DORA · NIS2 · EU CRA

Live container forensics, captured continuously

When there's an incident, these rules apply

DORA

In force since Jan 2025

Digital Operational Resilience Act

Applies to you if

You're an EU financial firm, or you supply IT to one

You must

Report major incidents and keep the records for years

NIS2

Becoming national law now

EU network & information security law

Applies to you if

You run an essential service: energy, health, transport, digital infrastructure

You must

Flag it in 24h, report in 72h, final report in a month

EU CRA

From Sep 2026

Cyber Resilience Act

Applies to you if

You sell software or connected products in the EU

You must

Report incidents and ship an SBOM with the product

Why image scans aren't enough

An image scan shows what you shipped, not what was running when the incident hit.

What it captures
Image scan
reel
What you shipped
package inventory (SBOM)
What was actually running
processes, memory, filesystem drift
Proof it holds up
verifiable timestamp, immutable

Reconstruct it after the fact and you have an estimate an auditor can challenge.

How reel closes the gap

Captured on schedule, before the pod is reaped

Set the schedule in a Kubernetes annotation. The agent captures each one while the pod is alive.

deployment.yaml
metadata:
  annotations:
    reel.io/schedule: |
      # checkpoint to the evidence vault
      @daily | upload checkpoint --s3-bucket evidence
      # software inventory alongside it
      @daily | upload sbom --scanners vuln --s3-bucket evidence
      # crypto inventory weekly
      @weekly | upload cbom
s3://evidence/prod/payment-0/ Object Lock
  • 2026-01-15 00:00checkpoint.tar.zst142 MB
  • 2026-01-15 00:00sbom.cdx.json1.2 MB
  • 2026-01-15 00:00cbom.cdx.json0.4 MB
  • 2026-01-14 00:00checkpoint.tar.zst141 MB
  • 2026-01-14 00:00sbom.cdx.json1.2 MB

Immutable copies in your S3 vault

Every capture lands in your bucket with a verifiable timestamp. Object Lock keeps it tamper-proof, the way a retention obligation expects.

Nothing left to reconstruct

Early warning, 72-hour notification, final report: each draws from a record that existed before the incident, not an estimate built afterward.