The answers most people need are below. For anything else, sign in and ask: a person reads every request, and the reply comes to the app and to your inbox.
| Question | Answer |
|---|---|
| What is free? | Every CVE page and every receipt, with no account. With a free account: one stack of three products watched, every product you paste watched for your first 14 days, sitreps by email, a weekly all-clear, 100 decision records and investigations, and 25 briefs a month. |
| What happens when the free 14 days end? | Two days before, we email you the products that will go quiet. On the last day the first three you added stay watched and the rest pause. Nothing is deleted: a paused product stays on your stack and starts again the moment you choose Practitioner, $20 a month. |
| What does a decision record do? | It keeps your call on a CVE (accepted, deferred, patch by a date, not affected, mitigated) with your reason, a date our server sets, and the CVE's evidence that day frozen beside it. While the call holds, the CVE's routine alerts are held back. You hear from us when new evidence breaks it: a KEV listing on an accepted risk, an affected range that now covers your version, a CISA deadline before your patch-by date. |
| Can I change or delete a record? | A record cannot be altered or removed, by anyone, including you. You change your mind with a new version, and the one before stays readable. If a record holds personal data that should not be there, ask us for a redaction. |
| What is an investigation? | A record of an incident or a near miss you looked into: what happened, who owns it, the products and CVEs involved, and when to check back. Anyone in your organisation can find it again, and new evidence on its CVE reaches you while it is open. Set a check-back date and we email you the day after it, if it is still open. Close it with a new version that says what you found. |
| An alert is not relevant to us. How do we stop it? | Press "Not relevant to us" on the alert. It records a not-affected call on that CVE with your reason, and the CVE goes quiet until new evidence breaks the call. The click also becomes a line in your alert preferences, which vciy's model reads before the next alert reaches you. |
| Can a filter hide something important? | Not the alerts that matter most. A KEV listing on what you watch, a CISA deadline change, a broken call and new evidence on an open investigation always reach you. Anything held back is kept, listed and counted in the weekly all-clear, and every preference line can be read and removed. |
| Where do the facts on a CVE page come from? | From the public sources named on each line: the CVE record, NVD, CISA's KEV catalog and its own scoring, FIRST's EPSS, and public proof-of-concept listings. Every value carries a receipt with when it was true at the source and when we learned it. |
| How do I cancel, and is there a refund? | Monthly plans cancel anytime. Yearly plans carry a 30 day money back guarantee. Custody carries 30 days money back on its first term. |
| Custody, on-premises or many seats? | Custody starts with an evidence review. Write to sales@vciy.com. |
Not answered here? Sign in and ask us. Plans and prices in full are on the pricing page.