Building in the open
Design partners
We’re inviting a small number of design partners for validation work arranged directly: you bring a release you actually ship, the audit runs offline in your environment, and every artifact stays with you. Pricing is under validation; the offline CLI costs nothing to trial, and v0.5.0 is available to approved private testers rather than as a public download. No organisation is represented on this site as a customer.
Five ways to write to us
Every route lands at hello@sbomflow.com. A person reads it and answers yes, no or not yet; there is no form behind this page and no sequence waiting on the other side of it.
Before you write to us
The evaluation journey
This is the whole first engagement. It runs on your build, in your environment, and ends with artifacts you hold and feedback we act on.
A firmware or software build you actually ship, and a named engineer who knows it. Not a demo repository.
Where the SBOMs, scan results, VEX decisions, test results and approvals for that release currently live — and which of them trace to the exact build.
Offline, in your environment, on the tester build. Nothing is hosted, no account is created, and nothing is sent to us.
Read the evidence pack the way your reviewer would: what was observed, what was refused, and what still needs a human decision.
Where the evidence was wrong, thin or unreadable; which warnings were noise; what your build system does that the scan did not understand; what you could not do at all.
Written reactions against the real record — the design part of design partner. It shapes what we build next, with its status labelled honestly wherever it appears.
Private tester access
v0.5.0 is a certified private tester build with no known release-blocking defects, subject to the documented restrictions. It is not on PyPI and there is no public download — approved testers receive it through a controlled channel. This is a testing programme, not a purchase: nothing below is a paid arrangement, and no organisation is being represented as a customer.
Teams that ship connected products and can point the tool at a real firmware or software build — not a demo repository. You need Python 3.11 or newer and a build tree. There is nothing to host, no account to create, and no data to send us.
The v0.5.0 wheel and its SHA-256, install instructions that work with the package index switched off, the public documentation set, and a written list of the restrictions this build ships under. You install it yourself and run it in your own environment.
Where the evidence was wrong, thin, or unreadable for the person who had to review it. Which warnings were noise. What your build system does that the scan did not understand. And what you could not do at all — an unusable path is more useful to us than a working one.
The restrictions, stated up front:
To ask for access, email hello@sbomflow.com and say what you build, on which build system, and what release you would point it at. A person reads that inbox and will answer yes, no, or not yet. How the build was verified, and what that verification did not establish, is set out on the trust centre.
Once you have the tester build
One command detects the project, scaffolds a config it refuses to overwrite, and runs a fully offline audit. It discloses the scan root, the detected inputs and its network posture before the first write — nothing happens to your tree that you have not been shown first.
$ sbomflow quickstart .Engagements
Every engagement is release-readiness support — never legal advice, and never a statement that a product is conformant.
What you’ll hold at the end
Commercial questions
Pricing is under validation and arranged directly while we invite a small number of design partners — it’s scoped to your product class, repositories, firmware variants, and release cadence rather than per-seat tooling. Trying the offline CLI costs nothing; access to the v0.5.0 build is by approval rather than download, and carries no charge and no commitment. Tell us about your product and we’ll come back with specifics.
Email hello@sbomflow.com with what you build, your build system (Yocto, Zephyr, Buildroot, or other), and where you sell. We reply with a clear yes, no, or not-yet on fit — and where it fits, a first engagement that starts from your real build, not a demo repo.
The tool itself runs in your environment, offline by default — for most engagements we never need your source at all, only the evidence outputs you choose to share. Anything you do share is used to run the engagement and nothing else. Email is currently our only intake channel precisely so there’s no hidden form pipeline behind this page.
SBOMFlow is built in the open about its status. Follow @SBOMFlow on X or Instagram, or watch What’s new for shipped, tested changes.
Get in touch
Three tracks: software and connected-device release evidence, post-market / PSIRT continuity (experimental preview), and AI-enabled product evidence (in development). Advisors and investors are welcome to write too. No spam, no sequence — a person reads this inbox. Who is behind SBOMFlow
Evaluate one release · Design partners · Research · Investment · General questions · No spam