CodeLocker
CodeLocker is a code-signing platform from Zeva for software supply-chain traceability and provenance.
What CodeLocker is
CodeLocker is a code-signing platform from Zeva for software supply-chain traceability and provenance. It signs source-code commits and binaries, and also supports targets such as files, scripts, and SBOMs. For commits, the platform verifies developer identity and checks pushed changes for valid signatures. A DevOps build pipeline can sign binaries generated during a build. Private keys remain in an HSM, with centralized key management described as compatible with FIPS 140-3 Level 3 HSMs. Zero-trust controls combine identity verification with least-privileged access, and multifactor authentication is supported. Signed source-code verification includes a step-by-step audit trail. Long-term validation signatures retain data for checking signatures with limited or no internet access, including air-gapped environments. CodeLocker integrates with source-control, identity-management, and CI/CD systems, with customizable plug-ins. Zeva presents it for developers and deployment engineers in regulated critical-infrastructure sectors. Pricing is available on request.
Good
- Signs commits and build-produced binaries
- Private keys remain in an HSM
- Supports multifactor authentication
- Includes long-term validation for air-gapped environments
- Integrates with CI/CD platforms
Watch out
- Pricing is available only on request
- Designed for regulated critical-infrastructure sectors
- Requires integrating identity and source-control systems
Who it suits
CodeLocker suits software developers and deployment engineers in regulated sectors such as defense, healthcare, device manufacturing, and finance. It is intended for teams needing controlled signing, provenance, and audit information.
Verdict
CodeLocker combines commit and binary signing with identity checks, key protection, audit trails, and long-term validation. Its integrations and compliance focus fit regulated software supply chains, while prospective users must request pricing.
The facts
Each one read from CodeLocker's own pages, with the date it was checked.
What it does
- Access controls
- Its zero trust architecture calls for identity verification and least privileged access, and the platform supports multifactor authentication.checked 9 Oct 2026
- Audit trail
- It supports multifactor authentication and signed source-code verification with a step-by-step audit trail.checked 10 Oct 2026
- Build pipeline
- It can integrate with a DevOps build pipeline to sign binaries produced by a build.checked 9 Oct 2026
- Compliance
- The maker says CodeLocker helps developers comply with the NIST Secure Software Development Framework (NIST 800-218).checked 10 Oct 2026
- Identity and access
- Its zero-trust approach includes explicit identity verification and least-privileged access.checked 10 Oct 2026
- Integrations
- It integrates with source-code repositories and CI/CD build servers, and offers customizable plug-ins for third-party applications.checked 10 Oct 2026
- Intended users
- The maker describes it as designed for software developers and deployment engineers in regulated critical infrastructure sectors, including defense, healthcare, device manufacturing, and finance.checked 9 Oct 2026
- Key security
- The site says private keys remain in an HSM and describes centralized key management compatible with FIPS 140-3 Level 3 HSMs.checked 10 Oct 2026
- Long term validation
- Its LTV signatures include data needed to validate signatures in environments with limited or no internet access, including air gapped environments.checked 9 Oct 2026
- Long-term validation
- Its long-term validation signatures include data needed to validate signatures in environments with limited or no internet access, including air-gapped environments.checked 10 Oct 2026
- Product
- CodeLocker is a code signing platform for software supply chain traceability and provenance.checked 9 Oct 2026
- Purpose
- CodeLocker is a code-signing platform for software supply-chain traceability and provenance.checked 10 Oct 2026
- Sales and support
- The site invites prospective customers to book a demo and does not list a self-serve purchase price.checked 10 Oct 2026
- Signing
- It supports both commit-level and binary-level signing.checked 10 Oct 2026
- Target users
- The maker describes it as designed for software developers and deployment engineers in regulated critical-infrastructure sectors, including defense, healthcare, device manufacturing, and finance.checked 10 Oct 2026
- Validation
- It provides an automated validation workflow for code signing.checked 10 Oct 2026
The company
- Founded
- 2005checked 28 Sep 2026
- Headquarters
- Fairfax, Virginia, USAchecked 28 Sep 2026
- Maker
- Zeva says it was founded in 2005 in Virginia, USA, and lists its address as 10300 Eaton Place Suite 305, Fairfax, VA 22030, USA.checked 10 Oct 2026
- Maker background
- Zeva says it was founded in 2005 in Herndon, Virginia, USA.checked 9 Oct 2026
Alternatives to CodeLocker
- 1
Sigstore
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 2
SignPath
Free planWebAPILinuxmacOS7.2Free plan - 3
AWS Signer
Free planWebAPILinuxmacOS7.1Free plan - 4
Cosign
Free planLinuxmacOSSelf-hostedWindows6.6Free plan - 5
OpenPubkey
Free planAPILinuxmacOSSelf-hosted6.6Free plan - 6
SignServer
Free planWebAPILinuxmacOS6.5Free plan