When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Not yet released. Self-hosting isn’t available until the first release ships. Planned: a docker-compose.selfhost.yml that runs the craclock binary, Postgres, and Caddy together.

Self-hosting will keep every byte of case data on your own infrastructure. The ruleset stream (regulatory updates) will still fetch over the network unless you disable it. See Security for how case data is encrypted at rest either way.