Skip to content
SPECIFICTION
Get listed

Chainloop

chainloop.dev

Free plan WebmacOSLinuxAPISelf-hosted
Visit chainloop.dev
Spec score 8.2 #8 of 24 in Software Supply Chain Security Software

What it is

Chainloop centralizes software delivery artifacts and evidence to support security, compliance and visibility across the delivery process. Its evidence store can hold metadata for SBOMs, QA reports, vulnerability scans and legal reviews. It connects metadata and artifacts in a graph, providing provenance and context for control gates, quality checks and compliance dashboards. The CLI and integrations capture evidence from CI/CD pipelines, including Git commit details and pipeline configuration. Documentation describes signing metadata with SLSA, in-toto, Sigstore or customer PKI such as AWS KMS or Keyfactor. Deployment options include cloud and self-managed setups, including on-premises and airgapped environments. The paid platform adds curated policies and frameworks such as SLSA, SSDF, CRA, DORA and NIS2. Community Edition costs nothing, is free and open source, and is self-hosted with community support; it has no UI or curated policy library. The enterprise Chainloop Platform has pricing available by contacting the maker and lists dedicated support.

Spec sheet

Purpose
Chainloop centralizes software delivery artifacts and evidence to support security, compliance, and visibility across the software delivery process.Read 30 Sep 2026 · docs.chainloop.dev
Intended users
Community Edition is aimed at starters, evaluators, and small teams with technical expertise; the enterprise platform is for organizations needing full SDLC security and compliance.Read 30 Sep 2026 · chainloop.dev
Deployment
The platform offers cloud and self-managed deployment options, including on-premises and airgapped setups; the pricing page identifies AWS, Azure, Google, and OpenShift for on-premises deployments.Read 30 Sep 2026 · chainloop.dev
Integrations
Documented integrations include Dependency-Track, Slack, Microsoft Teams, Linear, OpenAI, and Anthropic, with some integrations limited to paid plans.Read 30 Sep 2026 · docs.chainloop.dev
Support
Community Edition includes community support, while the enterprise platform lists dedicated support.Read 30 Sep 2026 · chainloop.dev
Company
Chainloop identifies itself as Chainloop, Inc.; LinkedIn lists its headquarters as San Francisco and its founding year as 2023.Read 30 Sep 2026 · linkedin.com
Attestations
The CLI and integrations capture evidence from CI/CD pipelines, including context such as Git commit details and pipeline configuration.Read 30 Sep 2026 · docs.chainloop.dev
CLI platforms
The CLI installation page lists Linux and macOS binaries for Intel and ARM64 architectures.Read 30 Sep 2026 · docs.chainloop.dev
Evidence types
Its evidence store can centralize metadata including SBOMs, QA reports, vulnerability scans, and legal reviews.Read 30 Sep 2026 · chainloop.dev
Policies and frameworks
The paid platform includes curated policies and compliance frameworks such as SLSA, SSDF, CRA, DORA, and NIS2.Read 30 Sep 2026 · chainloop.dev
Provenance
Chainloop connects metadata and artifacts in a graph to provide provenance and context for control gates, quality checks, and compliance dashboards.Read 30 Sep 2026 · chainloop.dev
Security certifications
Chainloop’s Trust Center lists SOC 2 Type 2 and ISO 27001, with ISO 27001 marked in progress.Read 30 Sep 2026 · trust.chainloop.dev
Signing
Chainloop documentation says metadata can be digitally signed using SLSA, in-toto, Sigstore, or customer PKI such as AWS KMS or Keyfactor.Read 30 Sep 2026 · docs.chainloop.dev

Plans and prices

Community Edition Free Free and open source · self-hosted · no UI or curated policy library · community support Read 30 Sep 2026 · chainloop.dev
Chainloop Platform Priced on request Contact us for pricing Enterprise SDLC governance · cloud, BYOC, on-premises, or airgapped deployment · dedicated support Read 30 Sep 2026 · chainloop.dev

Every Chainloop plan and price →

Strong points and limits

Strong points

  • Centralizes SBOMs, QA reports and vulnerability scans.
  • Captures pipeline evidence, including Git commit details.
  • Supports cloud, self-managed and airgapped deployment.
  • Community Edition is free and open source.

Limits

  • Community Edition is self-hosted and has no UI.
  • Community Edition lacks a curated policy library.
  • Platform pricing requires contacting the maker.

Who it suits

Community Edition is aimed at starters, evaluators and small technical teams. The paid platform is for organizations needing broader SDLC security and compliance.

Verdict

Chainloop offers a free self-hosted starting point and a paid platform with curated policies and deployment choices. The Community Edition’s lack of UI and policy library is an important boundary.

Where Specifiction places it

Alternatives to ChainloopAll alternatives →