.svg)
The Control Plane for Trusted Software Delivery
Our vision is to automate trust for Software Supply Chain, helping companies make faster decisions, reduce security risks, achieve compliance, and save time and money. Software releases and audits will take hours rather than weeks.
Upcoming
Chainloop Platform
Learn more about Chainloop Open Source, our Metadata Vault for Software Supply Chain, at our GitHub page.
Build Your
Single Pane Of Glass
Create a centralized view of your entire Software Development Life Cycle (SDLC). Integrate various CI/CD and DevSecOps services across any cloud or platform. Consolidate software delivery metrics in one dashboard to simplify oversight and minimize distractions.
Get Context With
Chainloop Trust Hub
Chainloop helps you better understand your software development process by creating a single source of truth for all your supply chain events and metadata. You can link essential data points like team information, pipelines, and manual or automated workflows to get a complete picture of the process. Chainloop enables you to democratize this information in your organization so you can make better decisions. For example, you can confidently block a software artifact to ensure compliance or security.
Block
With
Confidence
Effortlessly implement control gates and raise security or compliance exceptions to the entire organization. Empower teams to confidently enforce security and compliance measures.
Instrument
Your Software Delivery
Enable visibility into your software supply chain by implementing monitoring, alerting, and SLOs.
Meet
Developers
Where they are
We offer native integrations with multiple CI/CD and SCM platforms like GitHub, GitLab, Jenkins, Dagger, and more. With Chainloop, developers get a jargon-free process to comply with the SecOps team's requirements. No need to learn in-toto, signing, SLSA, OCI, APIs, credentials, nada :)
Enterprise
Ready Features
Chainloop’s was born with Enterprise features in mind. From customizable Federated content addressable store to Role Base Access Control or Single Sign On.
SLSA
in a Box
Supply Chain Levels for Software Artifacts (SLSA) defines standards and controls to prevent tampering and improve the integrity of your Software Supply Chain. With Chainloop, you can reach SLSA v1.0 Build Level 2 by leveraging your own content addressable storage, the Sigstore suite, and the in-toto attestation format.
Declarative and Versioned
Contracts
Operators have full control over what metadata must be received as part of the attestation and the environment where these workflows must be executed. This enables an easy and maintainable way of propagating and enforcing requirements downstream to your organization.
Trusted Software Supply Chain
Metadata Vault
Chainloop’s Open Source Metadata Vault allows you to easily collect, attest, sign, and distribute your Software Supply Chain metadata, SBOMs, VEX, SARIF files, QA reports, and more.
With Chainloop, SecOps teams can, for each step in their SDLC, declare and enforce what pieces of evidence must be collected and what to do with them by leveraging third-party integrations such as Dependency-Track for SBOM analysis or a blob storage/OCI registry.
On the other hand, developer teams do not need to become security experts. The attestation crafting tool will guide them with guardrails and a familiar developer experience.
You can think of Chainloop as an API for your organization’s Software Supply Chain that both development and SecOps teams can use to interact effectively.
That way SecOps teams now have control over their organization’s Software Supply Chain security compliance, observability and standardization implementation efforts.
Growing Number Of
Integrations
Chainloop offers a pluggable integrations framework that operators can use to extend Chainloop functionality by setting up third-party integrations on your attestation metadata. Integrations can range from notifications via a Slack message, storing the attestation to an AWS S3 blob storage, or sending a Software Bill Of Materials (SBOMs) to a third-party service, such as Guac or Dependency-Track.
Use
Your Cloud
Chainloop is cloud agnostic. We simplify deployment on AWS, Azure, and Google Cloud with support for multiple cloud managed services.
Use Cases
SOFTWARE DELIVERY VISIBILITY
Gain comprehensive visibility across all your workflows.
AUTOMATED COMPLIANCE
Automate compliance with our declarative contracts.
SUPERCHARGED COLLABORATION
Collaborate seamlessly with all your teams
on software delivery.
ENTERPRISE EVIDENCE STORE
Gather and centralize software supply chain metadata and pieces of evidence for SOC 2.
SBOM AND *VEX
Operationalize SBOMs software bill of materials.
OPEN SOURCE CONSUMPTION
Consume Open Source in a trustworthy way.
VULNERABILITY MANAGEMENT
Simplify vulnerability management for enhanced security.
Control Gates
Establish control gates and connect automated and human-driven processes.
Frequently asked questions.
Is Chainloop Open Source?
Yes, Chainloop source code has been Open Sourced and can be found here! 🎉
Can I run my own instance of Chainloop end to end?
Yes, please refer to this guide.
I am using neither GitHub Actions nor GitLab, can I still use Chainloop?
Yes, Chainloop is runner agnostic, which means that you can run the attestation anywhere, including your laptop! That said, there are benefits for using one of our supported runner types. We plan on supporting more CI vendors so your is not supported yet, please contact us with your preference and we will get back to you.
