About Bytesafe

Bytesafe is made by Bitfront AB, a Swedish company that has built software supply chain security tools since 2018. We are bootstrapped, and our cloud products are hosted in the EU.

How we got here

We started in 2018 with Bytesafe, at the time a private package repository with security policies built in, for npm, NuGet, Maven and PyPI. Since then the work has grown into three products on one platform.

Dependency Firewall is the next generation of our first product. It runs in front of the repository you already have, such as Artifactory, Nexus or GitLab, and keeps its rules as code for GitOps workflows. Rules block on CVSS and EPSS scores and known malware, and it covers ten ecosystems, containers included.

SBOM Observer monitors and analyzes the SBOM for every release you build or buy, and shows which vulnerabilities and license issues affect it.

Trust Repository is our newest product, for supplier transparency. Suppliers publish their SBOMs, VEX and support dates into it, and you publish your own to customers: the documents the EU Cyber Resilience Act asks for.

We also maintain two free resources. The SBOM Guide explains SBOMs, software supply chains and the CRA, in English and Swedish. Scale SBOM is an open source framework for producing, sharing and using SBOM and VEX documents.

Products in the Bytesafe platform

Each product works on its own, with its own plans and sign-in.

How we work

Bootstrapped: We have no venture funding. Our customers pay for the company, and we answer to them.
EU company and EU hosting: Bitfront AB is registered in Sweden and the cloud products are hosted in the EU. Dependency Firewall and SBOM Observer can also run on your own infrastructure on an Enterprise plan.
Open formats: CycloneDX, SPDX, VEX and ECMA-428 lifecycle documents, and compatibility with the Transparency Exchange API. What you keep with us can be read by other tools.
Works with your setup: Dependency Firewall runs in front of Artifactory, Nexus and the public registries. SBOM Observer reads SBOMs in CycloneDX and SPDX, VEX and SLSA attestations. Trust Repository takes uploads from any CI system over its REST API, and suppliers without a pipeline upload in the browser.