Freedom251 › Open Source License Compliance Software
Double Open Compliance
What Double Open Compliance is
Double Open Compliance automates software security and license compliance with deterministic filters and framework-anchored AI agents. It addresses legal due diligence for the EU Cyber Resilience Act, NIS2, and DORA. ORT Analyzer captures transitive dependencies according to how software is built, while Double Open Server provides global file-level caching that the site says enables 10x faster scanning. The platform creates machine-readable software bills of materials in CycloneDX and SPDX formats and can manage projects from GitHub and GitLab, as well as projects in air-gapped environments. Its agents surface ambiguous cases for human review or version-controlled pull requests. Vulnerability triage orders CVEs by code reachability and package roles and proposes resolutions with supporting evidence. The ORT technology stack includes a web interface, dashboards, REST API, and identity management. Teams can use SaaS or customer infrastructure, with customer data hosted in EU-controlled datacenters or on their own infrastructure. The underlying tools use Apache-2.0 and MIT licensed open-source projects. The Free SaaS tier costs nothing. Pro and Enterprise are available, with an MCP Server included in both; Enterprise also supports proprietary anchors. Unless separately agreed, the SaaS service targets at least 99% uptime during regular business hours.
Who it suits
Double Open Compliance suits teams assessing software components, licenses, and vulnerabilities across GitHub, GitLab, or air-gapped projects. It may also fit organizations that need SaaS or self-hosted deployment and review workflows for ambiguous compliance cases.
What it does well
- Analyzes transitive dependencies based on how software is built.
- Produces SBOMs in CycloneDX and SPDX formats.
- Can manage GitHub, GitLab, and air-gapped projects.
- Ranks CVEs by code reachability and package roles.
- Offers SaaS and customer-infrastructure deployment options.
- Includes a free SaaS tier at no cost.
What to know first
- Pro and Enterprise prices are not provided as listed facts.
- The SaaS uptime target applies during regular business hours.
- The service is not intended to store personal or sensitive data.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | Double Open Compliance SaaS tier | Free |
| Pro | MCP Server included · available for SaaS or hybrid delivery | On request |
| Enterprise | MCP Server included · proprietary anchors supported | On request |
As doubleopen.io lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Open the Double Open website.
- Choose the Free SaaS tier at no cost, or request pricing for Pro or Enterprise.
- Choose SaaS or customer-infrastructure deployment.
- Connect or manage projects from GitHub or GitLab, or use projects in an air-gapped environment.
- Use the web UI, dashboards, or REST API provided by the ORT technology stack.
Verdict
Consider Double Open Compliance if your team needs dependency analysis, SBOMs, and evidence-based vulnerability triage, with a choice of SaaS or customer infrastructure. The free SaaS tier offers a starting point; teams requiring Pro or Enterprise should account for pricing on request.
Questions
What does the Free SaaS tier cost?
The listed Free plan costs nothing.
Are Pro and Enterprise prices listed?
No prices are provided for either plan; the pricing note says pricing on request. Both include an MCP Server, and Enterprise supports proprietary anchors.
Which SBOM formats does it support?
It supports machine-readable SBOMs in CycloneDX and SPDX formats.
Can it be self-hosted?
Yes. Deployment options include customer infrastructure as well as SaaS, and the platform can also manage air-gapped projects.
Who makes Double Open Compliance?
The maker is Double Open Oy, headquartered in Helsinki, Finland.
What uptime does the SaaS target?
Unless separately agreed, the SaaS service targets at least 99% uptime during regular business hours.
Facts from Double Open Compliance's own pages
- Agent workflow
- AI agents act as junior curators and surface high-ambiguity exceptions for human verification or version-controlled pull requests. · doubleopen.io, 30 Sept 2026
- API and identity
- The ORT technology stack used by Double Open provides a web UI, dashboards, REST API and identity management. · doubleopen.io, 30 Sept 2026
- Compliance frameworks
- The platform addresses legal due diligence for the EU Cyber Resilience Act, NIS2 and DORA. · doubleopen.io, 30 Sept 2026
- Data handling
- The service is intended for software component analysis and is not intended for storing personal or sensitive data. · doubleopen.io, 30 Sept 2026
- Headquarters
- Helsinki, Finland · doubleopen.io, 28 Sept 2026
- Hosting and sovereignty
- Customer data is hosted in EU-controlled datacenters or on the customer's own infrastructure, supporting GDPR compliance. · doubleopen.io, 30 Sept 2026
- Maker
- Double Open Oy is headquartered in Helsinki, Finland, and LinkedIn lists it as founded in 2023. · linkedin.com, 30 Sept 2026
- Open source foundation
- The site's tools are built entirely on Apache-2.0 and MIT licensed open-source projects. · doubleopen.io, 30 Sept 2026
- Performance
- Double Open Server provides global file-level caching that the site says enables 10x faster scanning. · doubleopen.io, 30 Sept 2026
- Purpose
- Double Open automates software security and license compliance using deterministic filters and framework-anchored AI agents. · doubleopen.io, 30 Sept 2026
- Repositories
- The service can manage projects from GitHub and GitLab, as well as projects in air-gapped environments. · doubleopen.io, 30 Sept 2026
- SBOM formats
- The platform supports machine-readable SBOMs in CycloneDX and SPDX formats. · doubleopen.io, 30 Sept 2026
- Scanning
- ORT Analyzer captures transitive dependencies according to how they are actually built. · doubleopen.io, 30 Sept 2026
- Service availability
- Unless separately agreed, the SaaS service targets at least 99% uptime during regular business hours. · doubleopen.io, 30 Sept 2026
- Vulnerability triage
- Its vulnerability triage ranks CVEs by code reachability and package roles and proposes evidence-backed resolutions. · doubleopen.io, 30 Sept 2026