FOSSA vs SourceTrust
FOSSA
fossa.comSourceTrust
sourcetrust.devSide by side
| Figure | FOSSA | SourceTrust |
|---|---|---|
| Price from | Free | $24.92/mo |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 3 | 6 |
| Spec score · Open Source License Compliance Software | 8.1 (#8) | 7.6 (#20) |
| Founded | 2015 | 2026 |
| Headquarters | San Francisco, California, United States | Copenhagen, Denmark |
| Integrations | Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. | The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports. |
| Purpose | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. | SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship. |
| Support | The Free plan includes basic email support, while Business includes priority support. | SourceTrust offers a live walkthrough and lists [email protected] for platform questions. |
Plans
SourceTrust
- Open sourceFree
- Per project — monthly$29 a month
- Per project — yearly$299 a year
- Extra watched branch$550 a month
- Custom domain$49,499 a month
- Security monitoringPrice not published
In their own words
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.
SourceTrust
SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.