DejaCode vs SW360

DejaCode is an enterprise application for managing open-source license compliance and software supply-chain integrity across products and teams. It tracks open-source and third-party components, with unlimited products, components, and packages in each plan. Teams can store and manage SBOMs, retain historical records for audits, and import CycloneDX, SPDX, or AboutFile formats. Usage policies can be set at license or package level and linked with ScanCode; enforcement is advisory. Integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. AboutCode connections include ScanCode.io for package scanning, PurlDB, and VulnerableCode for vulnerability data. Deployment documentation covers Docker, enterprise, and local development setups. For enterprise deployments, the guidance recommends running your own related service instances to avoid sending sensitive or private data to public endpoints. Team starts at $500 a month and Business at $1,500 a month, each billed annually at the start of the subscription period. Enterprise pricing is custom and not listed. A private evaluation instance with all features and support is available for 30 days.

SW360 is an open-source catalogue and repository for organizing software component information across an organization. It records components, releases, and projects, manages license information and obligations, and supports workflows that produce license-related documents. Software Bill of Materials management is listed as a use case, with SPDX RDF/XML and CycloneDX import formats. SW360 also collects vulnerability information and matches it with components in its component service. A REST API exposes its functions, with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. The recommended version 20 deployment uses Docker- or Podman-compatible containers for the frontend, Keycloak, CouchDB, and Spring Boot backend. SW360 can trigger FOSSology clearing and import its reports, while FOSSology performs license scanning. SW360 itself does not scan licenses or source code. The project is free, licensed under EPL-2.0, and designed for self-managed deployment. Version 20.1.0 is listed as dated July 29, 2026.