- Home
- SBOM Management Software
- sbomify
sbomify
17-18 Berkeley Square, Clifton, Bristol, BS8 1HB, England
What it is
sbomify is a security artifact hub for creating, organizing, analyzing, and sharing software bills of materials (SBOMs) and compliance documents. It supports CycloneDX and SPDX, and its generation workflow covers 17 ecosystems, container images, directory scans, and Yocto/OpenEmbedded builds. The sbomify Action supports GitHub; Docker-based workflows are documented for GitLab, Bitbucket, and other CI/CD systems. Vulnerability analysis integrations include Google OSV and OWASP Dependency-Track. Trust Centers let software vendors share artifacts on a custom domain with public or private access. They can include SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports, and compliance attestations; content is also available programmatically through the Transparency Exchange API. The open-source platform can be self-hosted or used as a hosted service. Its free Community plan permits one product, five components, public documents, and one user. Business costs $159 a month, billed annually, and includes private documents and a 14-day free trial. Enterprise pricing is by custom quote.
For and against
For
- Supports CycloneDX and SPDX formats.
- Generation workflow covers 17 ecosystems and container images.
- Trust Centers allow public or private sharing.
- Available hosted or self-hosted.
- Free Community plan is available.
Against
- Community plan is limited to one product and five components.
- Community documents are public only, with one user.
- Business is $159 a month, billed annually.
- Enterprise pricing requires a custom quote.
The verdict
sbomify brings SBOM generation, compliance documents, vulnerability analysis, and artifact sharing into one platform. The Community plan has clear limits, while Business adds private documents and Enterprise lists broader controls and support.
Who it suits
It suits software vendors preparing compliance materials and software buyers checking software asset security. Teams that need private documents, more products, or more users can consider the paid plans.
Plans and prices
Community
1 Product · 5 Components · Unlimited SBOMs and compliance documents · Public documents only
Read 4 Oct 2026 · sbomify.com
Business
5 Products · 200 Components · Unlimited SBOMs and compliance documents · Private documents
Read 4 Oct 2026 · sbomify.com
Enterprise
Unlimited Products · Unlimited Components · SSO/SCIM · Dedicated account manager
Read 4 Oct 2026 · sbomify.com
On the record
- API
- The Trust Center content is consumable programmatically through the Transparency Exchange API (TEA).sbomify.com · read 4 Oct 2026
- Artifact coverage
- The Trust Center supports SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports, and compliance attestations.sbomify.com · read 4 Oct 2026
- Business support
- The Business plan includes priority email support.sbomify.com · read 4 Oct 2026
- CI/CD integrations
- The sbomify Action supports GitHub, and the site documents Docker-based workflows for GitLab, Bitbucket, and other CI/CD systems.sbomify.com · read 4 Oct 2026
- Community plan limit
- The Community plan limits accounts to one product, five components, public documents, and one user.sbomify.com · read 4 Oct 2026
- Ecosystems
- Its generation workflow supports 17 ecosystems, container images, directory scans, and Yocto/OpenEmbedded builds.sbomify.com · read 4 Oct 2026
- Enterprise controls
- The Enterprise plan lists role-based access controls, audits, organization-wide roles, and SSO/SCIM.sbomify.com · read 4 Oct 2026
- Product audience
- The company describes the platform as serving software vendors managing compliance and software buyers verifying software asset security.sbomify.com · read 4 Oct 2026
- Purpose
- sbomify is a security artifact hub for generating, managing, analyzing, and sharing SBOMs and compliance documents.sbomify.com · read 4 Oct 2026
- SBOM formats
- The platform supports CycloneDX and SPDX formats.sbomify.com · read 4 Oct 2026
- Self-hosting
- sbomify says its open-source platform can be self-hosted or used through its hosted service.github.com · read 4 Oct 2026
- Trust Center
- Trust Centers can use a custom domain and support public or private access for sharing security artifacts.sbomify.com · read 4 Oct 2026
- Vulnerability analysis
- The integrations page lists Google OSV and OWASP Dependency-Track for vulnerability analysis.sbomify.com · read 4 Oct 2026
