We value your privacy

We use strictly necessary cookies to run the site. With your consent, we also use analytics cookies to understand traffic. We do not use marketing or personalization cookies. By clicking "Accept All", you consent to analytics cookies. Learn more

Skip to main content
ProvenanceOS

Everything you need to trust what you ship

ProvenanceOS gives security, legal, and engineering teams a traceable record of public-repository dependency and vulnerability scans. Policy enforcement is planned.

Start 14-day trialView pricing

Public repository URL scan intake, npm and PyPI manifest extraction with OSV checks, AI-origin scoring over a bounded source sample, policy evaluation against built-in and active custom rules, and completed-scan CycloneDX export are available now. Each capability below is annotated with its rollout status.

AI-Origin Detection

Every completed repository scan carries a repository-level AI-origin score computed from a bounded sample of source files (up to 40 JavaScript, TypeScript or Python files / 512 KB, crawled from the package entry points), with a confidence level, the contributing stylometric signals and the exact sample coverage. It is a heuristic estimate over that sample — not per-commit or per-file attribution — and a scan whose source could not be sampled is reported as not assessed rather than scored.

  • Repository-level AI-origin score with confidence and sample coverage
  • Per-commit AI probability scores — coming at GA
  • File and function-level attribution — coming at GA
  • Model-family detection (GPT, Claude, Copilot, etc.) — coming at GA
  • SBOM-level provenance metadata

Dependency Lineage

npm and PyPI manifests are extracted and checked against OSV. An npm lockfile is included as a flat list of resolved packages, including packages that are not direct dependencies. A dependency graph and additional ecosystems are planned.

  • Multi-ecosystem support (npm, PyPI, crates, Maven, Go, Ruby) — coming at GA
  • Transitive dependency graph (which package depends on which) — coming at GA
  • Vulnerability correlation with NVD, GHSA, OSV — coming at GA
  • License compliance tracking — coming at GA

Policy Enforcement

Every completed scan is evaluated against the built-in provenance rules and the custom policies your organization has activated; each rule's decision (pass, warn, block, or could not be evaluated) is recorded on the scan and shown on its detail page. Custom rules match finding severity and repository and raise warn decisions. Decisions are logged and displayed only — nothing is blocked or held for review automatically. Automated enforcement is planned. Today a block decision is recorded and displayed on the scan, but no merge, release or scan is stopped or held for review by it, and custom policies can only raise warn decisions.

  • Centralized policy definitions, evaluated on every completed scan
  • Per-scan decision record (pass / warn / block / could not evaluate)
  • GitHub Actions, GitLab CI, Jenkins integrations — coming at GA
  • Pre-merge blocking with override workflows — coming at GA

Compliance Reporting

Planned: report generation from a completed scan, for SOC 2, NIST SSDF, and EU AI Act Article 50 transparency context. These reports are not an Article 6 risk classification and not an Article 9 risk-management system. HIPAA reporting is a separate planned item.

  • Compliance exports (PDF, JSON, CSV) — coming at GA
  • NIST SSDF (SP 800-218) mapping — coming at GA
  • EU AI Act Article 50 transparency context — coming at GA
  • SOC 2 CC8.1 change-management evidence — coming at GA

Real-Time Monitoring

Planned: continuous monitoring of repositories, branches, and pull requests, with alerts when provenance changes.

  • Webhook-driven ingestion — coming at GA
  • Slack, email, and PagerDuty alerts — coming at GA
  • Drift detection (when AI usage changes) — coming at GA
  • Historical timeline view per component — coming at GA

Enterprise Integrations

Planned: SAML SSO, audit-log streaming, custom retention, and single-tenant deployment options.

  • SAML 2.0 / OIDC SSO — coming at GA
  • Splunk, Datadog, and Snowflake log streams — coming at GA
  • SCIM user provisioning — coming at GA
  • Single-tenant VPC deployment — coming at GA

Ready to see it in action?

Create an account for live repository scanning, AI-origin scoring, and policy evaluation. Expanded lineage, automated policy enforcement, and compliance reports remain on the roadmap.

Start 14-day trial