Every Release, Fully Governed. Automatically.

Natively enforce policy gates across your SDLC. Block non-compliant releases with evidence of security, quality, and compliance. Trust both human and AI written software.

Book a Demo Take A Tour

Manual governance can't survive AI-driven development.

The Governance Bottleneck

AI now generates 10 times more code than human teams can manually review, while audits stay at human pace. Governance is the new constraint.

Detection, No Enforcement

Security tools flag risks but rarely enforce them. Without policy-as-code embedded in the pipeline, governance lives in dashboards while non-compliant releases reach production.

Rising Compliance Stakes

With regulations like the EU Cyber Resilience Act fines up to 2.5% of global sales, proving compliance has become a board-level requirement, not just a regulatory hurdle.

The compliance burden is real.

"The process today is me sitting down with 10 pages of an Excel spreadsheet and going and answering every compliance question."

Senior Manager, Quality Engineering, Large Enterprise

"We have 100 teams providing manual compliance evidence every month, 12 times a year. It's several hours out of my day, every month, just reviewing what they submit."

Technology Director, DevOps Platform Fortune 100 Company

"I don't trust developers filling out compliance questionnaires once a year. I want to see data."

VP of DevOps Services Fortune 500 Company

"The process today is me sitting down with 10 pages of an Excel spreadsheet and going and answering every compliance question."

Senior Manager, Quality Engineering, Large Enterprise

Every release carries immutable proof

AppTrust is your continuous governance layer. It signs every artifact, enforces policy gates, maps ownership, and delivers audit-ready traceability, automatically.

NEW Prompt to Release Traceability

Every agent prompt, commit, PR, approval, Jira ticket, and SBOM is signed and bound to the software artifact automatically. No screenshots or spreadsheets. Every piece of evidence is cryptographically sealed from prompt to production.

Gates that Physically Block Non-Compliant Releases

Policy-as-code gates evaluate evidence across application lifecycles or selected repositories, blocking non-compliant changes. For applications, justified exceptions are tracked as waivers so governance never slows velocity, and releases that pass earn the trusted release badge.

NEW Continuous Governance, Not a Single Point in Time

Governance doesn't stop when a version ships. Every application maps to an owner and criticality level, so risk always has context. Every active production version stays continuously monitored post-release. Expired versions are no longer actively governed.

Audit-Ready By Default

When regulators ask what was shipped, why it was approved, and what was flagged and waived, every answer is already there.

NEW CRA, DORA and NIST SSDF Compliance, Engineered Into Your Pipeline

Enforce pre-mapped compliance frameworks as Policy-as-Code, with no manual policy writing required. Every control mapped and enforced automatically. Real-time coverage scoring so you know exactly where you stand.

NEW Enforce Release Intent with AI Verification Policies

Syntax checks confirm code compiles, but they miss drift from defined requirements. AppTrust uses AI to evaluate releases against plain-language policies, generating signed cryptographic proof that execution matches intent.

From CVE to owner in one screen

• When a CVE surfaces post-release: Every Trusted Release carrying the affected component is flagged automatically.
• Instant blast radius visibility: See every affected application’s owner, criticality tier, and release stage on a single screen.
• Triage by impact, not CVSS: A critical CVE on a sandbox app can wait, while a medium CVE on a customer-facing release cannot.

Policy-as-Code, at any scale

• Policy Playground: Test new policies against real Application Versions from your System of Record before they ever block a build.
• AI-assisted authoring: Describe what you want to enforce, and our AI assistant generates validated Rego for your application context in seconds.
• Reusable templates: Validate once, save as a template, and let any team across your organization adopt it instantly.

Track DORA delivery metrics.

• Deployment frequency: Measure how often each project or application version ships, by team.
• Lead time visibility: See exactly where releases are slowing down, broken out by promotion stage.
• Team performance: Compare deployment speed across your portfolio and spot which teams are moving fast and which need unblocking.

Signed Evidence Across Your Toolchain

AppTrust auto-collects evidence from the security, quality, deployment, and change-management tools your teams already run.

DevGovOps: Unifying DevOps and Governance

AppTrust embeds security, quality, and compliance into your software supply chain. Every team gets a single view of what shipped, what passed, and what’s auditable.

Frequently Asked Questions

• What is JFrog AppTrust?

JFrog AppTrust is the software supply chain governance layer of the JFrog Platform. It makes compliance a natural output of every release, not a retrospective exercise. Every release is automatically evidenced, gated, and verifiable, so your teams ship at speed without the compliance tax.

• What is software supply chain governance?

Software supply chain governance (also known as DevGovOps) is the discipline of enforcing security, quality, and compliance policies continuously across the software development lifecycle. Signed evidence is bound to every artifact as immutable proof of what was built, approved, and released.

• How does AppTrust work with JFrog Artifactory?

JFrog Artifactory is your software System of Record. AppTrust runs natively on top, so every binary carries its policy decisions and signed evidence as it moves through the application lifecycle or between selected repositories. No separate system. No manual handoffs.

• Do policy gates slow developer velocity?

No. AppTrust gates run automatically against signed evidence inside your existing CI/CD pipelines, with no human review, approval queues, or ticket waits. Passing builds earn the Trusted Release badge automatically.

• How is AppTrust different from an application security posture management (ASPM) tool?

Some ASPM tools enforce, but they lack the underlying context to enforce reliably. AppTrust runs natively on JFrog Artifactory, your software System of Record. Every artifact, evidence item, and promotion lives in one place, creating an immutable, signed audit trail. ASPM isn’t built for auditors. AppTrust is.

• Should we build our own OPA engine instead of buying AppTrust?

Building your own Open Policy Agent (OPA) governance hits three walls: rule maintenance at scale, no binary binding, and multi-system evidence aggregation. AppTrust solves all three natively and remains, OPA-compatible.

• What is the engineering ROI of AppTrust?

Automated evidence-based policy gates eliminate manual audit preparation. Engineering teams stop collecting evidence across hundreds of pipelines. What used to take weeks is already there when you need it.

• How does AppTrust integrate with our existing CI/CD?

AppTrust works alongside the CI/CD tools you already run, including Jenkins, GitHub Actions, Azure DevOps, and CircleCI. AppTrust enforces policy gates at promotion in JFrog Artifactory, so pipelines don’t need rewriting.

• Which evidence partners does AppTrust support?

AppTrust auto-collects signed evidence from security, quality, and deployment tools including Akto, Akuity, CoGuard, Dagger, GitHub, Gradle, NightVision, ServiceNow, Sonar / SonarQube, Shipyard, and Troj.ai.

• Can AppTrust help with EU CRA, FedRAMP, and NIST SSDF compliance?

Yes. AppTrust delivers pre-mapped compliance frameworks for CRA and NIST SSDF, allowing teams to automate compliance with one click.

• Does AppTrust govern AI agent activity?

Yes. AppTrust governs AI agent activity by capturing every agent interaction at the IDE level through JFrog Agent Plugins for Cursor and Claude Code. Those interactions are stored as signed evidence and evaluated by AppTrust policies across the release lifecycle, giving every release a complete evidence chain from prompt to production.

• How does AppTrust monitor releases after they ship?

AppTrust monitors releases after they ship through continuous post-release governance. Every deployed version stays actively governed against operational support windows and accumulated risk. Versions past their support window are automatically deprioritized, so compliance can be proven at any point in time, not just at the release gate.