Freedom251 › Software Supply Chain Security Software
Chainloop
What Chainloop is
Chainloop centralizes software delivery artifacts and evidence to help teams track security, compliance, and context across the delivery process. Its evidence store can hold metadata for SBOMs, QA reports, vulnerability scans, and legal reviews. The service links artifacts and metadata in a provenance graph, supporting control gates, quality checks, and compliance dashboards. Its CLI and integrations collect pipeline evidence, including Git commit details and pipeline configuration, and documentation describes digital signing with SLSA, in-toto, Sigstore, or customer PKI such as AWS KMS or Keyfactor. The paid platform adds curated policies and frameworks including SLSA, SSDF, CRA, DORA, and NIS2. Chainloop offers cloud and self-managed deployment, including on-premises and airgapped options. Community Edition is free and open source, self-hosted, and includes community support, but has no UI or curated policy library. The enterprise platform lists dedicated support; its price is available by contacting the company.
Who it suits
Community Edition is aimed at technically skilled starters, evaluators, and small teams. The enterprise platform is for organizations seeking SDLC security and compliance across cloud or self-managed deployments.
What it does well
- Evidence store includes SBOMs, QA reports, scans, and legal reviews.
- CLI and integrations capture CI/CD pipeline context.
- Supports on-premises and airgapped deployments.
- Community Edition is free and open source.
What to know first
- Community Edition is self-hosted and has no UI.
- Community Edition lacks a curated policy library.
- Some integrations are limited to paid plans.
- Enterprise pricing is available by contacting the company.
Limits
Community Edition is self-hosted and has no UI or curated policy library. Its listed support is community support.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Community Edition | Free and open source · self-hosted · no UI or curated policy library · community support | Free |
| Chainloop Platform | Contact us for pricing · Enterprise SDLC governance · cloud, BYOC, on-premises, or airgapped deployment · dedicated support | On request |
As chainloop.dev lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Visit the Chainloop website.
- Choose Community Edition or contact the company about Chainloop Platform.
- For Community Edition, use the self-hosted option.
- Install the CLI using a Linux or macOS binary for Intel or ARM64.
- Connect CI/CD pipelines or documented integrations to capture evidence.
Verdict
Chainloop combines artifact evidence, provenance context, and pipeline attestations for software delivery security and compliance work. Community Edition provides a free self-hosted starting point, while curated policies and dedicated support are part of the paid platform.
Questions
Is there a free plan?
Yes. Community Edition is free and open source at no cost.
How much does Chainloop Platform cost?
The plan lists pricing as “Contact us for pricing.”
Which platforms are supported?
The listed platforms are API, Linux, macOS, self-hosted, and web. The CLI installation page lists Linux and macOS binaries for Intel and ARM64.
Can Chainloop be self-hosted?
Yes. Community Edition is self-hosted, and the platform offers self-managed deployment options including on-premises and airgapped setups.
What signing methods are supported?
Documentation describes SLSA, in-toto, Sigstore, and customer PKI such as AWS KMS or Keyfactor.
Which integrations are documented?
Documented integrations include Dependency-Track, Slack, Microsoft Teams, Linear, OpenAI, and Anthropic. Some integrations are limited to paid plans.
Facts from Chainloop's own pages
- Attestations
- The CLI and integrations capture evidence from CI/CD pipelines, including context such as Git commit details and pipeline configuration. · docs.chainloop.dev, 30 Sept 2026
- CLI platforms
- The CLI installation page lists Linux and macOS binaries for Intel and ARM64 architectures. · docs.chainloop.dev, 30 Sept 2026
- Company
- Chainloop identifies itself as Chainloop, Inc.; LinkedIn lists its headquarters as San Francisco and its founding year as 2023. · linkedin.com, 30 Sept 2026
- Deployment
- The platform offers cloud and self-managed deployment options, including on-premises and airgapped setups; the pricing page identifies AWS, Azure, Google, and OpenShift for on-premises deployments. · chainloop.dev, 30 Sept 2026
- Evidence types
- Its evidence store can centralize metadata including SBOMs, QA reports, vulnerability scans, and legal reviews. · chainloop.dev, 30 Sept 2026
- Integrations
- Documented integrations include Dependency-Track, Slack, Microsoft Teams, Linear, OpenAI, and Anthropic, with some integrations limited to paid plans. · docs.chainloop.dev, 30 Sept 2026
- Intended users
- Community Edition is aimed at starters, evaluators, and small teams with technical expertise; the enterprise platform is for organizations needing full SDLC security and compliance. · chainloop.dev, 30 Sept 2026
- Policies and frameworks
- The paid platform includes curated policies and compliance frameworks such as SLSA, SSDF, CRA, DORA, and NIS2. · chainloop.dev, 30 Sept 2026
- Provenance
- Chainloop connects metadata and artifacts in a graph to provide provenance and context for control gates, quality checks, and compliance dashboards. · chainloop.dev, 30 Sept 2026
- Purpose
- Chainloop centralizes software delivery artifacts and evidence to support security, compliance, and visibility across the software delivery process. · docs.chainloop.dev, 30 Sept 2026
- Security certifications
- Chainloop’s Trust Center lists SOC 2 Type 2 and ISO 27001, with ISO 27001 marked in progress. · trust.chainloop.dev, 30 Sept 2026
- Signing
- Chainloop documentation says metadata can be digitally signed using SLSA, in-toto, Sigstore, or customer PKI such as AWS KMS or Keyfactor. · docs.chainloop.dev, 30 Sept 2026
- Support
- Community Edition includes community support, while the enterprise platform lists dedicated support. · chainloop.dev, 30 Sept 2026