ReARM
rearmhq.com
What it is
ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.
Spec sheet
- Product
- ReARM describes itself as a release governance platform that tracks product composition, security posture, shipment clearance, supporting evidence, and what actually shipped.Read 29 Sep 2026 · rearmhq.com
- Integrations
- The documentation lists GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider integrations.Read 29 Sep 2026 · docs.rearmhq.com
- Headquarters
- Ottawa, Ontario, CanadaRead 28 Sep 2026 · rearmhq.com
- Founded
- 2019Read 28 Sep 2026 · rearmhq.com
- Dependency analysis limit
- The installation documentation says ReARM can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require Dependency-Track or imported VDR files.Read 29 Sep 2026 · docs.rearmhq.com
- Evidence retention
- The product page says it stores HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata with releases for 10+ years.Read 29 Sep 2026 · rearmhq.com
- Findings aggregation
- ReARM aggregates vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools, with triage and audit across organization, product, component, or release scope.Read 29 Sep 2026 · rearmhq.com
- Release approvals
- Release policies can automatically check releases, support manual and automated approvals, and record approver identity, timestamp, and evidence snapshot in an immutable audit trail.Read 29 Sep 2026 · rearmhq.com
- SBOM enrichment
- Reliza BEAR automatically enriches SBOMs with metadata including supplier, copyright, and license information.Read 29 Sep 2026 · rearmhq.com
- SBOM/XBOM management
- It organizes versioned SBOMs and XBOMs by release, component, and product, and supports cross-version dependency diffs and portfolio-wide dependency search.Read 29 Sep 2026 · rearmhq.com
- Security deployment
- The installation documentation says TLS is required for deployments outside localhost because login fails on a plain-HTTP page.Read 29 Sep 2026 · docs.rearmhq.com
- Self-hosting
- ReARM Community Edition can be installed with Docker Compose or a Kubernetes Helm chart and is licensed under AGPL 3.0.Read 29 Sep 2026 · docs.rearmhq.com
- Supported compliance needs
- The documentation says ReARM helps fulfill xBOM requirements of EU CRA, US Executive Orders 14028 and 14144, Section 524B of the FD&C Act, and India's RBI and SEBI.Read 29 Sep 2026 · docs.rearmhq.com
- Transparency Exchange API
- ReARM says it supports the Transparency Exchange API for distributing SBOMs and artifacts to downstream consumers.Read 29 Sep 2026 · rearmhq.com
Plans and prices
ReARM CE Free Free Forever Self-hosted · Single organization · Community support · Core SBOM/XBOM storage and retrieval · Vulnerabilities and violations via self-managed Dependency-Track integration Read 29 Sep 2026 · rearmhq.com
ReARM Pro - Enterprise $75 a month $75 per user per month 40+ users · All Standard features · Premium support (24x7, 1 hour response time) · Option for air-gapped deployment · Free 60-day trial Read 29 Sep 2026 · rearmhq.com
ReARM Pro - Starter $195 a month $195 Per Month 1-14 users · Up to 65GB compressed artifact storage · Priority support (8 hours response time) · Managed Dependency-Track · Free 60-day trial Read 29 Sep 2026 · rearmhq.com
ReARM Pro - Standard $1,350 a month $1,350 Per Month 15-39 users · All Starter features · Private VPC/VNet with SSO and unlimited artifact storage · Option for on-prem deployment · Enhanced support (24x7, 4 hours response time) · Free 60-day trial Read 29 Sep 2026 · rearmhq.com
Strong points and limits
Strong points
- Versions SBOMs and XBOMs across products and releases
- Retains release evidence for 10+ years
- Records approvals in an immutable audit trail
- Supports Transparency Exchange API distribution
Limits
- Scanning and policy findings need Dependency-Track or imported VDRs
- External deployments require TLS
- Starter plan limits artifact storage to 65GB compressed
Who it suits
ReARM suits teams that need release-level SBOM and XBOM records, security triage, and approval evidence. Self-hosting is an option for organizations able to install and operate its Community Edition.
Verdict
ReARM combines BOM management, security findings, and release approvals with retained evidence. Check the Dependency-Track requirement and the listed plan limits against your deployment needs.
Where Specifiction places it
- PlayStation Emulators#5 of 258.0
- Release Management Software#14 of 387.9
- SBOM Management Software#10 of 228.0