken first, and the app puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. It never checks by itself.
• Backups by themselves. Automatic backups, an optional copy to S3-compatible storage you own, and a weekly check that the latest backup reads back. The Health page names anything that needs attention.
• Own It 4.0.1 — fixes and an up-to-date manual. For Cyresora, 4.0.1 fixes an installer that had lost its styling and a command-line update that ended in an error after putting the previous version back. Its manual, FAQ and QUICKSTART now cover everything 4.0 added, including two Nginx rules that keep the data folder private. Your license covers it: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0.2 — the installer opens on every host. For Cyresora, 4.0.2 fixes a fresh install on an Apache host: the one-page setup at /install/ looped back to itself and never opened, and now it opens. Cyresora's Docker image also gives the web server the whole app folder, so a Docker install can finish and update itself. Your license covers it: press Check for updates on the Updates page, or download it from your order page.

Release notes in full

• Own It 4.1: client installations and your other tools. For Cyresora, 4.1 makes two changes that every app gets. An Extended license bought from October 4, 2026 covers up to ten client installations, one per client project: hand each one over to the client or host it for them, with the client's logo and colors from the app's branding settings. The API reference now shows how to connect Cyresora to Zapier, Make or n8n, using its own webhooks and API key. Your license covers the update: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0: it updates and backs itself up. For Cyresora, 4.0 means updates from inside the app: the Updates page checks for a new release with your license key, verifies Ownware's signature, takes a backup and puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. A new install can start with a sample business and remove it in one click; backups run by themselves, with an optional offsite copy and a weekly check that the latest one reads back; and the Health page says whether the install is looking after itself.
• Own It 3.3: the import preview tells the truth. The asset import's preview used to count a row whose owner email is not an address as ready, and the import then skipped it. Now the preview shows it as skipped before you confirm.
• Own It 3.2: every breach clock on one incident. The 3.2 wave (Cyresora 1.1) ran GDPR Article 33 and DORA beside the CRA and NIS2 ladders on the same incident, each from its own anchor, and drafted each stage's report from the incident record with the gaps marked, for you to check and send. It added a risk register filed under the NIS2 Article 21(2) measures, a document hub that keeps every version of your policies, and devices imported from Microsoft Entra ID.