DejaCode vs SourceTrust

DejaCode is an enterprise application for managing open-source license compliance and software supply-chain integrity across products and teams. It tracks open-source and third-party components, with unlimited products, components, and packages in each plan. Teams can store and manage SBOMs, retain historical records for audits, and import CycloneDX, SPDX, or AboutFile formats. Usage policies can be set at license or package level and linked with ScanCode; enforcement is advisory. Integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. AboutCode connections include ScanCode.io for package scanning, PurlDB, and VulnerableCode for vulnerability data. Deployment documentation covers Docker, enterprise, and local development setups. For enterprise deployments, the guidance recommends running your own related service instances to avoid sending sensitive or private data to public endpoints. Team starts at $500 a month and Business at $1,500 a month, each billed annually at the start of the subscription period. Enterprise pricing is custom and not listed. A private evaluation instance with all features and support is available for 30 days.

SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.