SourceTrust

SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for products they ship. It gathers direct and transitive dependencies from repositories, lockfiles and SBOMs into an inventory, then checks retrieved packages against registry digests and reads the license text inside them. Teams must review and confirm records before publication; packages needing a decision are flagged.

Repository connections include GitHub, GitLab and Azure DevOps. The platform lists 14 formats across nine ecosystems, including CycloneDX SBOM uploads. Outputs include hosted attestation pages, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist and branded PDF. Repository synchronization and publish-drift checks flag changes from the published snapshot. Pages can be password-protected and kept out of search engines. SourceTrust says it reads lockfiles and SBOMs, not source code, and parses lockfiles in the browser before upload. Eligible public GitHub projects can publish for $0, subject to fair use and attribution. Standard billing begins on first publication or export download. It is software tooling, not legal advice.

SourceTrust brings dependency inventory, review gates and compliance outputs into one platform. Eligible public GitHub projects have a no-cost publishing option, while standard project billing starts with publication or export.

SourceTrust may suit software teams that need to review dependencies and publish license information for shipped products. It is tooling rather than a law firm or legal advice.

SourceTrust is a web service for teams that need to review the licenses in software they ship and publish an approved compliance record. It is strongest for product teams managing several dependency sources or recurring releases, while organizations seeking legal advice or a broad security platform should look elsewhere. The main trade-off is that the free workflow is generous for eligible public projects, but normal project use becomes subscription-based at publication or export.

Overview

SourceTrust combines direct and transitive dependencies from connected repositories, lockfiles, and SBOMs into one inventory. It retrieves the package that is being shipped, compares it with the registry digest, and reads the license text inside that package. That gives reviewers more evidence than a package name alone, although the company positions the product as tooling rather than a law firm or source of legal advice.

Publication is deliberately gated: records remain unpublished until a team reviews and confirms them, with packages needing a decision flagged for attention. Approved records can become hosted attestation pages or exports such as THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify differences between the current inventory and the published snapshot, which suits teams maintaining a continuing compliance page rather than producing a single report.

Key features

• Broad intake: GitHub, GitLab, and Azure DevOps connections work alongside lockfile and SBOM imports. Support for 14 formats across nine ecosystems, including CycloneDX uploads, makes it practical when repositories and generated bills of materials coexist.
• Evidence-based verification: Digest comparison and in-package license reading tie decisions to the shipped artifact. This is a meaningful safeguard against relying solely on repository metadata.
• Review and policy control: Review gates prevent unconfirmed records from going public, while policy enforcement and obligation tracking support repeatable approval work. Attribution reports help turn decisions into materials a product can distribute.
• Publication and drift monitoring: A hosted page and multiple document formats cover customer-facing and release-engineering needs. Drift alerts matter for teams whose dependency graph changes between releases.
• Privacy controls: SourceTrust says it reads lockfiles and SBOMs rather than source code, parses lockfiles in the browser before upload, and can password-protect pages or keep them out of search engines. Optional vulnerability findings remain vendor-only, which limits their usefulness for teams needing shared security reporting.
• Connections and deployment: It is a cloud, web platform with multiple source-scan methods. A live walkthrough and [email protected] provide a route to product questions.

Pricing

The Open source plan costs free for an eligible public GitHub repository. Fair use applies, and SourceTrust attribution is required. Projects, dependency imports, and license reviews remain free for as long as needed; standard billing starts with the first publication or export download. There is no free trial, so this is an ongoing eligibility program rather than a time-limited evaluation.

Per project — monthly costs $29 a month, billed monthly, for one shipped product, unlimited users, and two watched branches. Per project — yearly costs $299 a year, billed yearly, with the same project and branch allowance. The annual option is the sensible fit for a stable product that will publish throughout the year; monthly billing better suits short-lived or irregular projects. Both plans are per shipped product, so a portfolio of products scales by project rather than by seats.

Expansion charges are unusually specific. An Extra watched branch is $550 a month, using the same monthly or yearly billing choice as the plan, per project beyond the two included branches. A Custom domain costs $49,499 a month on the same billing choice, covers one hostname for every attestation page in the organization, and is non-refundable once provisioned. Security monitoring costs $2,002,000 a month, is organization-wide, and adds daily OSV advisory scans with vendor-only findings. Those add-ons make the base project plans easier to justify than the full enterprise-style configuration unless the stated controls are essential.

Platforms

SourceTrust runs on the web as a cloud service. Its repository connections cover GitHub, GitLab, and Azure DevOps, and it accepts lockfiles plus CycloneDX and SPDX SBOM inputs. Teams wanting a self-hosted deployment or local-only processing should choose a different category of tool.

Who it's for

This is a good match for software publishers that need a reviewed, shareable license record for each shipped product, especially when dependencies arrive through several repositories or SBOM pipelines. Eligible public GitHub projects get the clearest value from the no-cost publishing route. Paid plans fit commercial teams that need unlimited reviewers, branch monitoring, controlled publication, and repeatable exports. It is less suitable for teams requiring source-code scanning, self-hosting, or legal counsel.

Pros and cons

• Pro: Package digest checks and license-text extraction connect compliance decisions to what is actually shipped.
• Pro: Review gates, drift checks, and many export formats support an auditable release process and a usable public record.
• Pro: Eligible public GitHub projects can publish without a card or trial clock, subject to fair use and attribution.
• Con: Paid access is charged per shipped product, so multiple products can increase cost quickly.
• Con: Only two watched branches are included, and the extra-branch, custom-domain, and security-monitoring prices are substantial.
• Con: Cloud-only delivery and vendor-only vulnerability findings exclude organizations needing self-hosted control or shared security results.

Alternatives

Choose Double Open Compliance instead when API or self-hosted deployment matters alongside its freemium SaaS offering. license-comply is a better fit for a free, self-hosted workflow focused on Python dependencies. Pick ScanCode.io when a free, Docker- or Linux-server-based tool with broad platform coverage is preferable. Apache RAT suits a straightforward free open-source release audit on Linux or another self-hosted setup. FOSSA is worth considering for a freemium service with a free tier and trial. FOSSLight Hub and FOSSology are alternatives for free, self-hosted open-source compliance systems. Licensable is the simpler choice for free public repositories or private repositories during its beta. For a wider set of options, see Open Source License Compliance Software.

Verdict

Choose SourceTrust if your priority is a controlled dependency review that ends in a maintained, shareable attestation page and release-ready license exports. Its strongest differentiator is the combination of package verification, approval gates, and drift monitoring, with an especially attractive path for eligible public GitHub projects. Look elsewhere if you need self-hosting, source-code analysis, or a lower-cost way to monitor many products and branches.