FossID Workbench vs SourceTrust
FossID Workbench
fossid.comSourceTrust
sourcetrust.devSide by side
| Figure | FossID Workbench | SourceTrust |
|---|---|---|
| Price from | — | $24.92/mo |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 6 |
| Spec score · Open Source License Compliance Software | 8.2 (#6) | 7.6 (#20) |
| Founded | 2016 | 2026 |
| Headquarters | Stockholm, Sweden | Copenhagen, Denmark |
| Integrations | Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. | The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship. |
| Support | FossID directs customers to its support portal for help and ticket submission. | SourceTrust offers a live walkthrough and lists [email protected] for platform questions. |
Plans
SourceTrust
- Open sourceFree
- Per project — monthly$29 a month
- Per project — yearly$299 a year
- Extra watched branch$550 a month
- Custom domain$49,499 a month
- Security monitoringPrice not published
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.
SourceTrust
SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.