Craftifact review
A security-focused repository with SBOM analysis, policy controls, and self-hosting.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Craftifact is an operated European artifact repository for software teams that need package storage alongside software supply-chain visibility. It supports hosted, proxy, and group repositories for Maven, npm, Python, OCI/Docker, and Go packages in beta. Teams can upload, download, manage metadata, and delete artifacts through the web interface and API, while self-hosted deployment is available separately through an early-access, request-based offering. Its audience is business customers that want repository infrastructure without operating the repository stack themselves.
Security and governance are central to the product. Craftifact links CycloneDX SBOMs and can generate SBOMs for supported formats, then provides dependency and vulnerability findings from SBOM-backed data. License signals, exposed-secret findings, suppressions, policy gates, cooldown gates, and Fast-track decisions support review workflows. RBAC, groups, robot accounts, and scoped tokens provide access control, while CI/CD and audit-support APIs connect repository activity with delivery and governance processes. OIDC identity providers, SoluForge IdP, S3-compatible storage, and Sonatype Nexus import are listed integrations.
Pricing is monthly and paid-only. Starter costs €99 per month and includes 40 GB of base artifact volume plus hosted, proxy, and group repositories, but not rule-based cleanup. Pro costs €199 per month, raises base volume to 80 GB, and adds rule-based cleanup plus one-hour backups with 30-day retention. Teams costs €399 per month, includes 160 GB of base artifact volume, and adds shared workflows for multiple teams alongside the Pro backup terms. Enterprise uses contact-based pricing for custom procurement and operating requirements. Craftifact suits teams that value SBOM-backed controls and repository governance; teams seeking a free repository option should choose an alternative.
Craftifact pros and cons
- Where it wins
- SBOM generation with dependency, vulnerability, license, and secret findings
- Hosted, proxy, and group repositories across five package formats
- Fine-grained access controls, policy gates, cleanup, backup, and restore
- Where it doesn't
- No free plan, with paid plans starting at €99 per month
- Rule-based cleanup is not included in the Starter plan
- Go package support is provided in beta
Craftifact fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. How we rank.
Last updated · How we research and update