SourceTrust review
A hosted compliance workspace for publishing reviewed license attestations.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
SourceTrust is a hosted license-compliance platform for software teams distributing products with open-source, commercial, or proprietary components. It imports repositories, lockfiles, and SBOMs, then inventories direct and transitive dependencies, verifies license evidence, records obligations and review decisions, and publishes buyer-facing compliance pages. Its focus is product attestations and publishing rather than a broad software-development workflow.
The published plans show two paid Product options: $29 per product per month for monthly billing, or $299 per product per year for annual billing. The monthly plan includes a branded hosted license page, repository sync and drift checks, and unlimited team members. The annual plan adds a branded attestation page with review gates, repository auto-sync and publish-drift checks, and unlimited users across the organization. A free Open source plan supports eligible public GitHub projects with attestation-page publishing, a GitHub App connection, and SourceTrust attribution. Review for free allows project creation, dependency import, and license review before publishing.
Its strongest distinction is the connection between review records, release disclosures, and ongoing repository changes. Teams can apply obligation review and publish gates, watch Published and Testing branches, and export attribution files, notices, PDFs, JSON, CycloneDX, and SPDX data from the same reviewed snapshot. Integrations cover GitHub, GitLab, and Azure DevOps, while deployment is web-based. SourceTrust suits teams that need a hosted, buyer-facing compliance record tied to repository synchronization and dependency-drift checks. Teams seeking a longer-established product should weigh its 2026 founding year, while organizations needing deployment beyond the web or broad enterprise compliance coverage should consider alternatives.
SourceTrust pros and cons
- Where it wins
- Imports repositories, lockfiles, and SBOMs into dependency inventories
- Publishes buyer-facing attestation pages with review and publish gates
- Exports attribution, notice, PDF, JSON, CycloneDX, and SPDX files
- Where it doesn't
- Paid product plans start at $29 monthly or $299 annually
- Free publishing is limited to eligible public GitHub projects
- Web-only delivery may not suit teams needing other deployment options
SourceTrust fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update