SourceTrust
SourceTrust: A hosted compliance workspace for publishing reviewed license attestations. Ranked #13 of 28 in Open Source License Compliance Software by our editors (9.0/10); pricing: Free plan · paid from $299/yr; best for hosted product attestations and publishing.
At a glance
- Editor score9.0 / 10
- PricingFree plan · paid from $299/yr
- Best forHosted product attestations and publishing
- Free planYes
- Paid from$299/yr
- Policy enforcementBoth
- Founded2026 · Copenhagen, Denmark
- Facts checked20 Sep 2026
Where it wins
- Imports repositories, lockfiles, and SBOMs into dependency inventories
- Publishes buyer-facing attestation pages with review and publish gates
- Exports attribution, notice, PDF, JSON, CycloneDX, and SPDX files
Where it doesn't
- Paid product plans start at $29 monthly or $299 annually
- Free publishing is limited to eligible public GitHub projects
- Web-only delivery may not suit teams needing other deployment options
Our verdict on SourceTrust
SourceTrust is a hosted license-compliance platform for software teams distributing products with open-source, commercial, or proprietary components. It imports repositories, lockfiles, and SBOMs, then inventories direct and transitive dependencies, verifies license evidence, records obligations and review decisions, and publishes buyer-facing compliance pages. Its focus is product attestations and publishing rather than a broad software-development workflow.
The published plans show two paid Product options: $29 per product per month for monthly billing, or $299 per product per year for annual billing. The monthly plan includes a branded hosted license page, repository sync and drift checks, and unlimited team members. The annual plan adds a branded attestation page with review gates, repository auto-sync and publish-drift checks, and unlimited users across the organization. A free Open source plan supports eligible public GitHub projects with attestation-page publishing, a GitHub App connection, and SourceTrust attribution. Review for free allows project creation, dependency import, and license review before publishing.
Its strongest distinction is the connection between review records, release disclosures, and ongoing repository changes. Teams can apply obligation review and publish gates, watch Published and Testing branches, and export attribution files, notices, PDFs, JSON, CycloneDX, and SPDX data from the same reviewed snapshot. Integrations cover GitHub, GitLab, and Azure DevOps, while deployment is web-based. SourceTrust suits teams that need a hosted, buyer-facing compliance record tied to repository synchronization and dependency-drift checks. Teams seeking a longer-established product should weigh its 2026 founding year, while organizations needing deployment beyond the web or broad enterprise compliance coverage should consider alternatives.
SourceTrust pricing
All 4 SourceTrust plans and prices →
SourceTrust fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $299/yr |
| Policy enforcement | Both |
| Obligation tracking | Yes |
| Attribution reports | Yes |
| SBOM import formats | CycloneDX, SPDX |
| Deployment options | Cloud |
| Source scan methods | Multiple |
| Deployment | Cloud |
| Platforms | Web |
| Support | Email, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 3 integrations: GitHub, GitLab, Azure DevOps |
| Pricing | Free plan · paid from $299/yr (source) |
| Website | sourcetrust.dev |
| Facts checked | 20 Sep 2026 |
SourceTrust integrations
SourceTrust lists 3 integrations on its own site.
- GitHub
- GitLab
- Azure DevOps
Alternatives to SourceTrust
- FOSSABroad open-source compliance coverage with free access, CI/CD controls, and SBOM workflows.5.0
- OSS Review ToolkitA flexible, self-hosted toolkit with broad ecosystem coverage and policy automation.—
- FossID WorkbenchA deep governance platform for teams managing open-source risk across the software lifecycle.—
See all SourceTrust alternatives →
Used SourceTrust? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used SourceTrust for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
SourceTrust is listed in our Open Source License Compliance Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sourcetrust/"><img src="https://www.itechguides.com/best/badge/sourcetrust.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026
Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. It never changes a score or a verdict. How we rank.
Last updated · How we research and update