Trust what
ships
Create a scan record from a public repository URL today, with npm and PyPI manifest extraction, OSV checks, AI-origin scoring over a bounded source sample, policy evaluation, and completed-scan CycloneDX export available now.
Illustrative example — sample values, not generated from a real scan
Provenance confidence
87%
AI-Origin Scoring & Stylometrics
Example valuesTop evidence signals
- Dependency manifest resolved (npm)94%
- Known vulnerability match (OSV.dev)91%
- Repository metadata (manifest discovery)88%
- AI-origin stylometric signals (bounded source sample)89%
Dependency lineage
Example values47 dependencies traced across npm + PyPI
3 known vulnerabilities matched (OSV.dev) • 1 high • 2 medium
Policy decision
Pass — 0 policy violations
Flag critical-severity dependencies
Example record ID
EV-2026-07-11-A1B2C3
2026-07-11T14:32:00Z
Availability
- Scan intakeAvailable now
- AI-origin scoringAvailable now
- Dependency lineageAvailable now
- Policy engineAvailable now
- Compliance reportsPlanned
SOC 2 Ready
Built to SOC 2 controls — compliance evidence generation is on the roadmap
Encrypted at rest
By our infrastructure providers
TLS 1.3
In transit
Everything you need to prove code provenance
One platform for the four questions every security, legal, and engineering team needs answered before shipping.
AI-Origin Detection
Every completed repository scan carries a repository-level AI-origin score computed from a bounded sample of source files (up to 40 JavaScript, TypeScript or Python files / 512 KB, crawled from the package entry points), with a confidence level, the contributing stylometric signals and the exact sample coverage. It is a heuristic estimate over that sample — not per-commit or per-file attribution — and a scan whose source could not be sampled is reported as not assessed rather than scored. Per-commit and function-level AI attribution and model-family detection are planned; today's score is repository-level over a bounded source sample.
Policy Engine
Every completed scan is evaluated against the built-in provenance rules and the custom policies your organization has activated; each rule's decision (pass, warn, block, or could not be evaluated) is recorded on the scan and shown on its detail page. Custom rules match finding severity and repository and raise warn decisions. Decisions are logged and displayed only — nothing is blocked or held for review automatically. Automated enforcement is planned. Today a block decision is recorded and displayed on the scan, but no merge, release or scan is stopped or held for review by it, and custom policies can only raise warn decisions.
Dependency Lineage
Per-scan dependency resolution across npm and PyPI with OSV.dev vulnerability matching is live now for repository scans. An npm lockfile is read as a flat list of resolved packages, including packages that are not direct dependencies. A graph of which package depends on which is not built. Transitive lineage graphs and additional ecosystems (Maven and beyond) are planned.
Compliance Reports
SOC 2 report generation from a completed scan is built but not yet available in the product. When it ships, change management is cited as CC8.1. Controls with no collected evidence are reported as Not Assessed, never as compliant. EU AI Act reporting is built but not yet available in the product. The report records Article 50 (transparency) as context for the AI-origin score and does not treat that score as compliance with Article 50. It is not an Article 6 risk classification or an Article 9 risk-management system. GDPR reporting is not covered by any current engine and remains planned.
Workflow
How ProvenanceOS works
Sign in, submit a repository URL, and review the scan record. Archive upload is planned.
- 01
Start scan intake
Submit a repository URL from the authenticated app and ProvenanceOS creates a durable queued scan job. Archive upload scanning is planned — the analysis worker currently processes repository scans only.
- 02
Track job status
View your scan request, source metadata, and queued status while the static-analysis worker rollout continues.
- 03
Unlock generated results
Completed scans show dependency lineage with OSV matches, an AI-origin score over a bounded source sample, and per-rule policy decisions. Compliance exports arrive as that phase ships.
Questions? Talk to our team
Start scanning public repositories today
Create an account for the capabilities available now. Automated policy enforcement and compliance reports remain on the roadmap.