Ship at SaaS speed,
with an SBOM for every artifact.
You ship daily and pull npm, pip, and winget across a Windows dev fleet and CI runners. EU CRA, EO 14028, and CISA Secure-by-Design now expect a verifiable SBOM for every artifact — without a security team slowing engineering down. Attestree signs and SBOMs each artifact at ingest, so the evidence is a side effect of shipping, not a release-day scramble.
- ingestnpm:[email protected]sbom · 312 depssig:9c2a…
- ingestpip:[email protected]detonated · cleansig:1f7b…
- blocknpm:[email protected]malware · haltedBLOCK
- sbomcyclonedx · 312 componentssignedsig:a4d0…
- siemsiem://attest.streamstreamingsig:77e1…
- exportevidence-bundle.zipcra-readysig:0be4…
What engineering-led security teams ask us first.
SBOM by construction
Every npm, pip, and winget artifact gets a CycloneDX SBOM and an in-toto attestation at ingest — not a scanner bolted on before release. The SBOM and vulnerability-handling evidence the EU CRA expects falls out of normal operations.
Multi-tenant SaaS, no appliance
Run Attestree as a hosted, multi-tenant control plane — no on-prem box for your platform team to operate. Same attestations and evidence as the appliance; self-host stays available when a tenant needs it.
Evidence regulators accept
Signed, verifiable attestations map to EO 14028, CISA Secure-by-Design, and SOC 2 evidence requests. One CLI call verifies any artifact — in your fleet or your auditor's.
The platform, sized for an engineering org.
Start with attested ingest for the package managers your engineers actually use, then add inventory and policy as your supply-chain story matures.
Winget Enterprise
Attested install gates in front of every Windows package channel.
Read productInventory
One attested inventory across your package managers — winget and Chocolatey today, more as they land.
Read productTransforms
Cedar policy-as-code: rewrite, gate, or block any artifact in flight.
Read productWindows Updates
Approve, stage, and attest every KB before deployment.
Read productCommercial — request access.
Pre-GA pricing is design-partner friendly. Tell us about your stack — we'll come back within two business days.
"Design partner pipeline open. Be first to be quoted."