Codenotary Trustcenter vs FOSSA

Codenotary Trustcenter manages software bills of materials (SBOMs) and applies trust enforcement to applications and their components. It can import and export SBOMs in any format, create detailed SBOMs for open-source applications or containers, and analyze them. The platform tracks component provenance and trust levels, flags unknown or untrusted components, and monitors attestations and application and stack risk profiles. It provides real-time application risk scores with reachability analysis and can enforce deployment of container images built with known, trusted components. Trustcenter also supports software risk profiles for compliance and audit work, plus artifact attestation guidance such as in-toto. Listed integrations include CI/CD and SCM tools, Docker and OCI registries, Snyk, Aqua, JFrog, Jenkins, GitLab, GitHub, Kubernetes, and AWS Lambda. Language bindings include Java, C++, Python, Node.js, Go, Rust, and PHP. Trustcenter/Teams is offered on-premises or in the cloud, with component discovery, dependency tracking, centralized SBOM storage, and continuous vulnerability scanning. Enterprise plans start at $3,600 a month; Teams pricing is by quote. A 30-day trial is listed.

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.