DejaCode vs FOSSA
DejaCode
public.dejacode.comFOSSA
fossa.comSide by side
| Figure | DejaCode | FOSSA |
|---|---|---|
| Price from | $500/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 3 |
| Spec score · Open Source License Compliance Software | 8.4 (#4) | 8.1 (#8) |
| Deployment | The documentation describes Docker-based installation, enterprise deployment, and local development installation. | FOSSA documents an on-premises deployment that customers can operate in their own infrastructure using Kubernetes and Helm. |
| Founded | 2003 | 2015 |
| Headquarters | United States | San Francisco, California, United States |
| Integrations | Documented platform integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. | Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. |
| Purpose | DejaCode is an enterprise application for automating open-source license compliance and software supply-chain integrity. | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. |
| SBOMs | It can capture, store, and manage SBOMs and maintain historical data for audits. | FOSSA supports generating, importing, exporting, and managing SBOMs; the pricing page lists a limit of five imported SBOMs on Free. |
| Support | Team and Business plans list technical training and web and email support. | The Free plan includes basic email support, while Business includes priority support. |
Plans
In their own words
DejaCode
DejaCode is an enterprise application for managing open-source license compliance and software supply-chain integrity across products and teams. It tracks open-source and third-party components, with unlimited products, components, and packages in each plan. Teams can store and manage SBOMs, retain historical records for audits, and import CycloneDX, SPDX, or AboutFile formats. Usage policies can be set at license or package level and linked with ScanCode; enforcement is advisory. Integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. AboutCode connections include ScanCode.io for package scanning, PurlDB, and VulnerableCode for vulnerability data. Deployment documentation covers Docker, enterprise, and local development setups. For enterprise deployments, the guidance recommends running your own related service instances to avoid sending sensitive or private data to public endpoints. Team starts at $500 a month and Business at $1,500 a month, each billed annually at the start of the subscription period. Enterprise pricing is custom and not listed. A private evaluation instance with all features and support is available for 30 days.
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.