Billing & Subscription
The Billing & Subscription settings allow administrators to manage the financial aspects of their CVD Portal usage. Ensuring uninterrupted access to the portal is crucial for maintaining your Coordinated Vulnerability Disclosure (CVD) program and remaining compliant with the ongoing obligations of the Cyber Resilience Act (CRA).
Only admins can open Billing. On this page you see your current plan and can upgrade it. You manage your subscription, your payment method and your invoices in the Stripe customer portal, which opens from this page. The page does not show usage metrics.
Subscribe during a trial
During a trial, the main button on Billing keeps the plan you are trying, for example Keep Compliance. You can also choose a higher plan, or select Compare all plans to see the lower ones.
During a Compliance trial, Billing and the trial banner also offer Choose Reporting. Reporting covers Article 14 reporting only, which applies now. The rest of the CRA applies on 11 December 2027. From then, every product you place on the EU market needs a risk assessment, technical documentation and a Declaration of Conformity, and Compliance builds them per product. If you choose Reporting, you keep Compliance until the trial ends, and Reporting starts on that date. Your trial work is preserved.
When you subscribe during a trial, you keep the trial days that are left. Stripe holds your card but does not charge it until the date the trial ends. The page shows that date under each button. If the trial ends in less than 48 hours, Stripe charges the card when you subscribe.
To stop before the first charge, cancel the subscription in the Stripe customer portal before that date.
VAT and invoices
Prices exclude VAT. At checkout, Stripe asks for your billing address and, for a business, your VAT number. Stripe then calculates the VAT:
- A customer in the Netherlands pays 21% Dutch VAT.
- A business in another EU country with a valid VAT number pays no VAT. The invoice shows both VAT numbers and the reverse-charge note.
- A customer outside the EU pays no VAT.
Checkout also asks you to accept the Terms of Service. To add or change your VAT number later, open Billing and select Manage billing. The change applies to new invoices.
Add products above your plan
Compliance includes 3 products. Enterprise includes 25. Each extra product costs €99 per month. On an annual subscription, Stripe charges €1,188 per product per year.
To add products:
- Open Products and select Add product. When you reach your limit, Add product opens the Add products page.
- Enter the number of extra products that you need.
- Select Update extra products.
You can also open the page from Billing. Select Extra products.
Stripe charges the payment method on file at once. The charge is prorated for the rest of the billing period, plus VAT where it applies. The new limit applies when the payment succeeds, usually within one minute. Then go back to Products to add your product.
If your bank asks you to confirm the payment, the page tells you. Open Billing, select Manage billing and pay the open invoice. The new limit applies when the payment succeeds.
To lower the number, open Billing, select Extra products and enter a smaller number. The form does not accept a number below the products that you use. Archive or delete products first. Stripe credits the unused time on your next invoice.
Only admins can change the number. Extra products need a paid Compliance or Enterprise subscription that you pay to us directly. During a trial, subscribe first. If a partner pays for your plan, or if we invoice your Enterprise contract, contact us to change the number.
When the subscription ends, the extra products end with it.
Buy through AWS Marketplace
You can also buy CVD Portal Enterprise on AWS Marketplace, as a 12-month or 36-month contract. AWS bills the contract on your AWS invoice. This is useful when your company buys software through its AWS account. Only Enterprise is for sale on AWS Marketplace.
The listing is CVD Portal on AWS Marketplace. AWS shows the public price in US dollars. To get other terms, contact us for a private offer. Give us the 12-digit ID of the AWS account that will buy. AWS shows a private offer only to that account.
To link the purchase to your workspace:
- Open the listing, sign in to AWS and accept the offer.
- Select Set up your account. AWS opens CVD Portal.
- Sign in as an admin of your company. If you have no account, register and confirm your email. Then open the page again within 24 hours.
- Select Link to and the name of your workspace.
Billing then shows that AWS bills your plan. The plan follows your AWS contract.
Some workspaces cannot link a purchase:
- A workspace that pays by card. Cancel the card subscription on Billing first.
- A workspace that a partner pays for.
- A client workspace that a consultant opened. Only an admin can link, from the admin's own workspace.
Some workspaces must confirm the link. The page then shows a box to tick:
- The workspace already has a paid plan that AWS does not bill, for example an Enterprise contract that we invoice. A direct agreement with us does not end when you link. To end it, email support@cvdportal.com.
- The workspace already has an active AWS Marketplace contract. Link the new purchase only if it replaces that contract. If both contracts stay active, AWS bills both.
When the AWS contract ends, the workspace moves to the Free plan. Nothing is deleted, see Your data after a downgrade. AWS does not let a buyer cancel a contract before its end date. To end a contract early, email support@cvdportal.com.
Extra products above the 25 in Enterprise are not for sale on AWS Marketplace. To add them, email support@cvdportal.com.
What happens when a trial ends
A trial needs no cancellation. If you did not subscribe, no card is held, so nothing bills automatically and the account moves to the Free plan on the end date.
Administrators receive two emails. The first arrives three days before the end date and names the date. The second arrives after the end date and lists what changed.
| Item | During the trial | On the Free plan |
|---|---|---|
| Product assessments | 3 | 0 |
| Team seats | 5 | 1 |
| Vulnerability disclosure portal | Included | Included, at no cost |
| Report intake and tracking | Included | Included, at no cost |
Both emails go to users with the Administrator role. Members and auditors cannot change a plan, so they are not notified.
What happens when a paid subscription is cancelled
Administrators receive one email that names the cancelled tier and lists the same changes. Stripe sends the payment receipt separately.
Refund when you delete the account
An administrator deletes the account in Settings, Account, Danger Zone. Download your data first with Export your data on the same page. The CRA requires you to keep your technical documentation for 10 years.
When you delete the account, we cancel the card subscription at once and send no more invoices. We keep the fees for one calendar month from the deletion. We refund the share you paid for each whole billing month that starts after that month. Stripe emails you a credit note and returns the money to the card you used.
| You paid | You delete | We keep the fees until | We refund |
|---|---|---|---|
| A year on 1 January | 15 March | 15 April | May to December, 8 of 12 months |
| A year on 1 January | 10 December | 10 January | Nothing, no whole month is left |
| A month on 1 March | 2 March | 2 April | Nothing, no whole month is left |
A billing period that started before 3 November 2026 keeps no calendar month. We refund each whole billing month that starts after the deletion.
If AWS Marketplace bills you, the AWS contract stays active until its end date. To end it early, email support@cvdportal.com. If a partner bills you, ask the partner. Section 6 of the Terms of Service has the full rule.
Your data after a downgrade
Nothing is deleted when a trial ends or a subscription is cancelled. Every assessment, document and report is preserved and unlocks again when you subscribe. You can also download the all-products HTML archive, so work built during a trial is never locked in.
An account becomes eligible for deletion only after 90 days of inactivity. We then give 30 days of written notice before anything is removed.