# Every Release, Fully Governed. Automatically. Natively enforce policy gates across your SDLC. Block non-compliant releases with evidence of security, quality, and compliance. Trust both human and AI written software. ## Manual governance can't survive AI-driven development. ### The Governance Bottleneck AI now generates 10 times more code than human teams can manually review, while audits stay at human pace. Governance is the new constraint. ### Detection, No Enforcement Security tools flag risks but rarely enforce them. Without policy-as-code embedded in the pipeline, governance lives in dashboards while non-compliant releases reach production. ### Rising Compliance Stakes With regulations like the EU Cyber Resilience Act fines up to 2.5% of global sales, proving compliance has become a board-level requirement, not just a regulatory hurdle. ## The compliance burden is real. "The process today is me sitting down with 10 pages of an Excel spreadsheet and going and answering every compliance question." Senior Manager, Quality Engineering, Large Enterprise "We have 100 teams providing manual compliance evidence every month, 12 times a year. It's several hours out of my day, every month, just reviewing what they submit." Technology Director, DevOps Platform Fortune 100 Company "I don't trust developers filling out compliance questionnaires once a year. I want to see data." VP of DevOps Services Fortune 500 Company ## Every release carries immutable proof AppTrust is your continuous governance layer. It signs every artifact, enforces policy gates, maps ownership, and delivers audit-ready traceability, automatically. ## NEW Prompt to Release Traceability Every agent prompt, commit, PR, approval, Jira ticket, and SBOM is signed and bound to the software artifact automatically. No screenshots or spreadsheets. Every piece of evidence is cryptographically sealed from prompt to production. ## Gates that Physically Block Non-Compliant Releases Policy-as-code gates evaluate evidence across application lifecycles or selected repositories, blocking non-compliant changes. For applications, justified exceptions are tracked as waivers so governance never slows velocity, and releases that pass earn the trusted release badge. ## NEW Continuous Governance, Not a Single Point in Time Governance doesn't stop when a version ships. Every application maps to an owner and criticality level, so risk always has context. Every active production version stays continuously monitored post-release. Expired versions are no longer actively governed. ## Audit-Ready By Default When regulators ask what was shipped, why it was approved, and what was flagged and waived, every answer is already there. ## NEW CRA, DORA and NIST SSDF Compliance, Engineered Into Your Pipeline Enforce pre-mapped compliance frameworks as Policy-as-Code, with no manual policy writing required. Every control mapped and enforced automatically. Real-time coverage scoring so you know exactly where you stand. ## NEW Enforce Release Intent with AI Verification Policies Syntax checks confirm code compiles, but they miss drift from defined requirements. AppTrust uses AI to evaluate releases against plain-language policies, generating signed cryptographic proof that execution matches intent. ### From CVE to owner in one screen - **When a CVE surfaces post-release:** Every Trusted Release carrying the affected component is flagged automatically. - **Instant blast radius visibility:** See every affected application’s owner, criticality tier, and release stage on a single screen. - **Triage by impact, not CVSS:** A critical CVE on a sandbox app can wait, while a medium CVE on a customer-facing release cannot. ### Policy-as-Code, at any scale - **Policy Playground:** Test new policies against real Application Versions from your System of Record before they ever block a build. - **AI-assisted authoring:** Describe what you want to enforce, and our AI assistant generates validated Rego for your application context in seconds. - **Reusable templates:** Validate once, save as a template, and let any team across your organization adopt it instantly. ### Track DORA delivery metrics. - **Deployment frequency:** Measure how often each project or application version ships, by team. - **Lead time visibility:** See exactly where releases are slowing down, broken out by promotion stage. - **Team performance:** Compare deployment speed across your portfolio and spot which teams are moving fast and which need unblocking. Signed Evidence Across Your Toolchain AppTrust auto-collects evidence from the security, quality, deployment, and change-management tools your teams already run. ## DevGovOps: Unifying DevOps and Governance AppTrust embeds security, quality, and compliance into your software supply chain. Every team gets a single view of what shipped, what passed, and what’s auditable. ## Frequently Asked Questions - What is JFrog AppTrust? JFrog AppTrust is the software supply chain governance layer of the JFrog Platform. It makes compliance a natural output of every release, not a retrospective exercise. Every release is automatically evidenced, gated, and verifiable, so your teams ship at speed without the compliance tax. - What is software supply chain governance? Software supply chain governance (also known as [DevGovOps](/content/learn/grc/devgovops/index.html)) is the discipline of enforcing security, quality, and compliance policies continuously across the software development lifecycle. Signed evidence is bound to every artifact as immutable proof of what was built, approved, and released. - How does AppTrust work with JFrog Artifactory? JFrog Artifactory is your software System of Record. AppTrust runs natively on top, so every binary carries its policy decisions and signed evidence as it moves through the application lifecycle or between selected repositories.