Git-native AI procurement evidence
Show buyers exactly which AI your software uses, with evidence.
AI TrustBOM reads your repository and produces a cited description of the AI providers, models, tools and data flows in your product. Your own Trust approver signs it off in Git before anything is sent to a buyer.
30-day free trial, then $499/month or $4,990/year per GitHub owner.
Pre-launch. The trustbom CLI is not yet published and trials are not yet open to customers. Installation and purchases are not open today. This site describes the planned launch offer.
- Runs in your own environment
- Every claim cited to a file
- Human-approved in Git
- No data collected by this site
The problem
Buyers now ask about your AI
If you sell software with AI features to enterprise or regulated buyers, you will be sent security reviews and AI questionnaires: which models, which providers, where does data go, is customer data used for training, who oversees it.
Today those answers are usually assembled by hand from memory and old documents. They go stale when the product changes, and a buyer can only take them on trust. A marketing claim is not evidence.
The product
What AI TrustBOM produces
An evidence-backed pack built from your repository and approved by a human at your company.
Cited, not claimed
Every model, tool and answer points to a file in your repository, or to a manual declaration you made on the record.
Approved by Trust
A designated Trust approver at your company signs off a specific version in Git. Scanner output stays a draft until then.
Kept current
A pull-request check flags AI changes that no one has approved yet, so the next buyer review does not start from a surprise.
It runs in your own environment and your own GitHub workflow. You send the exported pack to your buyer yourself; there is no hosted service in the offer.
How it works
From repository to buyer in three steps
-
Scan
Run
trustbom scan. It reads tracked lockfiles, manifests, allowlisted configuration and detector packs and writes a cited draft. -
Review and approve
Engineers fill gaps with manual declarations. Trust approves the exact graph through a reviewed Git change.
-
Send the pack
Export the approved pack, fill buyer questionnaires from it, and send it to your buyer.
Honest by design
What detection is, and is not
Detection is based on manifests, configuration and pattern packs in your tracked files. It is not a runtime proxy and does not observe live traffic. It finds supported signals, such as Anthropic, OpenAI, Amazon Bedrock, Google Vertex AI and Azure OpenAI SDK use, MCP servers and evaluation workflows, and you declare anything it cannot see.
Scanner output is a draft until a human at your company approves it. AI TrustBOM does not certify compliance with any law, standard or contract, and an absence of evidence is never presented as proof that something is not used.
Pricing
$499/month
or $4,990 per year, per GitHub owner. Start with a 30-day free trial.
The basic commands are free with no time limit. Producing the approved, sendable pack needs a license.
Answer the next AI questionnaire with evidence.
See what a finished pack looks like, then decide whether it fits your buyers' reviews.