SBOMFlow Building in the open

Design partners

Priced around the painful job, not per-seat tooling.

We're taking a small number of design partners for validation work arranged directly. Engagements are packaged around outcomes — a defensible evidence record for a real release — and scoped to your product class, repositories, firmware variants, and release cadence. Pricing is under validation; the offline CLI is free to trial.

Become a design partner Trial the CLI first — free, offline

Before you write to us

Who this fits — and who it doesn't, yet.

A strong fit today

  • Connected-device and embedded manufacturers — embedded Linux, industrial IoT, robotics, cameras, building controls, network appliances
  • Firmware CI in place (or nearly), and someone who owns product security
  • Selling into the EU with CRA obligations on the horizon — or fielding customer SBOM and security questionnaires now
  • PSIRT or product-security leads who want to shape the experimental post-market preview
  • Teams shipping AI-enabled products who want to shape the AI Evidence track

Probably not, yet

  • Pure-SaaS teams with no device, firmware, or shipped-release story
  • Teams that need a hosted multi-tenant platform, SSO/SCIM, or an auditor portal today — that surface doesn't exist yet
  • Anyone shopping for a compliance certificate — no tool can honestly sell you one

Engagements

Four ways to work with us.

Available today

Release Evidence Sprint

  • Build-backed, validated SBOMs from one real release
  • Vulnerability context: matching with confidence, KEV/EPSS, reachability
  • Evidence-gap assessment and CRA-oriented coverage map
  • Review and release-gate baseline with your policies
  • Portable reviewer bundle your customers or auditors can verify
  • A prioritised, honest list of next actions
Available today · preview components labelled

Repeat Release & Post-Market Support

  • Repeatable per-release audits in your CI
  • Release memory, drift, and gate management across versions
  • Advisory correlation against shipped releases
  • PSIRT case continuity on the experimental post-market preview
  • Supplier and customer evidence sharing with redaction
In development · design partners

AI-Enabled Product Evidence Track

  • Linked software and AI evidence on one release record
  • Model-artifact evidence from your real builds — available now
  • Shape the declared-AI manifest, drift, and review model as it lands
  • Standards-based AI/ML BOM output as the sharing target
  • Early access to each capability as it ships, honestly labelled
By arrangement

Channel & Advisory Enablement

  • For embedded-security consultancies, CRA advisors, auditors, and labs
  • SBOMFlow supplies the engineering evidence pack and workflow
  • Your professional judgment stays the product — we never replace it
  • Evidence formats your reviewers can verify without installing anything

Every engagement is release-readiness support — never legal advice, and never a statement that a product is conformant.

What you'll hold at the end

A first engagement produces artifacts, not slideware.

Evidence pack
The complete, machine-readable record from your real release — yours to keep, in open formats.
Coverage & gaps
Where your evidence maps to CRA-oriented requirements today, and exactly what's missing.
Gate baseline
A release-gate configuration reflecting your actual policies, rehearsed with a dry run.
Reviewer bundle
A portable, hash-verified handoff your compliance reviewer or customer can open with nothing installed.
A straight answer
Where SBOMFlow fits your workflow, where it doesn't yet, and what we'd build with you next.

Commercial questions

Asked and answered.

What does it cost?

Pricing is under validation and arranged directly while we work with a small number of design partners — it’s scoped to your product class, repositories, firmware variants, and release cadence rather than per-seat tooling. The offline CLI is free to trial. Tell us about your product and we’ll give you a straight answer.

How do we become a design partner?

Email hello@sbomflow.com with what you build, your build system (Yocto, Zephyr, Buildroot, or other), and where you sell. We reply with a straight answer on fit — and where it fits, a first engagement that starts from your real build, not a demo repo.

What happens to the data we share with you?

The tool itself runs in your environment, offline by default — for most engagements we never need your source at all, only the evidence outputs you choose to share. Anything you do share is used to run the engagement and nothing else. Email is currently our only intake channel precisely so there's no hidden form pipeline behind this page.

How can we follow along?

SBOMFlow is built in the open about its status. Follow @SBOMFlow on X or Instagram, or watch What's new for shipped, tested changes.

Get in touch

Tell us what your release process actually looks like.

Three tracks: connected-device release evidence, post-market / PSIRT continuity (experimental preview), and AI-enabled product evidence (in development). We're also happy to talk with advisors and investors who see the same wave coming. No spam, no sequence — a person reads this inbox.

Release-evidence design partners · Post-market (PSIRT) design partners · AI evidence design partners · Advisors · Investors · No spam