Kosli
Oslo, Norway
What it is
Kosli is a paid change-recording and compliance-monitoring platform for tracking software and business-process changes. It brings attestations, software bills of materials, scans, and build metadata into one place, then connects that evidence to a real-time production view. Cryptographic provenance and fingerprints create a tamper-evident custody record from commit through production. Policy-as-code controls, automated evidence collection, and real-time notifications help identify deviations. Kosli can detect running artifacts with unknown provenance and offers time-machine forensics for environment changes. Its listed capabilities include source and repository security, dependency analysis, SBOM management, build provenance, artifact signing, provenance attestations, and release policy gates. Integrations include GitHub, Bitbucket, GitLab, CircleCI, Jenkins, Microsoft Azure, TeamCity, Terraform, Ansible, Datadog, New Relic, Jira, ServiceNow, Slack, and Email. Deployment choices include multi-tenant SaaS, single-tenant AWS hosting, and Enterprise on-premises deployment. Kosli is headquartered in Oslo, Norway.
For and against
For
- Tracks attestations, SBOMs, scans, and build metadata
- Provides tamper-evident provenance from commit to production
- Supports policy-as-code and automated evidence collection
- Offers SaaS, single-tenant, and Enterprise on-premises deployment
- Lists integrations across CI, cloud, monitoring, and service tools
Against
- Pricing is available only on request
- Enterprise security SLAs are specified for Enterprise customers
- On-premises deployment is limited to Enterprise customers
The verdict
Kosli combines software supply-chain evidence, provenance, policy controls, and runtime investigation in one platform. Its broad integrations and deployment options may fit regulated teams, but buyers must request pricing and review Enterprise-specific terms.
Who it suits
Kosli is aimed at software development teams in highly regulated industries, including banks and other regulated enterprises. It suits teams needing centralized supply-chain evidence, policy controls, and production traceability.
Plans and prices
Custom annual contract
based on recorded data and retention · volume discounts · usage costs capped during contract
Read 1 Oct 2026 · kosli.com
On the record
- Access model
- Kosli says it does not require access to customer systems because data is sent one way through its API or open-source CLI.kosli.com · read 1 Oct 2026
- Chain of custody
- Kosli records cryptographic provenance and fingerprints to provide a tamper-evident chain of custody from commit to production.kosli.com · read 1 Oct 2026
- Data protection
- Kosli states that data is encrypted at rest and in transit, backed up daily to another region, and that application data is resident in the EU.kosli.com · read 1 Oct 2026
- Deployment options
- Kosli offers multi-tenant SaaS, single-tenant hosting in a customer-selected AWS region, and on-premises deployment for Enterprise customers.kosli.com · read 1 Oct 2026
- Identity controls
- Kosli supports SSO through an existing identity provider and automatically uses the provider’s MFA settings.kosli.com · read 1 Oct 2026
- Integrations
- Kosli lists integrations including GitHub, Bitbucket, GitLab, CircleCI, Jenkins, Microsoft Azure, TeamCity, Terraform, Ansible, Datadog, New Relic, Jira, ServiceNow, Slack and Email.kosli.com · read 1 Oct 2026
- Policy controls
- Kosli supports policy-as-code controls, automated evidence collection and real-time notifications for deviations.kosli.com · read 1 Oct 2026
- Purpose
- Kosli is a change recording and compliance monitoring platform for tracking and querying software or business-process changes.docs.kosli.com · read 1 Oct 2026
- Runtime monitoring
- Kosli detects running artifacts of unknown provenance and provides time-machine forensics for environment changes.kosli.com · read 1 Oct 2026
- Security certification
- Kosli states that it completed an AICPA SOC 2 Type II audit.kosli.com · read 1 Oct 2026
- Supply-chain security
- Kosli centralizes attestations, SBOMs, scans and build metadata, then connects them to a real-time production view.kosli.com · read 1 Oct 2026
- Support SLA
- Kosli states that security SLAs are provided for Enterprise customers.kosli.com · read 1 Oct 2026
- Target users
- Kosli says it is built for software development teams operating in highly regulated industries, including banks and other regulated enterprises.kosli.com · read 1 Oct 2026
- Tool compatibility
- Kosli says it is tool-agnostic and push-only, so CI systems, scanners and signing tools can remain in place.kosli.com · read 1 Oct 2026
