Unified License Risk Management

Chainloop captures artifacts, CI/CD metadata, and compliance evidence, like audit logs, test results, dependency scanning results, compliance reports, SBOMs, signatures, attestations, and more. It stores this data in a centralized, tamper-proof evidence repository, together with rich contextual information.

Every piece of evidence is connected in a traceable graph, providing complete visibility over your software lifecycle. This ensures that decisions are based on verifiable evidence, reports, artifacts, and data.

Chainloop is able to directly collect evidence from existing CI/CD pipelines, automatically capturing all the necessary metadata from the build environment. This evidence then becomes part of the attestation, providing auditable evidence of security controls in build/deployment environments.

Chainloop can capture data from all popular CI/CD systems, including GitHub Actions, GitLab CI/CD, Jenkins, CircleCI and TeamCity. The data captured include:

• Branch protection settings: required status checks, push restrictions, review dismissal policies, and enforcement rules
• Request configurations: required reviewers, review dismissal rules, and branch update requirements
• Commit protection details: signing requirements, status check policies, and custom protection rules

Chainloop provides a curated set of policies tailored to common compliance controls, such as SBOM sanity checks, artifact signature verification, license checks, code quality and coverage checks, CVE scans, and many more. Both built-in policies and custom policies are supported.

The results of policy evaluations are stored in Chainloop’s evidence store and can be queried through the user interface. Policies are written in Rego and can be used to evaluate individual materials or the whole attestation document.

Policies are also reusable: this enables security, compliance and legal teams to define global rules (for example, “no GPL dependencies”) and have them enforced consistently across different products.

Chainloop provides a Web dashboard, a command-line interface (CLI) and a set of REST APIs that Dev, Sec, Ops, Legal and Compliance teams can use to explore and audit evidence, contracts and policies.

• The CLI is the primary interface for developers, enabling them to save attestations and interact with contracts.
• The Web dashboard is intended for non-developers, providing a holistic and centralized view of materials, attestations, policies, contracts and compliance status.
• The APIs make it possible to extend Chainloop and/or integrate Chainloop data with external services and data sources, such as custom PKI solutions or AI tooling.

Access to these interfaces is secured through role-based access control (RBAC), using organization and project roles; the APIs also support keyless OIDC authentication.