The CRA team you don't have.

Built by an engineering team in Kosovo for European manufacturers. Our job is to turn product-security requirements into work your team can inspect, understand and maintain.

Close to the build. Close to the problem.

A component inventory is useful when it describes what actually ships. A vulnerability decision is useful when an engineer can explain it. A technical file is useful when the evidence survives the next release. We focus on that connection between the product and its documents.

Roja combines a platform with people who do the work alongside your team: SBOM validation, monitoring, triage, reporting drafts, documentation and remediation help. Manufacturers remain accountable for their decisions and submissions. We make the engineering work concrete and reviewable.

How we work

We start with one product and agree its boundary, inputs and authorised access. We record assumptions and limitations rather than filling gaps with a confident-sounding conclusion. We review findings with the people who know the architecture and keep release references attached to the evidence.

Projects have a defined scope, timeline and price. Ongoing monitoring has a stated triage allowance and escalation process. Before sensitive build material is shared, we agree access, EU data location, retention and deletion in writing. A free Snapshot is a starting review, not an automatic commitment to a subscription.

Clear professional boundaries

We do not certify products, act as a notified body, provide legal advice or carry out penetration testing. Accredited partner labs conduct testing; conformity bodies handle the applicable statutory assessment roles. Where your route needs external involvement, we help prepare the evidence and coordinate the handover.

Team information

Named team biographies will be published after the people and their approved details are confirmed. This local project does not invent founders, qualifications, customer logos or client outcomes. Contact us to discuss the people assigned to a proposed engagement.

See our published prices, read our disclosure policy or start with one product.

A handover your team can keep using

We want the next release to be easier to review than the first. That means keeping component identities, build references, applicability decisions and document ownership visible. If an engineer changes role or a supplier stops maintaining a component, the reasoning should remain available. An export without that context can become obsolete as soon as the product changes.

We distinguish findings from conclusions. A scanner may identify a candidate vulnerability, while a product-specific review determines whether the affected code is present and relevant. We preserve the evidence for that decision and the assumptions that could change it. Your engineers get something they can challenge and improve, rather than an unexplained score.

The right help at the right stage

A smaller manufacturer may need an initial inventory before it can scope an implementation project. Another team may already have documents but need help triaging vulnerabilities across supported branches. We start with the missing work and define the engagement around it. Assessment, implementation and monitoring are separate scopes so the customer can see what each price buys.

A statutory interpretation may need qualified legal review, while an external assessment may need a designated body. We coordinate engineering evidence around those roles. The goal is clear accountability and a manufacturer that understands its security process after an engagement ends. Our work should leave the customer with a maintained evidence index, named owners and a practical plan.

We do not invent team credentials or imply that an engineering review transfers statutory responsibility. Before an engagement, the customer should know who is assigned, what information they need and what the resulting deliverable will establish. Open questions and access limitations belong in the handover alongside completed work. A useful relationship makes those boundaries easier to see and manage.