CRACI provides build-time software supply chain security and SBOM generation for developers.
- Categories
- Software supply chain and SBOM, Third-party risk and security ratings, GRC and compliance automation
- Based in
- Helsinki, Finland
- Founded
- 2025
- Ownership
- Private
About CRACI
CRACI is a software supply chain security platform. It records software bills of materials (SBOMs) from every build, monitors vulnerabilities after shipping, and submits Cyber Resilience Act notifications on behalf of manufacturers. The company sells to software manufacturers, particularly those operating in Europe, and to teams managing third-party vendor compliance. CRACI runs GitHub Actions jobs on its own runners, which allows it to record what actually enters each build rather than scanning afterwards. This includes packages pulled in by build scripts, hooks, and base images. The platform provides vulnerability monitoring, triage, and routing to owning teams, and supports VEX. It also offers a vendor compliance portal for collecting and validating third-party SBOMs and certifications. Founded in Helsinki in 2025, CRACI raised a €1.4M pre-seed round in 2026. It builds on open standards like SPDX and CycloneDX and exports in those formats. The company states that risk assessment, conformity assessment, and declaration of conformity remain the manufacturer's responsibility.
Products
- Secure Build ServiceRuns each build job in an isolated virtual machine with a default-deny egress policy that is checked before the job starts.
- Package AnalyticsA package-aware proxy that records every package a job pulls in, including its resolved version, source, and declared license.
- Vendor SBOM ManagementCollects, validates, and tracks software bills of materials from vendors to identify vulnerabilities across the supply chain.
- Compliance Documentation PortalA self-service portal where vendors can submit required documentation, certifications, and security assessments.
- Risk Monitoring & AlertsMonitors vendor compliance status in real time and sends alerts for security incidents or compliance lapses.
Ownership and deals
- Raised $1.6m in a pre-seed roundInvestor Lifeline VenturesReport on the CRACI funding round of May 2026 (opens in a new tab)
Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.