SourceTrust

SourceTrust is ranked #7 of 27 in open source license compliance software on The Geeks Club. It runs on Web. There is a free plan. Paid plans start at $24.92/mo.

SourceTrust plans and pricing

All plans

Open source Free eligible public GitHub repository · fair use applies · SourceTrust attribution sourcetrust.dev · 29 Sept 2026

Per project — monthly $29/mo Monthly per shipped product · unlimited users · two watched branches sourcetrust.dev · 29 Sept 2026

Per project — yearly $299/yr Yearly per shipped product · unlimited users · two watched branches sourcetrust.dev · 29 Sept 2026

Extra watched branch $550/mo Same monthly or yearly choice as your plan per project · beyond the two included branches sourcetrust.dev · 29 Sept 2026

Custom domain $49,499/mo Same monthly or yearly choice as your plan one hostname for every attestation page in your organization · non-refundable once provisioned sourcetrust.dev · 29 Sept 2026

Security monitoring $2,002,000/mo Same monthly or yearly choice as your plan organization-wide · daily OSV advisory scans · vendor-only findings sourcetrust.dev · 29 Sept 2026

Compared on open source license compliance software

Free plan: Yes
Paid from: 299 /yr
Policy enforcement: both
Obligation tracking: Yes
Attribution reports: Yes
SBOM import formats: CycloneDX, SPDX
Deployment options: cloud
Source scan methods: multiple

Best SourceTrust alternatives

See all 12

9.2 FOSSA Free plan

8.4 Double Open Compliance Free plan 8.4 FOSSology Free plan

7.8 OHRisk Free plan

7.8 ScanCode Toolkit Free plan

7.7 licscan Free plan

SourceTrust

Purpose: SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship.
Inventory: It gathers direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory.
Verification: SourceTrust retrieves the shipped package, checks it against the registry digest, and reads the license text inside it.
Review gates: Nothing is published until the team has reviewed and confirmed the record, and the product flags packages that need a decision.
Integrations: The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports.
Supported inputs: The platform overview says it supports 14 formats across 9 ecosystems, including CycloneDX SBOM uploads.
Exports: Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF.
Change monitoring: Repository sync and publish-drift checks flag when the live inventory differs from the published snapshot.
Security controls: Pages can be password-protected and excluded from search engines, and optional vulnerability findings remain vendor-only.
Data access: SourceTrust says it reads lockfiles and SBOMs, never source code, and parses lockfiles in the browser before upload.
Open source eligibility: Eligible public GitHub projects can publish an attestation page for $0 with no card or trial clock, subject to fair use and SourceTrust attribution.
Free review: Projects, dependency imports, and license reviews are free for as long as needed; standard project billing starts on first publish or export download.
Support: SourceTrust offers a live walkthrough and lists [email protected] for platform questions.
Audience and limitation: The company describes the product as license compliance infrastructure for shipped products and says it is software tooling, not a law firm or legal advice.
Price from: $24.92/mo

Visit site Alternatives

Where it ranks on The Geeks Club

Best Open Source License Compliance Software in 2026#7 of 27

Is SourceTrust yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote SourceTrust

Sources

sourcetrust.dev· checked 29 Sept 2026
sourcetrust.dev/platform· checked 29 Sept 2026
sourcetrust.dev/pricing· checked 29 Sept 2026
sourcetrust.dev/about· checked 29 Sept 2026