Codenotary Trustcenter vs TRUSCA

Codenotary Trustcenter manages software bills of materials (SBOMs) and applies trust enforcement to applications and their components. It can import and export SBOMs in any format, create detailed SBOMs for open-source applications or containers, and analyze them. The platform tracks component provenance and trust levels, flags unknown or untrusted components, and monitors attestations and application and stack risk profiles. It provides real-time application risk scores with reachability analysis and can enforce deployment of container images built with known, trusted components. Trustcenter also supports software risk profiles for compliance and audit work, plus artifact attestation guidance such as in-toto. Listed integrations include CI/CD and SCM tools, Docker and OCI registries, Snyk, Aqua, JFrog, Jenkins, GitLab, GitHub, Kubernetes, and AWS Lambda. Language bindings include Java, C++, Python, Node.js, Go, Rust, and PHP. Trustcenter/Teams is offered on-premises or in the cloud, with component discovery, dependency tracking, centralized SBOM storage, and continuous vulnerability scanning. Enterprise plans start at $3,600 a month; Teams pricing is by quote. A 30-day trial is listed.

TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.