SourceTrust

License Compliance Made Simple

SourceTrust operates as a license compliance platform which converts your software dependencies into a verified license page that you can distribute. The tool enables development teams to maintain an ongoing documentation system which tracks all their delivered products while recording all dependencies with full documentation. The system tracks all delivered products together with their complete dependency documentation because it keeps an active record of all dependencies. The system tracks all delivered products together with their complete dependency documentation because it keeps an active record of all dependencies.

What It Does

SourceTrust performs license compliance automation through its ability to access your present repositories and its capability to process lockfiles and SBOM files. The system creates a comprehensive list of all dependencies which includes direct and transitive dependencies before you can verify your compliance status and share it with others. The system enables users to determine their compliance standing through active evidence validation before they can share their compliance status with others.

Key Features

• Multi-source Import: Users can establish connections between GitHub and GitLab and Azure DevOps repositories and they can also submit lockfiles and SBOMs through direct upload

• Complete Dependency Tracking: The system unifies all direct and transitive package information into a single comprehensive inventory

• Evidence-based Verification: The system obtains real package artifacts which it verifies by matching them with registry digests while it extracts license information from the package contents

• Flexible Review Workflow: Users can approve basic licenses in bulk while they monitor packages which require further evaluation

• Multiple Output Formats: Users can distribute content through their own branded web pages and create PDF documents for legal teams and generate attribution files to distribute with their releases

• Repository Synchronization: The system detects when dependencies change and it requires users to verify all modifications before they can proceed with version releases

• Audit Trail: Maintains traceable records of team decisions and published revisions

Who It Is For

SourceTrust serves software development teams who need to manage license compliance for their products. The system provides essential value to organizations which distribute software to enterprise clients who need complete license verification and to legal departments which require unambiguous compliance records and to engineering teams which seek to automate their compliance operations.

Why It Stands Out

SourceTrust analyzes the content of your shipped packages instead of depending on registry metadata which other tools use. The label is a claim, but the contents are evidence. The platform retrieves the exact artifact, checks it against the registry digest, preserves the license text alongside your review, and records your team decision with each published revision.

The platform turns a complex compliance process into three clear steps: import what you ship, review what matters, and publish your answer. Your review stays yours, and your record stays traceable throughout the entire lifecycle of your product.

The Compliance Journey

SourceTrust guides you through a complete workflow from first import to a shareable record. The six-stage process covers import, verification, review, publication, sharing, and measurement, ensuring nothing falls through the cracks. The system identifies dependency changes which require user intervention before they can publish their subsequent version. The system identifies dependency changes which require user intervention before they can release their next version.

Every published license page includes a review summary confirming that each component passed your team review, with license confirmed, license text on file, and obligations acknowledged. The documentation system produces an understandable record which you can use to defend your position.