Short answer: StreamSec Tools stays what it has been for more than 25 years — a commercially licensed library, developed, maintained and supported by StreamSec. The EU Cyber Resilience Act does not change that; if anything, it makes it worth more. We will not hand the library over to open source and walk away from it, and we will not take it off the market to sell it to a single buyer. We are doing the work the Act asks of a manufacturer, and much of it is already done.

WHY WE ARE SAYING THIS

The Cyber Resilience Act puts obligations on everyone who sells software in the EU, and customers who follow it have asked the obvious question: will a small, specialised vendor carry that load — or will it give the product away as open source, or sell it off to one customer who keeps it in-house? Either would leave you holding a component that nobody maintains, and under the same Act you answer for the components in your own product. So here is our answer, and the work behind it.

WHAT THE ACT ASKS OF US, AND WHERE WE STAND

• Secure by default. Every setting the library chooses on your behalf is the secure one — the TLS cipher suites and signature algorithms, the signing hashes, the protection of exported keys, the password-based key derivation. Where the secure choice changed what existing code does, the change log says so in its first entry, and says how to choose the old behaviour deliberately where an old peer requires it. Secure by construction »
• Security fixes, free of charge. Security fixes are free for at least five years, delivered without delay as source patches and published in the Announcements section of our support forum — where the patches already published reach back to releases from 2018. Each one stays available there for at least ten years.
• The easy way to stay current. Renewing a StreamSec Tools subscription has always been heavily discounted, and it gives you a complete, current archive that already includes every fix you need, instead of a set of patches to apply one by one. It also brings the bug fixes and feature additions that are not classed as potentially exploitable vulnerabilities, and so are never published as security patches. Renew or order »
• One place to report a vulnerability. support@streamsec.se is our single point of contact for vulnerabilities, and our security policy says how a report is handled and when the details are published. A fixed vulnerability gets a patch and an advisory, and our procedure for reporting an actively exploited vulnerability to the EU authorities — required since 11 September 2026 — is in place.
• The whole bill of materials, with every release. A CycloneDX SBOM ships with each release, listing every third-party entry with its license, its reachability and how to remove it. The whole iceberg »
• Evidence, not assurances. The algorithms are tested against published test vectors, NIST's among them; the protocols are interop-tested against OpenSSL and OpenSSH; and a self-test battery runs on 32-bit and 64-bit Windows and on Linux.
• CE marking. StreamSec Tools will carry the CE marking, with its EU declaration of conformity published on this page, before the Act's main obligations apply on 11 December 2027.

WHY A MAINTAINED COMPONENT IS THE CRA-FRIENDLY CHOICE

If you place a product on the EU market, the Act makes you its manufacturer, and it expects you to exercise due diligence over the third-party components inside it. What that due diligence looks for is exactly what a maintained commercial component provides: a known manufacturer, a stated support period, security fixes for the whole of that period, a bill of materials, and documented defaults. Open source is not the problem — an unowned component is. A library that someone is paid to maintain, and does maintain, is the easiest part of your compliance to document.

AND WHATEVER HAPPENS

Every StreamSec Tools license includes the complete Object Pascal source code of the library. You are never left holding a binary you cannot inspect, rebuild or patch.

Questions about the CRA and StreamSec Tools: sales@streamsec.se. To report a vulnerability: support@streamsec.se.