DENIS and the EU Cyber Resilience Act

In short

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets security requirements for software and devices sold in the European Union, from design to vulnerability handling and updates. Its reporting duties apply from 11 September 2026 and the regulation applies in full from 11 December 2027.

For a decision maker: DENIS is built and maintained in the EU, its security practices are written down and can be checked, and the open items are listed below. For a technical reader: the evidence is a document in the source repository that maps each requirement to a mechanism, a file and an honest status.

What is in place

• Signed releases. Every release carries a signed checksum list. The installer and the updater check the signature before anything is installed.
• Software bill of materials. The release process attaches a CycloneDX and an SPDX bill of materials to releases, so you can run your own scanners against what is inside DENIS. The bill-of-materials page says from which release they are attached; for earlier ones you can generate the files from the source.
• Daily dependency check. Every day the dependencies are checked against a database of known vulnerabilities.
• Disclosure policy and contact. A published vulnerability disclosure policy, GitHub private reporting and the address mail@usedenis.com. Acknowledgement within 3 working days.
• Audit log. Sign-ins, configuration changes and every enforcement action are written to an audit log that can be exported to your SIEM.
• Secure updates. Updates are verified, backed up and rolled back automatically if the new version fails to start. Automatic security updates are on by default for new installations and can be switched off.
• Five years of security support. Every major version gets security fixes for at least five years from its first release. The current and the previous minor line always get them.
• Security fixes are free. Security fixes are always free of charge. New features go only into the newest version.

What is still to come

• Independent penetration test. Planned with an independent party; not done yet, and no date is promised. A summary, without technical details, will be published afterwards.
• Formal conformity assessment. Carried out before DENIS is sold. DENIS is not sold yet.

The readiness document lists further open points, such as encryption at rest, which DENIS leaves to disk encryption, and a tamper-evident audit log.

Where to read the evidence

• The full readiness document (docs/compliance/CRA.md on GitHub): requirement by requirement, with files and status.
• SECURITY.md: the vulnerability disclosure policy and how to report.
• The software bill of materials: what is inside DENIS and how it is produced.
• Security and trust: what DENIS does to protect itself and your data, and what has not been verified yet.
• Get DENIS and documentation.

Code reviews are internal and are not published. A summary of the review practice is in the readiness document, and full reports are given to auditors on request under a non-disclosure agreement.

Questions