Wisec

Wisec is a software supply-chain security platform that collects, signs and preserves build evidence, including provenance, SBOMs and VEX documents. It best suits teams that need CI policy gates and audit-oriented records, especially those preparing for CRA-related requirements. The free tier supports small projects, while the paid plans scale sharply in capacity and price.

Overview

Wisec links builds in a signed chain using Ed25519, with SLSA provenance and public Sigstore/Rekor timestamping. It generates signed CycloneDX SBOMs and VEX documents that describe whether detected CVEs are exploitable. This makes it more than a document store: it ties security evidence to builds and can apply rules before a build passes its CI gate.

Its CI agent runs without cloning repositories, and Wisec says it withholds scanner-quoted code before sending findings. The agent is open source under Apache-2.0, but the platform itself is managed and hosted in the EU. Data is encrypted in transit and at rest, with platform data hosted in France and residency in the EU.

Key features

Eleven anomaly rules run on every build: five calibrated to project history and six aimed at known-bad patterns. Teams can set block or warn policies covering secrets, vulnerable dependencies, unapproved contributors, risk thresholds and CVE severity. That combination suits teams seeking automated release controls; it also means policy configuration is central to getting value from the platform.

Dedicated CI/CD support covers GitLab CI, GitHub Actions, Jenkins and Azure DevOps. CircleCI and Travis CI are described as coming soon. Wisec can also import SARIF v2.1.0 findings from CodeQL, Semgrep, Snyk, Trivy and other compatible tools, letting teams bring scanner results into its evidence and gating workflow.

For compliance work, Wisec maps evidence to NIS2, SOC2, ISO 27001 and CRA and exports PDF reports. For CRA and ISO 27001, the maker explicitly characterizes this as evidence mapping, not a claim of conformity. Treat the reports as supporting material, not a substitute for demonstrating compliance.

Pricing

Wisec has a free plan, paid plans and a 14-day trial. The free tier costs nothing and includes three projects, 1,000 builds per month, 30 days of history, one PDF certificate per month and community support. It is a useful starting point for small projects or security exploration, but the build and certificate caps make it a limited fit for regular team-wide evidence workflows.

Business costs €990 a year, billed at €990/yr at the founder rate; the standard rate is €5,000/yr from 2027. It allows 10 projects and 20,000 builds per month, keeps one year of history and includes email support with a 48-hour response. This fits growing teams that need notarization, but its project and history limits are a step down from Pro.

Pro costs €2,990 a year, billed at €2,990/yr at the founder rate; the standard rate is €15,000/yr from 2027. It includes unlimited projects and builds, lifetime archives and priority support with a 24-hour response. The higher price is most defensible for organizations that need those capacity and retention limits lifted.

Enterprise uses custom pricing and billing. It includes unlimited projects and builds, on-premise or private-cloud deployment, and dedicated 24/7 priority support. It is the option for organizations that require self-hosting or dedicated support rather than another fixed-capacity tier.

Platforms

Wisec supports API, Linux, macOS, web and Windows, as well as self-hosted deployments for Enterprise customers. The self-hosting option is available on-premise or in a private cloud; buyers who require that deployment model must consider Enterprise pricing.

Who it's for

Wisec is a strong fit for development and security teams that want signed build evidence, scanner imports and release policies in one workflow. Its EU hosting and source-handling approach may also matter to teams evaluating data residency and repository exposure. Small projects can start free; growing teams have a defined Business tier, while Pro and Enterprise address higher volume, retention or deployment needs.

It is less compelling for teams that only need a standalone open-source signing tool, or that need a CI integration beyond the dedicated options currently supported. The free tier's caps also make it better for exploration than sustained high-volume use.

Pros and cons

• Pros: Signed build chains, SLSA provenance, CycloneDX SBOMs and VEX documents bring several evidence types together.
• Pros: Configurable warn and block gates connect evidence and scanner findings to release decisions.
• Pros: EU hosting, encryption and an agent that does not clone repositories address practical data-handling concerns.
• Cons: Free is capped at three projects, 1,000 builds per month, 30 days of history and one PDF certificate per month.
• Cons: Business has a 10-project limit and one-year history; Pro is a substantial price increase for unlimited capacity and lifetime archives.
• Cons: CircleCI and Travis CI support is not yet presented as dedicated integration support.
• Cons: Compliance evidence mapping does not establish CRA or ISO 27001 conformity.

Alternatives

Consider other software supply chain security software if you want to compare approaches across the category. ActiveState Platform may suit teams whose public projects fit its free organization plan; its paid organization plan uses contact-sales pricing. Sonatype Nexus Repository is worth considering if repository management is the priority: its Community Edition is free and includes ecosystem support and CI/CD integration.

DevGuard is another freemium option in the same broad platform and deployment range. GUAC is a free, MIT-licensed open-source project for teams prepared to set it up with Docker, Docker Compose and jq. SafeDep Platform may appeal to teams that want to use its free open-source tools without a SafeDep account.

StepSecurity may be a better fit for teams using public repositories on GitHub Cloud: its free Community plan includes unlimited public repositories and GitHub-hosted runners. Chainloop offers a free, open-source, self-hosted Community Edition, but it has no UI or curated policy library. Sigstore is a free option for developers and software providers who want a tool free to use, rather than Wisec's broader build-evidence and policy workflow.

Verdict

Wisec is a good choice for teams that want signed, retained build evidence tied to CI policy decisions, with EU hosting and a path from a capped free tier to self-hosted Enterprise deployment. Its main trade-offs are the sharp rise from founder-rate Business to Pro pricing and the limits on cheaper plans. Choose it when that integrated evidence-and-gating workflow is the priority; look elsewhere if you only need a free signing tool, need a not-yet-supported CI integration, or require a compliance guarantee.