Skip to content
SPECIFICTION
Get listed

Kosli

kosli.com

WebWindowsmacOSLinuxAPISelf-hosted
Visit kosli.com
Spec score 7.5 #15 of 24 in Software Supply Chain Security Software

What it is

Kosli is a change-recording and compliance-monitoring platform for tracking software and business-process changes. It centralizes attestations, software bills of materials, scans, and build metadata, then links that evidence to a real-time production view. Cryptographic provenance and fingerprints create a tamper-evident chain from commit to production. Policy-as-code controls, automated evidence collection, and notifications address deviations, while runtime monitoring can identify artifacts with unknown provenance and provide time-machine forensics for environment changes. Kosli lists integrations including GitHub, Bitbucket, GitLab, CircleCI, Jenkins, Microsoft Azure, TeamCity, Terraform, Ansible, Datadog, New Relic, Jira, ServiceNow, Slack, and Email. It supports SaaS, single-tenant AWS hosting, and on-premises Enterprise deployment. The platform runs through API, Linux, macOS, self-hosted, web, and Windows. Pricing is available on request.

Spec sheet

Purpose
Kosli is a change recording and compliance monitoring platform for tracking and querying software or business-process changes.Read 1 Oct 2026 · docs.kosli.com
Integrations
Kosli lists integrations including GitHub, Bitbucket, GitLab, CircleCI, Jenkins, Microsoft Azure, TeamCity, Terraform, Ansible, Datadog, New Relic, Jira, ServiceNow, Slack and Email.Read 1 Oct 2026 · kosli.com
Headquarters
Oslo, NorwayRead 28 Sep 2026 · kosli.com
Access model
Kosli says it does not require access to customer systems because data is sent one way through its API or open-source CLI.Read 1 Oct 2026 · kosli.com
Chain of custody
Kosli records cryptographic provenance and fingerprints to provide a tamper-evident chain of custody from commit to production.Read 1 Oct 2026 · kosli.com
Data protection
Kosli states that data is encrypted at rest and in transit, backed up daily to another region, and that application data is resident in the EU.Read 1 Oct 2026 · kosli.com
Deployment options
Kosli offers multi-tenant SaaS, single-tenant hosting in a customer-selected AWS region, and on-premises deployment for Enterprise customers.Read 1 Oct 2026 · kosli.com
Identity controls
Kosli supports SSO through an existing identity provider and automatically uses the provider’s MFA settings.Read 1 Oct 2026 · kosli.com
Policy controls
Kosli supports policy-as-code controls, automated evidence collection and real-time notifications for deviations.Read 1 Oct 2026 · kosli.com
Runtime monitoring
Kosli detects running artifacts of unknown provenance and provides time-machine forensics for environment changes.Read 1 Oct 2026 · kosli.com
Security certification
Kosli states that it completed an AICPA SOC 2 Type II audit.Read 1 Oct 2026 · kosli.com
Supply-chain security
Kosli centralizes attestations, SBOMs, scans and build metadata, then connects them to a real-time production view.Read 1 Oct 2026 · kosli.com
Support SLA
Kosli states that security SLAs are provided for Enterprise customers.Read 1 Oct 2026 · kosli.com
Target users
Kosli says it is built for software development teams operating in highly regulated industries, including banks and other regulated enterprises.Read 1 Oct 2026 · kosli.com
Tool compatibility
Kosli says it is tool-agnostic and push-only, so CI systems, scanners and signing tools can remain in place.Read 1 Oct 2026 · kosli.com

Plans and prices

Custom annual contract Priced on request annual contract based on recorded data and retention · volume discounts · usage costs capped during contract Read 1 Oct 2026 · kosli.com

Every Kosli plan and price →

Strong points and limits

Strong points

  • Tracks provenance from commit through production
  • Centralizes attestations, SBOMs, scans, and build metadata
  • Supports policy-as-code and automated evidence collection
  • Offers SaaS, single-tenant, and on-premises deployment
  • Provides SSO and encrypted data protection

Limits

  • Pricing is available only on request
  • On-premises deployment is for Enterprise customers
  • Security SLAs are provided for Enterprise customers

Who it suits

Kosli is aimed at software development teams in highly regulated industries, including banks and other regulated enterprises. Its deployment choices also suit organizations requiring customer-selected cloud regions or on-premises hosting.

Verdict

Kosli focuses on traceable software changes, supply-chain evidence, and compliance controls. Its push-only model lets existing CI, scanning, and signing tools remain in place.

Where Specifiction places it

Alternatives to KosliAll alternatives →