Know what you use. Verify what you trust.
ALVPHA Upstream helps software and product teams document their open-source inventory, assess specific risks and work through technical cases in a structured way. We agree a clearly defined scope with verifiable deliverables.
OpenChain ISO/IEC 5230
OpenChain ISO/IEC 18974
OSPO Alliance
KI BundesverbandYou need to understand which open-source components are evidenced within the agreed product scope and where information is missing.
Scanners provide findings. Your team needs documented assessments, clear responsibilities and actionable next steps.
A problem needs to be narrowed down, reproduced and documented for further work.
We examine the agreed inventory and available evidence to establish a structured basis for ownership, assessment and follow-up. Known coverage gaps are explicitly documented.
We support the triage of specific findings and document assessments, decisions and progress. Scope, data sources and responsibilities are agreed before work begins.
We search for existing patches on the customer's behalf and deliver them when available. We do not develop our own patches or pull requests. If no suitable patch is available, we cannot guarantee delivery or a fix.
Scope, inputs and deliverables are agreed before work begins. We deliver existing patches when available; we cannot guarantee availability or a fix. External open-source projects retain control over their acceptance decisions and release schedules.
The free Trust Check is a structured self-assessment across seven dimensions. Your answers are evaluated automatically; you immediately receive a one-page Trust Snapshot with up to three evidence gaps and next steps. No call, no code upload, no manual approval.
Start your free Trust CheckAutomatically generated orientation based on your answers. Not independently technically verified, no scan, no certificate, no trust score.
A paid, scoped Trust Assessment with Trust Report is commissioned separately and delivered with its own quality gates. Scope, permissions and price are agreed beforehand.
Discuss the product, release or technical issue and the desired outcome.
Agree inputs, work steps, responsibilities, deliverables and acceptance criteria.
Document sources, decisions, unresolved questions and progress.
Walk through the deliverables and identify useful next steps.
Depending on the agreed engagement, deliverables may include an inventory and coverage review, a prioritised action list, a documented technical case or a scoped operational pilot. We define inputs, deliverables, customer responsibilities and acceptance criteria before starting.
We work with organisations that use open-source components in their own products or systems and need reliable evidence and decisions.
Product and platform teams that need release evidence, licence clarity and an orderly process for handling findings.
Manufacturers of machines, devices and controllers with open source in firmware and companion software.
Public administrations and public IT service providers that operate open source and want structured governance, evidence and case handling.
The EU Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to manage vulnerabilities, report incidents and document components. A well-organised approach to open source is the foundation for that.
Regulation (EU) 2024/2847 entered into force.
Obligation to report actively exploited vulnerabilities and severe incidents.
The essential requirements of the CRA apply in full.
This information is for orientation only and does not constitute legal advice. Please assess your specific obligations with the competent bodies.
ALVPHA Tech GmbH
ALVPHA Tech GmbH has declared conformance of its open source licence compliance program with ISO/IEC 5230:2020 and its open source security assurance program with ISO/IEC 18974 through self-certification, and is part of the OpenChain Community of Conformance for both standards.
The self-certifications apply to the respective programs of ALVPHA Tech GmbH. They are not independent third-party certifications.
Do you support software, industrial or IT customers and want to add a clearly scoped open-source service to your offering? We can explore suitable client needs and a practical cooperation model with you.
Client ownership, technical responsibilities and commercial terms are agreed before a joint engagement.
Factual explanations of the topics your customers, auditors and the Cyber Resilience Act are raising with your team.
No. We first review the tools and evidence you already have. The engagement addresses a specific need, such as coverage, assessment, ownership or follow-through.
Its usefulness depends on the source, generation process and artifacts covered. We document the agreed review scope and known gaps.
No. Our technical upstream support covers searching for existing patches on the customer's behalf and delivering them when available. We do not develop our own patches. If no suitable patch is available, we cannot guarantee delivery or a fix. Testing, integration and installation are not included in this promise.
An introductory call establishes the need, technical scope and desired outcome. For a suitable engagement, we then prepare a scoped proposal.
Please do not submit confidential files, source code or security details through public contact channels. We agree suitable exchange channels and terms before transfer.
No. Scope and price depend on the agreed engagement. After the introductory call you receive a scoped proposal covering deliverables, your involvement and acceptance criteria.
What is your team working through? In an introductory call we clarify the need, the scope and a suitable first step.
No confidential files, source code or security details through public contact channels.
