Freedom251 › Artifact repository software
OrbitalReg
What OrbitalReg is
OrbitalReg is a self-hosted artifact repository for teams managing packages and build artifacts on infrastructure they control. One API supports 42 formats, including Maven, npm, PyPI, Docker, Helm, Cargo, NuGet, and Terraform providers. The registry runs as one Go binary with Postgres and S3-compatible storage on premises, in a customer cloud account, or offline. Trivy and Grype scan uploads or on demand, keeping results on your hardware. Verify-on-pull policies can reject artifacts without CMS, OpenPGP, RSA, or Sigstore signatures. Air-gap mode blocks outbound traffic and accepts vendored CVE feeds and signed update bundles. GitHub Actions, GitLab CI, Jenkins, and Tekton are named integrations. SAML 2.0, OIDC, scoped tokens, TLS 1.3, migration tools, and EU-only residency are also listed. A free plan is available; paid access starts at €100/yr with a 30-day trial.
Who it suits
OrbitalReg is aimed at regulated industries, defence, finance, public sector organizations, and operators seeking control of infrastructure and data. It suits teams needing on-premises, cloud-account, or offline registry deployment.
What it does well
- Self-hosted deployment, including offline operation
- 42 package formats through one API
- Trivy and Grype artifact scanning
- Signature verification and air-gap mode
- Migration CLI for major registries
What to know first
- SOC 2 Type II is still in pre-audit
- Commercial plan starts at €10,000 in year one
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| OrbitalReg Free | Forever; no contract or expiry · Security layer stays free after trial · no signup wall | Free |
| Design Partner · Limited cohort | €100/year · 1 cluster licence · full-featured access · feedback commitment | €100 a year |
| Commercial · Year 1 entry | €10,000 in year 1 · 3 cluster licences · unlimited cluster scaling · business-hours email support | €10,000 a year |
| Long-term Partner · Lifetime price lock | Sized to company; 3-year contract · 3 cluster licences · each scales unlimited · optional 24/7 support add-on | On request |
As orbitalreg.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Verdict
OrbitalReg focuses on controlled, self-hosted artifact management with scanning, signing policies, and air-gap support. Its free tier lowers entry cost, while commercial deployments have substantial listed pricing.
Facts from OrbitalReg's own pages
- Air-gap deployment
- Air-gap mode denies outbound traffic and supports vendored CVE feeds and signed update bundles delivered out of band. · orbitalreg.com, 8 Oct 2026
- CI integrations
- The product says GitHub Actions, GitLab CI, and Jenkins integrate natively, and also names Tekton as a CI source. · orbitalreg.com, 8 Oct 2026
- Company
- The site says OrbitalReg was established in 2024 and is made in Germany; it describes the product as hosted in Frankfurt. · orbitalreg.com, 8 Oct 2026
- Compliance
- SOC 2 Type II is in pre-audit, ISO 27001 controls are mapped to product features, and the company says it is GDPR-compliant with EU-only data residency. · orbitalreg.com, 8 Oct 2026
- Deployment
- The registry runs as one Go binary with Postgres and S3-compatible storage on premises, in a customer cloud account, or offline. · orbitalreg.com, 8 Oct 2026
- Encryption
- The security page states that in-transit traffic uses TLS 1.3 and provides operator-controlled at-rest encryption recipes. · orbitalreg.com, 8 Oct 2026
- Founded
- 2024 · orbitalreg.com, 28 Sept 2026
- Headquarters
- Germany · orbitalreg.com, 28 Sept 2026
- Identity
- Authentication options include SAML 2.0 and OIDC for the admin interface, plus scoped token authentication for the artifact API. · orbitalreg.com, 8 Oct 2026
- Intended customers
- The maker describes it for regulated industries, defence, finance, public sector, and operators seeking control over their infrastructure and data. · orbitalreg.com, 8 Oct 2026
- Migration
- A migration CLI imports from Artifactory, Nexus, GitHub Packages, GitLab, and cloud registries. · orbitalreg.com, 8 Oct 2026
- Package formats
- It supports 40+ package formats through one API surface, including Maven, npm, PyPI, Docker, Helm, Cargo, NuGet, and Terraform providers. · orbitalreg.com, 8 Oct 2026
- Product
- OrbitalReg is a self-hosted artifact repository for teams that need to manage software packages and build artifacts on their own hardware. · orbitalreg.com, 8 Oct 2026
- Pull verification
- Per-repository verify-on-pull policies can block artifacts that lack cryptographic signatures, including CMS, OpenPGP, RSA, and Sigstore signatures. · orbitalreg.com, 8 Oct 2026
- Scanning
- Trivy and Grype scan artifacts at upload and on demand, with results kept on customer hardware. · orbitalreg.com, 8 Oct 2026
- Support
- The Commercial plan includes email support during business hours; the Long-term Partner plan offers 24/7 support as an optional add-on. · orbitalreg.com, 8 Oct 2026
Where OrbitalReg stands on Freedom251
- Artifact repository software#38 of 64