“Do you have a SOC 2 report?”
Certifications and audit reports, public or behind your NDA
See one live trust.sbomify.com
One link for every security question about your product
Publish SBOMs, VEX, security advisories and certifications on a Trust Center that updates itself with every release, on your own domain. Customers serve themselves, and questionnaires take minutes instead of weeks.
Self-service
Send a link, not a call. Every answer in one place.
Most trust centers stop at SOC 2 badges. Yours also answers what is inside your product, and whether the latest CVE affects it.
“What is inside your product?”
An SBOM for every release, in CycloneDX or SPDX
“Are we affected by CVE-2026-XXXXX?”
VEX statements and security advisories, per product and version
“How do we report a vulnerability?”
A disclosure policy and an RFC 9116 security.txt
New to the idea? What a trust center is, and what goes in one
Automated publishing
Published from your pipeline. Never out of date.
Questionnaire answers go stale. A Trust Center fed by the same pipeline that builds your software does not.
Synced with every release
New SBOMs from CI appear the moment they are uploaded. No manual uploads, and complex product hierarchies stay in order.
Posture with VEX applied
Release-level VEX and CBOM downloads sit next to every SBOM, with a vulnerability posture card that reflects your decisions.
Signed and verifiable
Signature and provenance badges let readers check that what they downloaded is what you published.
Advisories when it matters
A filterable index of your security advisories by product and severity, with affected and fixed versions and a dated timeline.
sbomify publishes its own, from its own pipeline. Visit trust.sbomify.com
Access control
Public, gated or private. Per product.
Not every document belongs on the open web. Choose what visitors can see, component by component.
- Public: listed and downloadable by anyone who visits.
- Gated: listed, but visitors request access and accept your NDA first. You approve each request from your dashboard.
- Private: hidden from the Trust Center entirely.
Gated advisories go further: a reader who may not see one gets “not found”, so an embargo stays an embargo. How advisories are gated
Machine-readable
For people. And for their tools.
Your customers' scanners and CSAF aggregators can pick up what you publish without anyone sending an email.
- CSAF 2.0 advisories, with provider metadata and a ROLIE feed that aggregators find on their own.
- The Transparency Exchange API, the ECMA TC54 standard for discovering SBOMs and VEX for any release.
- An RFC 9116 security.txt, so researchers know where to report a vulnerability.
TEA and your own domain come with the Business and Enterprise plans.
trust.acme.exampleServed from your own domain
- /.well-known/security.txtRFC 9116
- /.well-known/csaf/provider-metadata.jsonCSAF 2.0
- ROLIE feed of public advisoriesTLP:WHITE
- TEA discovery for every releaseECMA TC54
- SBOM, VEX and CBOM downloadsPer release
Updated with every release
Plans
Start free. Add your domain later.
A public Trust Center is on the free Community plan. Business and Enterprise put it on your domain and keep sensitive documents private.
CommunityFree
- A public Trust Center
- SBOM management
- OSV scanning, rescanned weekly
Business and EnterpriseEverything in Community, plus
- A Trust Center on your own domain
- Private documents and components
- The Transparency Exchange API
- Daily rescans and Dependency-Track
See pricing for the details, or how to set up a Trust Center
Questions
Before you start
How is this different from a compliance trust center?
Compliance trust centers from GRC platforms hold SOC 2 reports and policies: they show the company is run securely. sbomify's is a product security trust center. It holds those documents too, and also answers what is in each release and whether a vulnerability affects it. Compare the two
Can we use our own domain?
Yes, on Business and Enterprise. Set a domain such as trust.yourcompany.com, add a CNAME record with your DNS provider and wait for it to validate. Setup guide
Can we share penetration test reports without making them public?
Yes. Mark them as gated: they stay listed, visitors request access and accept your Company NDA if you uploaded one, and you approve or deny each request from your dashboard.
Do we have to upload SBOMs by hand?
No. Send them from CI with the sbomify GitHub Action or your pipeline of choice, and the Trust Center reflects each new release as soon as it is uploaded.
Can we run sbomify on our own infrastructure?
Yes. sbomify is open source and runs with Docker Compose. Read the self-hosting guide, or use our cloud at app.sbomify.com.
Ready when you are
Give your customers one link for product security
Publish SBOMs, VEX, advisories and certifications on a Trust Center that updates itself with every release.
- Free to start
- Open source
- Cloud or self-hosted