Skip to content
SPECIFICTION
Get listed

Double Open Compliance

doubleopen.io

Free plan WebAPISelf-hosted
Visit doubleopen.io
Spec score 8.1 #7 of 28 in Open Source License Compliance Software

What it is

Double Open Compliance automates software security and license compliance with deterministic filters and framework-anchored AI agents. It addresses legal due diligence for the EU Cyber Resilience Act, NIS2, and DORA. ORT Analyzer captures transitive dependencies according to how software is built, while Double Open Server provides global file-level caching that the site says enables 10x faster scanning. The platform produces machine-readable SBOMs in CycloneDX and SPDX formats and manages GitHub, GitLab, and air-gapped projects. AI agents surface ambiguous exceptions for human verification or version-controlled pull requests. Vulnerability triage ranks CVEs by code reachability and package roles and proposes evidence-backed resolutions. Deployment can be SaaS or customer-hosted, with data in EU-controlled datacenters or on customer infrastructure. The ORT stack includes a web UI, dashboards, REST API, and identity management.

Spec sheet

Purpose
Double Open automates software security and license compliance using deterministic filters and framework-anchored AI agents.Read 30 Sep 2026 · doubleopen.io
Headquarters
Helsinki, FinlandRead 28 Sep 2026 · doubleopen.io
Maker
Double Open Oy is headquartered in Helsinki, Finland, and LinkedIn lists it as founded in 2023.Read 30 Sep 2026 · linkedin.com
Agent workflow
AI agents act as junior curators and surface high-ambiguity exceptions for human verification or version-controlled pull requests.Read 30 Sep 2026 · doubleopen.io
API and identity
The ORT technology stack used by Double Open provides a web UI, dashboards, REST API and identity management.Read 30 Sep 2026 · doubleopen.io
Compliance frameworks
The platform addresses legal due diligence for the EU Cyber Resilience Act, NIS2 and DORA.Read 30 Sep 2026 · doubleopen.io
Data handling
The service is intended for software component analysis and is not intended for storing personal or sensitive data.Read 30 Sep 2026 · doubleopen.io
Hosting and sovereignty
Customer data is hosted in EU-controlled datacenters or on the customer's own infrastructure, supporting GDPR compliance.Read 30 Sep 2026 · doubleopen.io
Open source foundation
The site's tools are built entirely on Apache-2.0 and MIT licensed open-source projects.Read 30 Sep 2026 · doubleopen.io
Performance
Double Open Server provides global file-level caching that the site says enables 10x faster scanning.Read 30 Sep 2026 · doubleopen.io
Repositories
The service can manage projects from GitHub and GitLab, as well as projects in air-gapped environments.Read 30 Sep 2026 · doubleopen.io
SBOM formats
The platform supports machine-readable SBOMs in CycloneDX and SPDX formats.Read 30 Sep 2026 · doubleopen.io
Scanning
ORT Analyzer captures transitive dependencies according to how they are actually built.Read 30 Sep 2026 · doubleopen.io
Service availability
Unless separately agreed, the SaaS service targets at least 99% uptime during regular business hours.Read 30 Sep 2026 · doubleopen.io
Vulnerability triage
Its vulnerability triage ranks CVEs by code reachability and package roles and proposes evidence-backed resolutions.Read 30 Sep 2026 · doubleopen.io

Plans and prices

Free Free Double Open Compliance SaaS tier Read 30 Sep 2026 · doubleopen.io
Enterprise Priced on request MCP Server included · proprietary anchors supported Read 30 Sep 2026 · doubleopen.io
Pro Priced on request MCP Server included · available for SaaS or hybrid delivery Read 30 Sep 2026 · doubleopen.io

Every Double Open Compliance plan and price →

Strong points and limits

Strong points

  • Supports CycloneDX and SPDX SBOMs
  • Handles GitHub, GitLab, and air-gapped projects
  • AI agents flag ambiguous exceptions
  • Customer-hosted deployment is available
  • Free tier costs nothing

Limits

  • Service targets 99% uptime during business hours
  • Not intended for personal or sensitive data

Who it suits

It suits teams managing software component security, license obligations, SBOMs, and regulatory due diligence across hosted or self-hosted environments.

Verdict

Double Open Compliance covers dependency analysis, SBOM production, vulnerability triage, and compliance workflows across several deployment models. The free tier is explicit, while higher-tier scope and pricing require clarification.

Where Specifiction places it

Alternatives to Double Open ComplianceAll alternatives →