Kosli

What Kosli is

Kosli is a change recording and compliance monitoring platform for tracking software and business process changes. It brings attestations, software bills of materials (SBOMs), scans and build metadata together with a real-time view of production. Cryptographic provenance records and fingerprints create a tamper-evident chain of custody from commit to production. Teams can use policy-as-code controls, automated evidence collection and real-time notifications to manage deviations. Runtime monitoring can detect artifacts running without known provenance, and time-machine forensics helps trace environment changes. Kosli supports source and repository security, dependency analysis, SBOM management, build provenance, artifact signing, provenance attestations and release policy gates. It is tool-agnostic and push-only: CI systems, scanners and signing tools can remain in place, with data sent through its API or open-source CLI. Integrations include GitHub, Bitbucket, GitLab, CircleCI, Jenkins, Microsoft Azure, TeamCity, Terraform, Ansible, Datadog, New Relic, Jira, ServiceNow, Slack and Email. Deployment choices include multi-tenant SaaS, single-tenant hosting in a customer-selected AWS region, and on-premises deployment for Enterprise customers. Kosli is headquartered in Oslo, Norway, and targets development teams in regulated industries. Pricing is on request under a custom annual contract based on recorded data and retention.

Who it suits

Kosli suits software development teams in regulated industries, including banks and other regulated enterprises, that need to track changes and compliance evidence across production. It may also fit teams that want provenance and policy controls while keeping their existing CI, scanning and signing tools.

Limits

The custom annual contract is based on recorded data and retention, with usage costs capped during the contract. Volume discounts are available; no contract price is listed.

Getting started

1. Visit the Kosli website.
2. Choose multi-tenant SaaS, single-tenant hosting in a customer-selected AWS region, or an Enterprise on-premises deployment.
3. Send data through the API or open-source CLI.
4. Connect existing tools such as a CI system, scanner or signing tool.
5. Arrange a custom annual contract with Kosli; pricing is on request.

Verdict

Choose Kosli if a regulated development team needs recorded provenance, evidence collection and runtime change monitoring across its software supply chain. Its deployment choices and broad integrations can accommodate existing tools. Teams seeking a listed price should look elsewhere, since pricing is on request.