Freedom251 › Release Management Software

ReARM

Free plan APISelf-hostedWeb

What ReARM is

ReARM is a release governance platform for tracking software composition, security posture, shipment clearance, supporting evidence, and shipped contents. It organizes versioned SBOMs and XBOMs by product, component, and release, and supports dependency comparisons across versions and searches across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license details to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals; the audit trail records approver identity, time, and an evidence snapshot. Integrations include GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider. Community Edition is self-hosted under AGPL 3.0. It can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. Paid plans start at $195/mo, and a 60-day trial is listed.

Who it suits

ReARM suits software teams that need release approvals, BOM management, and retained evidence across products and releases. Its self-hosted Community Edition may fit organizations prepared to manage their own Dependency-Track integration for vulnerability and policy findings.

What it does well

Organizes versioned SBOMs and XBOMs across products and releases.
Retains release evidence and metadata for 10+ years.
Release policies support manual and automated approvals.
Community Edition is self-hosted under AGPL 3.0.
Supports the Transparency Exchange API.

What to know first

Vulnerability scanning needs Dependency-Track or imported VDR files.
External deployments require TLS.
Paid plans start at $195/mo.

Limits

ReARM CE is self-hosted, supports a single organization, and requires a self-managed Dependency-Track integration for vulnerabilities and violations. ReARM Pro Starter costs $195/mo and supports 1-14 users with up to 65GB compressed artifact storage; its free trial lasts 60 days.

Plans

Plan	Billed and limits	Price
ReARM CE	Free Forever · Self-hosted · Single organization · Community support · Core SBOM/XBOM storage and retrieval · Vulnerabilities and violations via self-managed Dependency-Track integration	Free
ReARM Pro - Standard	$1,350 Per Month · 15-39 users · All Starter features · Private VPC/VNet with SSO and unlimited artifact storage · Option for on-prem deployment · Enhanced support (24x7, 4 hours response time) · Free 60-day trial	$1,350 a month
ReARM Pro - Starter	$195 Per Month · 1-14 users · Up to 65GB compressed artifact storage · Priority support (8 hours response time) · Managed Dependency-Track · Free 60-day trial	$195 a month
ReARM Pro - Enterprise	$75 per user per month · 40+ users · All Standard features · Premium support (24x7, 1 hour response time) · Option for air-gapped deployment · Free 60-day trial	$75 a month

As rearmhq.com lists them, read 29 Sept 2026. The maker's own page has the final word.

Getting started

Visit https://rearmhq.com/ to review ReARM and its plans.
Choose the self-hosted Community Edition or a ReARM Pro plan.
For Community Edition, install with Docker Compose or a Kubernetes Helm chart.
Configure TLS for deployments outside localhost.
Connect Dependency-Track or import VDR files for vulnerability scanning and policy findings.
Connect tools such as GitHub Actions, GitLab, Azure DevOps, or Jenkins as needed.

Verdict

ReARM combines BOM organization and evidence retention with release checks and approvals. Before choosing Community Edition, account for its Dependency-Track or imported VDR requirement for vulnerability scanning and policy findings.

Questions

Is there a free plan?

Yes. ReARM CE is free forever and self-hosted for a single organization.

How much do paid plans cost?

ReARM Pro Starter is $195 per month, Standard is $1,350 per month, and Enterprise is $75 per user per month. Each paid plan includes a free 60-day trial.

Which platforms does ReARM support?

The listed platforms are API, self-hosted, and web. Community Edition can be installed using Docker Compose or a Kubernetes Helm chart.

Does ReARM scan for vulnerabilities without Dependency-Track?

It can store and version BOMs without Dependency-Track. Vulnerability scanning and policy findings require Dependency-Track or imported VDR files.

Is ReARM open source?

ReARM Community Edition is licensed under AGPL 3.0.

Which integrations are listed?

Integrations include GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider.

Facts from ReARM's own pages

Dependency analysis limit: The installation documentation says ReARM can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require Dependency-Track or imported VDR files. · docs.rearmhq.com, 29 Sept 2026
Evidence retention: The product page says it stores HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata with releases for 10+ years. · rearmhq.com, 29 Sept 2026
Findings aggregation: ReARM aggregates vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools, with triage and audit across organization, product, component, or release scope. · rearmhq.com, 29 Sept 2026
Founded: 2019 · rearmhq.com, 28 Sept 2026
Headquarters: Ottawa, Ontario, Canada · rearmhq.com, 28 Sept 2026
Integrations: The documentation lists GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider integrations. · docs.rearmhq.com, 29 Sept 2026
Product: ReARM describes itself as a release governance platform that tracks product composition, security posture, shipment clearance, supporting evidence, and what actually shipped. · rearmhq.com, 29 Sept 2026
Release approvals: Release policies can automatically check releases, support manual and automated approvals, and record approver identity, timestamp, and evidence snapshot in an immutable audit trail. · rearmhq.com, 29 Sept 2026
SBOM enrichment: Reliza BEAR automatically enriches SBOMs with metadata including supplier, copyright, and license information. · rearmhq.com, 29 Sept 2026
SBOM/XBOM management: It organizes versioned SBOMs and XBOMs by release, component, and product, and supports cross-version dependency diffs and portfolio-wide dependency search. · rearmhq.com, 29 Sept 2026
Security deployment: The installation documentation says TLS is required for deployments outside localhost because login fails on a plain-HTTP page. · docs.rearmhq.com, 29 Sept 2026
Self-hosting: ReARM Community Edition can be installed with Docker Compose or a Kubernetes Helm chart and is licensed under AGPL 3.0. · docs.rearmhq.com, 29 Sept 2026
Supported compliance needs: The documentation says ReARM helps fulfill xBOM requirements of EU CRA, US Executive Orders 14028 and 14144, Section 524B of the FD&C Act, and India's RBI and SEBI. · docs.rearmhq.com, 29 Sept 2026
Transparency Exchange API: ReARM says it supports the Transparency Exchange API for distributing SBOMs and artifacts to downstream consumers. · rearmhq.com, 29 Sept 2026