States, verdicts and event types
The application's reference tables, on one page. Handy to keep open while working a case, or to attach to an internal procedure.
Case states
| State | Origin | Available actions |
|---|
| new | Manual entry, or an external signal promoted to a case. | Start the triage, archive. |
| triage | Triage started. | Complete the three steps. |
| obligation | Verdict of obligation. | Take charge, prepare the notification, file. |
| in progress | Early warning filed. | File the update and the final report. |
| fulfilled | Final report filed. | Consult, generate the dossier. |
| archived | No obligation, or archiving. | Consult. |
Events arriving from outside (public form, connectors, API, intelligence) are not born as cases: they live first as signals in the INCOMING queue (/signals), with their own states — new, promoted, attached, duplicate, informational, dismiss. No statutory clock runs until a person promotes the signal to a case (it is the promotion that sets the moment of awareness).
Verdicts
| Verdict | Condition | Legal basis | Effect |
|---|
| obligation | Vulnerability with documented exploitation. | Art. 14(2)(a) | 24-hour clock, alert to the contact. |
| obligation (incident) | Serious incident with security properties compromised. | Art. 14(4)(a) | 24-hour clock; final report within one month of the early warning. |
| suspended | Insufficient elements to decide. | to be reassessed | Re-check reminder; the statutory deadline keeps running. |
| no obligation | Event out of scope, or precondition absent. | — | Archived with the justification on the record. |
Obligation phases and deadlines
| Phase | Deadline | Runs from | On confirmation |
|---|
| Early warning | 24 hours | Moment of awareness | The case moves to «in progress»; the update opens. |
| Update | 72 hours | Filing of the early warning | The final report opens; for a vulnerability you state the corrective-measure date. |
| Final report · incident | 1 month | Filing of the early warning | The case moves to «fulfilled». |
| Final report · vulnerability | 14 days | Availability of the corrective measure | The case moves to «fulfilled». |
Registry event types
| Type | Covers |
|---|
| report | Intake from the portal, manual entry. |
| assessment | Promotion, attachment or disposal of a signal, triage started and concluded, verdicts, taking charge, archiving, change of the moment of awareness. |
| notification | Filings of the three phases, user notice, upstream report, dispatch of operational alerts. |
| administration | Settings, users, escalation, API keys, SBOM, alert channels, account security. |
Clock colours
| State | Condition |
|---|
| More than 4 hours | More than 4 hours to the deadline. |
| Less than 4 hours | Under 4 hours to the deadline. |
| Deadline passed | Deadline missed. |
Subscription states
| State | Regulatory work | New products / API keys | Reading and export |
|---|
| trial | Yes | Yes (within slots) | Yes |
| active | Yes | Yes (within slots) | Yes |
| payment overdue (grace) | Yes | Yes (within slots) | Yes |
| suspended | Yes | No | Yes |
| canceled | Yes | No | Yes |
«Regulatory work» = opening cases, running triage, filing, attaching evidence and exporting: it never stops for a payment. Details in Subscription and billing.