SW360
SW360: A strong catalog and compliance hub for teams managing third-party software. Ranked #8 of 28 in Open Source License Compliance Software by our editors (8.3/10); pricing: Open source; best for component catalogs and compliance tracking.
At a glance
- Editor score8.3 / 10
- PricingOpen source
- Best forComponent catalogs and compliance tracking
- Paid fromFree
- Founded2016
- Facts checked20 Sep 2026
Where it wins
- Centralizes components, releases, licenses, obligations, and vulnerabilities
- Supports BOMs, SPDX, CycloneDX, clearing workflows, and attribution documents
- REST API access with FOSSology and external tool integrations
Where it doesn't
- Does not perform direct source-code or license scanning
- Requires deployment through containers or bare-metal installation
- Workflow-specific SBOM format support varies by import or export path
Our verdict on SW360
SW360 is an open-source software catalog and compliance application for organizations managing third-party components. It brings component, release, project, license, obligation, vulnerability, and clearing information into one system. Developers, project managers, compliance officers, legal counsel, architects, and research and development managers can use its web application and API to coordinate software governance across projects.
Its strongest area is structured compliance management. Teams can maintain component and release catalogs, track license obligations, manage project BOMs, import and export SBOMs, and handle SPDX documents. Clearing workflows and reports support review processes, while legal-document and attribution-information generation helps prepare downstream compliance materials. Vulnerability tracking and synchronization extend the catalog beyond licensing, and integrations with FOSSology, CVE-Search, Keycloak, SPDX, CycloneDX, and external code-scan tools support a wider compliance workflow. REST API access also gives technical teams a way to connect SW360 with surrounding systems.
SW360 is a better fit for organizations that want an open-source, self-hosted control plane for component governance than for teams seeking a hosted SaaS scanner. Source-code and license scanning are delegated to specialized tools, with SW360 importing and managing their results rather than replacing those tools. Deployment can use containers or bare-metal installation, so implementation teams need to account for hosting and operational ownership. Choose SW360 when catalog depth, obligation tracking, clearing, SBOM handling, attribution output, and integration flexibility matter most. Choose an alternative when direct scanning or a fully managed service is the primary requirement.
Your product? Our editors can test SW360 in depth and publish a review, labelled as paid · from $149/mo →
SW360 pricing
SW360 fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| Policy enforcement | Not verified |
| Obligation tracking | Yes |
| Attribution reports | Yes |
| SBOM import formats | SPDX RDF/XML, CycloneDX |
| Deployment options | Both |
| Source scan methods | Multiple |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Support | Docs, Community |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 6 integrations: FOSSology, CVE-Search, Keycloak, SPDX, CycloneDX, external code-scan tools |
| Pricing | Open source |
| Website | eclipse.dev |
| Facts checked | 20 Sep 2026 |
SW360 integrations
SW360 lists 6 integrations on its own site.
- FOSSology
- CVE-Search
- Keycloak
- SPDX
- CycloneDX
- external code-scan tools
Alternatives to SW360
- FOSSABroad open-source compliance coverage with free access, CI/CD controls, and SBOM workflows.9.4
- OSS Review ToolkitA flexible, self-hosted toolkit with broad ecosystem coverage and policy automation.9.0
- FossID WorkbenchA deep governance platform for teams managing open-source risk across the software lifecycle.8.8
SW360 vs the competition
- SW360 vs FOSSA
- SW360 vs OSS Review Toolkit
- SW360 vs FossID Workbench
- SW360 vs ScanCode.io
- SW360 vs Double Open Compliance
- SW360 vs DejaCode
Compare SW360 with any tool side by side →
Used SW360? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used SW360 for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
SW360 is listed in our Open Source License Compliance Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sw360/"><img src="https://www.itechguides.com/best/badge/sw360.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update