Claude 
Cursor 
Codex 
Hugging Face 
NVIDIA 
Visual Studio Code 
Devin 
Kiro 
Open Code 
NanoClaw 
Docker 
npm 
PyPy 
Wiz 
Financial Services 
Gaming 
Public Sector 
Automotive 
Technology 
Healthcare 
Every Release, Fully Governed. Automatically.
Natively enforce policy gates across your SDLC. Block non-compliant releases with evidence of security, quality, and compliance. Trust both human and AI written software.
Manual governance can't survive AI-driven development.
The Governance Bottleneck
AI now generates 10 times more code than human teams can manually review, while audits stay at human pace. Governance is the new constraint.
Detection, No Enforcement
Security tools flag risks but rarely enforce them. Without policy-as-code embedded in the pipeline, governance lives in dashboards while non-compliant releases reach production.
Rising Compliance Stakes
With regulations like the EU Cyber Resilience Act fines up to 2.5% of global sales, proving compliance has become a board-level requirement, not just a regulatory hurdle.
The compliance burden is real.
"We have 100 teams providing manual compliance evidence every month, 12 times
a year. It's several hours out of my day, every month, just reviewing what they
submit."
"I don't trust developers filling out compliance questionnaires once a year.
I want to see data."
"The process today is me sitting down with 10 pages of an Excel spreadsheet and going and answering every compliance question."
Every release carries immutable proof
AppTrust is your continuous governance layer. It signs every artifact,
enforces policy gates, maps ownership, and delivers audit-ready traceability, automatically.
enforces policy gates, maps ownership, and delivers audit-ready traceability, automatically.
NEWPrompt to Release Traceability
Every agent prompt, commit, PR, approval, Jira ticket, and SBOM is signed and bound to the software artifact automatically. No screenshots or spreadsheets. Every piece of evidence is cryptographically sealed from prompt to production.
Gates that physically block non-compliant releases
Policy-as-code gates evaluate evidence at every promotion, blocking non-compliant releases. Those that pass earn the trusted release badge. Justified exceptions are tracked as waivers so governance never slows developer velocity.
NEWContinuous Governance, Not a Single Point in Time
Governance doesn't stop when a version ships. Every application maps to an owner and criticality level, so risk always has context. Every active production version stays continuously monitored post-release. Expired versions are no longer actively governed.
Audit-ready by default
When regulators ask what was shipped, why it was approved, and what was flagged and waived, every answer is already there.
NEWCRA and NIST SSDF Compliance, Engineered Into Your Pipeline
Enforce pre-mapped compliance frameworks as Policy-as-Code, with no manual policy writing required. Every control mapped and enforced automatically. Real-time coverage scoring so you know exactly where you stand.
DevGovOps at Every Stage
Map risk. Codify policy. Measure delivery.
From CVE to owner in one screen
- When a CVE surfaces post-release: Every Trusted Release carrying the affected component is flagged automatically.
- Instant blast radius visibility: See every affected application’s owner, criticality tier, and release stage on a single screen.
- Triage by impact, not CVSS: A critical CVE on a sandbox app can wait, while a medium CVE on a customer-facing release cannot.
Policy-as-Code, at any scale
- Policy Playground: Test new policies against real Application Versions from your System of Record before they ever block a build.
- AI-assisted authoring: Describe what you want to enforce, and our AI assistant generates validated Rego for your application context in seconds.
- Reusable templates: Validate once, save as a template, and let any team across your organization adopt it instantly.
Track DORA delivery metrics.
- Deployment frequency: Measure how often each project or application version ships, by team.
- Lead time visibility: See exactly where releases are slowing down, broken out by promotion stage.
- Team performance: Compare deployment speed across your portfolio and spot which teams are moving fast and which need unblocking.
Signed Evidence Across Your Toolchain
AppTrust auto-collects evidence from the security, quality, deployment, and change-management tools your teams already run.
DevGovOps: Unifying DevOps and Governance
AppTrust embeds security, quality, and compliance into your software supply chain. Every team gets a single view of what shipped, what passed, and what’s auditable.
Additional Resources
-
JFrog AppTrust is the software supply chain governance layer of the JFrog Platform. It makes compliance a natural output of every release, not a retrospective exercise. Every release is automatically evidenced, gated, and verifiable, so your teams ship at speed without the compliance tax.
-
Software supply chain governance (also known as DevGovOps) is the discipline of enforcing security, quality, and compliance policies continuously across the software development lifecycle. Signed evidence is bound to every artifact as immutable proof of what was built, approved, and released.
Traditional governance relied on manual checklists and self-reported evidence collected after the fact. Modern software supply chain governance embeds policy enforcement and evidence collection directly into the pipeline, so every release is automatically evidenced, gated, and verifiable. As AI accelerates code volume and regulations like the EU Cyber Resilience Act demand auditable proof, continuous software supply chain governance has moved from best practice to business requirement.
-
JFrog Artifactory is your software System of Record. AppTrust runs natively on top, so every binary carries its policy decisions and signed evidence as it moves through the lifecycle. No separate system. No manual handoffs. Learn about JFrog Platform
-
No. AppTrust gates run automatically against signed evidence inside your existing CI/CD pipelines, with no human review, approval queues, or ticket waits. Passing builds earn the Trusted Release badge automatically.
-
Some ASPM tools enforce, but they lack the underlying context to enforce reliably. AppTrust runs natively on JFrog Artifactory, your software System of Record. Every artifact, evidence item, and promotion lives in one place, creating an immutable, signed audit trail. ASPM isn’t built for auditors. AppTrust is.
-
Building your own Open Policy Agent (OPA) governance hits three walls: rule maintenance at scale, no binary binding, and multi-system evidence aggregation. AppTrust solves all three natively and remains, OPA-compatible.
-
Automated evidence-based policy gates eliminate manual audit preparation. Engineering teams stop collecting evidence across hundreds of pipelines. What used to take weeks is already there when you need it.
-
AppTrust works alongside the CI/CD tools you already run, including Jenkins, GitHub Actions, Azure DevOps, and CircleCI. AppTrust enforces policy gates at promotion in JFrog Artifactory, so pipelines don’t need rewriting. See all CI/CD integrations →
-
AppTrust auto-collects signed evidence from security, quality, and deployment tools including Akto, Akuity, CoGuard, Dagger, GitHub, Gradle, NightVision, ServiceNow, Sonar / SonarQube, Shipyard, and Troj.ai. See all integrations →
-
Yes. AppTrust delivers pre-mapped compliance frameworks for CRA and NIST SSDF, allowing teams to automate compliance with one click. Yes. AppTrust delivers pre-mapped compliance frameworks for CRA and NIST SSDF, allowing teams to automate compliance with one click.
-
Yes. AppTrust governs AI agent activity by capturing every agent interaction at the IDE level through JFrog Agent Plugins for Cursor and Claude Code. Those interactions are stored as signed evidence and evaluated by AppTrust policies across the release lifecycle, giving every release a complete evidence chain from prompt to production.
-
AppTrust monitors releases after they ship through continuous post-release governance. Every deployed version stays actively governed against operational support windows and accumulated risk. Versions past their support window are automatically deprioritized, so compliance can be proven at any point in time, not just at the release gate.
