Troubleshooting

The situations that most often reach support, with the usual cause and the fix. If yours is not here, open a request: we will add the entry.

«Too many requests»Rate limit on sign-in attempts. Wait a few minutes: it is not an account lock.

The six-digit code is always rejectedThe phone's clock is off. Turn on automatic time; the code changes every 30 seconds.

I lost the phone with the authenticatorUse a recovery code (single-use). Without codes, open a support request: identity checks are required.

I sign in with Google but cannot see my colleagues' casesGlobal social sign-in takes you into the account already tied to your email: if you had created a personal organisation, you will see that one. To work with your colleagues, get invited into their organisation, or use company SSO (carrying the organisation slug), which provisions you into the right group. Content already created elsewhere has to be migrated with support.

The verification email never arrivesSpam folder and filters on no-reply@cranotify.eu. The link expires in 24 hours and is single-use.

Alerts and reminders

I do not receive the clock remindersCheck, in order: the escalation addresses (Account area › People), the spam filters, the email integration status in the Account area. The test send goes to your own address: if it arrives, the problem is in the escalation addresses.

Counsel receives too many alertsThey are set as contact or deputy, or they opted into filing confirmations. Fix the escalation chain.

Slack or Teams receive nothingUse the test message: the per-channel outcome lands in the registry. Typical causes: the connector was disabled by the workspace, a wrong webhook address, or the event is not selected.

My webhook rejects the messagesVerify the signature over the raw body, before deserialisation. See Slack, Teams and webhooks.

Flow and deadlines

The clock does not startThe moment of awareness has not been set: it is entered in the third triage step. Without it there is no expiry to compute.

The clock reads «expired» as soon as I set itThe moment of awareness you entered is more than 24 hours old. That is correct information: document the reason in the justification.

The final report shows no countdownIt is a vulnerability and the corrective-measure availability date has not been entered yet. It goes in when filing the 72-hour update.

I cannot start the triage on a reportIt is a signal in the INCOMING queue (/signals): it must first be promoted to a case — and it is the promotion that sets the moment of awareness — then the triage starts. While unpromoted it is only a signal, not a case.

The case says «in progress» but I thought it was closedAfter the early warning the update and the final report remain. «Fulfilled» only arrives with the last filing.

Filing

«Attach the receipt…»The file is mandatory: without proof of filing the state does not change. A PDF print of the confirmation page or the confirmation email saved as .eml is fine.

«Invalid receipt»Allowed formats: PDF, PNG, JPEG, .eml, up to 10 MB.

The platform gives me no protocol numberLeave the field empty: it is optional. The receipt is the evidence that counts.

I cannot access the ENISA platformAn institutional credentials problem, outside CRAnotify: EU Login and CSIRT authorisation. They are the checklist prerequisites — activate them ahead of time.

Writing blocked

«The current plan does not allow this action»The subscription is in grace or read-only. Regularise from Account area › Subscription. Reading and exports stay available at all times.

«This action requires administrator privileges»Company settings, users, API, SBOM, alerts and the form are administrator-only. The attempt stays on the record.

I cannot add a product or a userThere are no plan limits: registering a Managed Product is never refused. If the count is not what you expect, check archived products and linked variants.

Registry and evidence

The integrity check reports a broken chainExport the full CSV immediately, change nothing, and open a request quoting the first inconsistent row. See Registry integrity.

The CSV opens with wrong charactersThe file is UTF-8 with a byte-order mark: in Excel use text import specifying UTF-8, or open it with an editor that respects the encoding.

A registry row shows the wrong authorRows are not corrected. Record the correct act: the sequence will show the error and the rectification.

Public form

The embedded form does not appearCheck the iframe address (it must carry the form code and ?embed=1) and that your page's content policy does not block third-party frames.

Spam is coming inEnable the anti-bot check if available on the installation; the other defences are always on. Spam signals are disposed of at review (dismiss): they stay on the record without ever becoming a case.

A signal is marked «turnstile non verificabile»The verification service was unreachable and the submission was accepted so a genuine report would not be lost. Screen it with extra care before promoting it.

If you need help

Open a support request stating the organisation code, the case number, what you were doing and what happened. For a deadline that is running out, use the phone: +39 031 5478618.