01
Import
Connect a repo on GitHub, GitLab, or Azure DevOps, or drop a lockfile or SBOM. We read what you already generate. No new pipeline.
Prove license obligationswith every commit.
One reviewed compliance page per product, from the lockfiles and SBOMs you already have. Maintained proof that stays current with what you ship.
Reads what you already generate
- CycloneDX SBOM
- npm (package-lock.json)
- pnpm (pnpm-lock.yaml)
- Yarn (yarn.lock)
- Bun (bun.lock)
- Go (go.mod)
- Rust (Cargo.lock)
- Python (uv.lock, poetry.lock)
- NuGet (packages.lock.json)
- Maven (pom.xml)
- Gradle (gradle.lockfile)
- Composer (composer.lock)
- Bundler (Gemfile.lock)
01The problem
A routine update canchange your legalobligations.
Every dependency, font, and SDK you ship carries a license. The list changes every sprint, and one version bump can swap MIT for copyleft. Nobody notices until a customer asks.
package-lock.json · one npm update
"dependencies": {
- "charting-lib": "1.4.2"MIT
+ "charting-lib": "2.0.0"GPL-3.0
}
Obligation changed: now requires source disclosure
247
third-party components in a typical product. Each one is a distinct obligation.
0
of your fonts, icons, and SDKs appear in that list. They still carry terms.
1
missing NOTICE file can breach terms across every release that shipped it.
02The answer
See the full workflowOne page. Reviewed,published, keptcurrent.
Import the manifest, review each license once, publish a branded attestation page. Every component on it passed your review: license confirmed, text on file, obligations acknowledged.
- Publish gate: the page can never claim what you have not reviewed
- Your branding, at your URL or ours. One link procurement can open
- Repository sync keeps it current on every release
03The difference
How verification worksWe read the licenseinside the artifactyou actually ship.
Most tools trust whatever the registry metadata declares. SourceTrust downloads the exact tarball you depend on, verifies the bytes against the registry's own digest, and reads the LICENSE file inside. When metadata and artifact disagree, you find out from us, not from a buyer's lawyer.
- Hash-checked against the registry's own digest before anything is trusted
- Six honest states per package, from Verified to Mismatch. Nothing is rubber-stamped
- Nine ecosystems: npm, PyPI, crates.io, Maven, Go, and more
verify charting-lib@2.0.0 · npmregistry says MIT
Fetch the artifact
Downloading charting-lib-2.0.0.tgz
Verify the bytes
Integrity verified · sha512-8c42af…
Read the license inside
LICENSE, line 1
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Record the evidence
Full text, digest, and fetch time kept with the review
License mismatchdeclared MIT · shipped GPL-3.0
The shipped file wins. Your obligations follow GPL-3.0, not the metadata.
04How it works
From lockfile to a pageyou can send.
02
Review
Confirm each license once. Copyleft, missing notices, and distribution risk surface automatically.
03
Publish
One click to a branded page at your URL. Gated until everything is reviewed, so you can never claim what you have not checked.
04
Stay current
Every push re-imports your dependencies. Safe licenses approve themselves, drift gets flagged, merges can republish, and the page never silently goes stale.
Merge a pull request. The page updates itself.
See how repository sync works05Why now
Read the enforcement casesLicense violations getdecided in court.
Open-source licenses are copyright licenses with conditions. When a product ships without meeting them, courts have treated it as infringement, not a minor contract slip. Both of these were decided in 2024.
EUR 900,000
Entr'ouvert v. Orange (France, 2024)
GPL code distributed without source. Includes EUR 150,000 in moral damages.
EUR 7,500
Steck v. AVM (Germany, 2024)
An individual developer enforced LGPL obligations against a major vendor.
EU Cyber Resilience Act
Teams preparing for the CRA already ask every vendor for a current, maintained record of the third-party code they ship.
11 Sep 2026
Incident reporting obligations apply
11 Dec 2027
Main obligations, including an SBOM and CE marking
EUR 15M
Maximum penalty, or 2.5% of turnover
Penalties for the most serious infringements can reach EUR 15,000,000 or 2.5% of worldwide annual turnover, so procurement teams increasingly treat a maintained supply-chain record as a baseline vendor requirement. The CRA's own SBOM is component documentation for authorities on request, not a public page, and it does not answer the license question buyers ask on a parallel track. That parallel track is the record SourceTrust keeps current.
That’s usually when teams finally look
- Enterprise customer asks for proof third-party license obligations stay current
- SOC 2, ISO 27001, or SOC 1 report in hand. Then a buyer asks something your questionnaire never covered
- M&A or investment diligence on IP and OSS exposure
- Major release with dependency churn; legal flags GPL/LGPL/AGPL
- New fonts or icon packs without documented licenses
- Attribution file in the repo years out of date
A dated, reviewed attestation record is evidence you took these obligations seriously, the kind of context you can hand a buyer. It is not legal advice, and no tool can guarantee you are safe from a claim.
06Outputs
See every export formatAnswer any request fromthe same source of truth.
Procurement wants a URL. Engineering wants files in the repo. Legal wants full license text. All of it comes from one reviewed inventory, so the URL, the export, and the attachment can never disagree.
Hosted page
sourcetrust.app/acme/platform
One clean link a reviewer opens and reads in minutes.
Machine-readable
sbom.spdx.json · cyclonedx.json
CycloneDX, SPDX, JSON, and CSV, straight from the same review.
Ship-ready files
THIRD_PARTY_LICENSES.md · NOTICE
Attribution files for what you actually distribute, ready to commit.
For the questionnaire
disclosure.pdf
A branded PDF for the vendor review that wants an attachment.
acme - zsh
$ curl -s sourcetrust.app/api/page/acme/platform.json
{
"name": "Acme Platform",
"revision": 12,
"packages": 247,
"copyleftVerdict": "none",
"complianceHealthGrade": "A",
"healthScore": 94,
"snapshot": "8c42af1"
}
Every page also ships schema.org JSON-LD and a CORS-open JSON endpoint. Readable by the AI doing your buyer's due diligence.
07Pricing
See full pricingOne price per product.No per-user fees.
Legal, engineering, and procurement all touch the same record, so we do not charge per head. Start with the one product under scrutiny and add more as you ship them.
$29/mo per product
or $299 per year, billed per shipped product
- Unlimited users across your org
- Free to create, import, and review
- Billing starts on first publish or download
- Every export format, repo sync, drift checks
Built in Copenhagen
Ship the proof.
Set up your first product in minutes. Free to import and review. You only pay when you publish.