Skip to content
SPECIFICTION
Get listed

SourceTrust

sourcetrust.dev

From $24.92/mo Free plan Web
Visit sourcetrust.dev
Spec score 7.6 #20 of 28 in Open Source License Compliance Software

What it is

SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.

Spec sheet

Purpose
SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship.Read 29 Sep 2026 · sourcetrust.dev
Integrations
The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports.Read 29 Sep 2026 · sourcetrust.dev
Support
SourceTrust offers a live walkthrough and lists [email protected] for platform questions.Read 29 Sep 2026 · sourcetrust.dev
Headquarters
Copenhagen, DenmarkRead 28 Sep 2026 · sourcetrust.dev
Founded
2026Read 28 Sep 2026 · sourcetrust.dev
Audience and limitation
The company describes the product as license compliance infrastructure for shipped products and says it is software tooling, not a law firm or legal advice.Read 29 Sep 2026 · sourcetrust.dev
Change monitoring
Repository sync and publish-drift checks flag when the live inventory differs from the published snapshot.Read 29 Sep 2026 · sourcetrust.dev
Data access
SourceTrust says it reads lockfiles and SBOMs, never source code, and parses lockfiles in the browser before upload.Read 29 Sep 2026 · sourcetrust.dev
Exports
Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF.Read 29 Sep 2026 · sourcetrust.dev
Free review
Projects, dependency imports, and license reviews are free for as long as needed; standard project billing starts on first publish or export download.Read 29 Sep 2026 · sourcetrust.dev
Inventory
It gathers direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory.Read 29 Sep 2026 · sourcetrust.dev
Open source eligibility
Eligible public GitHub projects can publish an attestation page for $0 with no card or trial clock, subject to fair use and SourceTrust attribution.Read 29 Sep 2026 · sourcetrust.dev
Review gates
Nothing is published until the team has reviewed and confirmed the record, and the product flags packages that need a decision.Read 29 Sep 2026 · sourcetrust.dev
Security controls
Pages can be password-protected and excluded from search engines, and optional vulnerability findings remain vendor-only.Read 29 Sep 2026 · sourcetrust.dev
Supported inputs
The platform overview says it supports 14 formats across 9 ecosystems, including CycloneDX SBOM uploads.Read 29 Sep 2026 · sourcetrust.dev
Verification
SourceTrust retrieves the shipped package, checks it against the registry digest, and reads the license text inside it.Read 29 Sep 2026 · sourcetrust.dev

Plans and prices

Open source Free eligible public GitHub repository · fair use applies · SourceTrust attribution Read 29 Sep 2026 · sourcetrust.dev
Per project — monthly $29 a month Monthly per shipped product · unlimited users · two watched branches Read 29 Sep 2026 · sourcetrust.dev
Per project — yearly $299 a year Yearly per shipped product · unlimited users · two watched branches Read 29 Sep 2026 · sourcetrust.dev
Extra watched branch $550 a month Same monthly or yearly choice as your plan per project · beyond the two included branches Read 29 Sep 2026 · sourcetrust.dev
Custom domain $49,499 a month Same monthly or yearly choice as your plan one hostname for every attestation page in your organization · non-refundable once provisioned Read 29 Sep 2026 · sourcetrust.dev
Security monitoring Price not published Same monthly or yearly choice as your plan organization-wide · daily OSV advisory scans · vendor-only findings Read 29 Sep 2026 · sourcetrust.dev

Every SourceTrust plan and price →

Strong points and limits

Strong points

  • Combines direct and transitive dependencies
  • Checks packages against registry digests
  • Requires review before publication
  • Imports lockfiles and SBOMs
  • Offers many compliance export formats

Limits

  • Standard billing starts at publish or download
  • Open-source eligibility requires fair use and attribution
  • It reads lockfiles and SBOMs, not source code
  • Custom domain pricing is $49499.00 per month

Who it suits

SourceTrust suits teams shipping software that need dependency inventories, license review, attribution outputs, and compliance pages. It is software tooling, not a law firm or legal advice.

Verdict

SourceTrust provides a review-controlled path from dependency inputs to published license information and export files. Its cloud plans cover shipped products, watched branches, security monitoring, and custom domains, with prices listed separately.

Where Specifiction places it

Alternatives to SourceTrustAll alternatives →