BOMvault generates the full, immutable compliance dossier that FDA auditors, DoD ISSOs, and EU CRA reviewers actually sign off on — from a single SBOM run. Built for regulated software teams that cannot afford a Refuse-to-Accept letter.
| id | submitted | stage | status |
|---|---|---|---|
| 3c8d7e2a | 2026-05-09_18:42:11Z | Vulnerability enrichment | VERIFIED |
| 9f1ba03d | 2026-05-09_18:42:14Z | License provenance | VERIFIED |
| 61cc4470 | 2026-05-09_18:42:17Z | Evidence Builder | SEALED |
| 07e2891c | 2026-05-09_18:42:18Z | S3 Object Lock | ARCHIVED |
FDA reviewers, DoD ISSOs, and EU CRA market surveillance do not audit your SBOM file. They audit the cybersecurity documentation package: vulnerability assessments, VEX justifications, component support status, end-of-support dates, and a security architecture view — all tied to the release.
Most tools stop at generating the file. BOMvault closes the gap between SBOM generation and a tamper-evident submission artifact an auditor signs off on, automatically, for every release.
Stitched together. Manual before every submission.
One pipeline. Audit-ready, every release.
Every release runs through the same four-stage chain of custody. Hashes are recorded at each stage, statuses are typed, and the output is a framework-specific package — not another SBOM file in a portal.
Multi-format SBOMs from source and containers. CycloneDX 1.6 and SPDX 3.0 from a Rust Syft/Grype scanner pool.
Vulnerability data from OSV, GHSA, and NVD. Three-tier license provenance with conflict detection and risk scoring.
Assembles VEX, support status, end-of-support dates, and security architecture views into a framework-specific dossier.
Immutable S3 Object Lock, SOC 2 audit trail, 7-year retention, SAML 2.0 / OAuth 2.0 SSO, and PostgreSQL row-level multi-tenancy.
$ bomvault submit ./build/cardio-pump-v3.4.tar» resolving manifest… cyclonedx-1.6 (2,841 components)» enrich osv/ghsa/nvd 3,112 advisories matched» license 3-tier provenance 2 conflicts flagged» evidence fda-qmsr dod-ssdf eu-cra✓ SEALED bv-2026-0509-01 sha256:3c8d7e2a…9f1ba03d✓ ARCHIVED s3://vault.bomvault.io/cardio-pump-v3.4/bv-2026-0509-01.evp$
Medical device + SaMD teams preparing 510(k), De Novo, PMA.
DoD primes, subcontractors, and federal software programs.
Medtech and software vendors shipping into the EU market.
“Auditors don’t want our SBOM file. They want the evidence trail behind it. BOMvault is the first tool that ships that trail by default — sealed, dated, and impossible to argue with.”
FDA QMSR, DoD SSDF, EU CRA covered from a single SBOM run.
Immutable S3 Object Lock storage with SOC 2 access logging.
Submission-ready dossier closes the gap that triggers Refuse-to-Accept.
A release group maps to a shippable software product or device version under regulatory review. Add more as your portfolio grows — no per-seat tax, no scan-count games. Annual subscription, billed against the cost of a failed audit, not a SaaS seat.
Single regulated release group. First 510(k) or SSDF attestation.
Mid-market medtech and DoD subs shipping multiple device variants.
Large primes, hospital networks, multi-product portfolios.
30 minutes with a BOMvault engineer. We ingest one of your release artifacts and produce a sealed, framework-specific evidence package you can hand to your auditor.