CodeLocker

Paid

What CodeLocker is

CodeLocker is a code-signing platform focused on software supply-chain traceability and provenance. It supports signing at the commit and binary levels, and its listed signing targets include source-code commits, source code, files, binaries, scripts, and SBOMs. For commit signing, CodeLocker verifies developer identity and checks pushed commits for valid signatures. It can also connect to a DevOps build pipeline to sign binaries produced by a build.

Private keys remain in an HSM, and the centralized key management is compatible with FIPS 140-3 Level 3 HSMs. The platform’s zero-trust approach uses identity verification and least-privileged access, with multifactor authentication supported. Signed source-code verifications have a step-by-step audit trail. Long-term validation signatures include data needed to validate signatures in settings with limited or no internet access, including air-gapped environments. The maker says CodeLocker helps developers comply with the NIST Secure Software Development Framework (NIST 800-218).

CodeLocker integrates with source-control repositories, identity-management systems, and CI/CD platforms, and offers customizable plug-ins. Zeva describes it as designed for software developers and deployment engineers in regulated sectors such as defense, healthcare, device manufacturing, and finance. Pricing is available on request; the site invites visitors to book a demo or request a call. Zeva was founded in Virginia in 2005 and lists an address in Fairfax, Virginia, USA.

Who it suits

CodeLocker is aimed at software developers and deployment engineers working in regulated critical-infrastructure sectors, including defense, healthcare, device manufacturing, and finance. It may suit teams that need commit or binary signing, centralized key protection, and validation in restricted-network environments.

What it does well

Signs commits and binaries, with additional supported targets including scripts and SBOMs.
Keeps private keys in an HSM.
Supports multifactor authentication and least-privileged access.
Provides a step-by-step audit trail for signed source-code verifications.
Long-term validation supports environments with limited or no internet.

What to know first

Pricing is available on request.
Getting started involves booking a demo or requesting a call.

Getting started

Visit the CodeLocker website.
Book a demo or request a call.
Connect supported source-control repositories, identity management, or CI/CD platforms as needed.
Configure signing for commits or binaries in your workflow.

Verdict

Consider CodeLocker if your team needs signing and provenance controls for software builds, especially in a regulated sector or restricted-network setting. Teams looking for a published price should note that pricing is on request; the site directs prospective customers to arrange a demo or call.

Questions

How much does CodeLocker cost?

Pricing is available on request.

What can CodeLocker sign?

It supports commit-level and binary-level signing. Listed targets also include source code, files, scripts, and SBOMs.

Does CodeLocker support CI/CD signing?

Yes. It can integrate with DevOps build pipelines to sign binaries produced by a build.

How are private keys protected?

The maker says private keys remain in an HSM and describes centralized key management compatible with FIPS 140-3 Level 3 HSMs.

Who makes CodeLocker?

Zeva makes CodeLocker. Zeva says it was founded in Virginia in 2005 and lists an address in Fairfax, Virginia, USA.

Facts from CodeLocker's own pages

Access controls: Its zero trust architecture calls for identity verification and least privileged access, and the platform supports multifactor authentication. · codelocker.zevainc.com, 9 Oct 2026
Audit trail: It supports multifactor authentication and signed source-code verification with a step-by-step audit trail. · codelocker.zevainc.com, 10 Oct 2026
Build pipeline: It can integrate with a DevOps build pipeline to sign binaries produced by a build. · codelocker.zevainc.com, 9 Oct 2026
Compliance: The maker says CodeLocker helps developers comply with the NIST Secure Software Development Framework (NIST 800-218). · codelocker.zevainc.com, 10 Oct 2026
Founded: 2005 · codelocker.zevainc.com, 28 Sept 2026
Headquarters: Fairfax, Virginia, USA · codelocker.zevainc.com, 28 Sept 2026
Identity and access: Its zero-trust approach includes explicit identity verification and least-privileged access. · codelocker.zevainc.com, 10 Oct 2026
Integrations: It integrates with source-code repositories and CI/CD build servers, and offers customizable plug-ins for third-party applications. · codelocker.zevainc.com, 10 Oct 2026
Intended users: The maker describes it as designed for software developers and deployment engineers in regulated critical infrastructure sectors, including defense, healthcare, device manufacturing, and finance. · codelocker.zevainc.com, 9 Oct 2026
Key security: The site says private keys remain in an HSM and describes centralized key management compatible with FIPS 140-3 Level 3 HSMs. · codelocker.zevainc.com, 10 Oct 2026
Long-term validation: Its long-term validation signatures include data needed to validate signatures in environments with limited or no internet access, including air-gapped environments. · codelocker.zevainc.com, 10 Oct 2026
Maker: Zeva says it was founded in 2005 in Virginia, USA, and lists its address as 10300 Eaton Place Suite 305, Fairfax, VA 22030, USA. · zevainc.com, 10 Oct 2026
Maker background: Zeva says it was founded in 2005 in Herndon, Virginia, USA. · zevainc.com, 9 Oct 2026
Product: CodeLocker is a code signing platform for software supply chain traceability and provenance. · codelocker.zevainc.com, 9 Oct 2026
Purpose: CodeLocker is a code-signing platform for software supply-chain traceability and provenance. · codelocker.zevainc.com, 10 Oct 2026
Sales and support: The site invites prospective customers to book a demo and does not list a self-serve purchase price. · codelocker.zevainc.com, 10 Oct 2026
Signing: It supports both commit-level and binary-level signing. · codelocker.zevainc.com, 10 Oct 2026
Target users: The maker describes it as designed for software developers and deployment engineers in regulated critical-infrastructure sectors, including defense, healthcare, device manufacturing, and finance. · codelocker.zevainc.com, 10 Oct 2026
Validation: It provides an automated validation workflow for code signing. · codelocker.zevainc.com, 10 Oct 2026

Where CodeLocker stands on Freedom251

Code Signing Software#27 of 28