ReARM
ReARM is a release governance platform for tracking software composition, security posture, shipment clearance, supporting evidence, and what shipped.
What ReARM is
ReARM is a release governance platform for tracking software composition, security posture, shipment clearance, supporting evidence, and what shipped. It organizes versioned SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and searches across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license details to SBOMs. ReARM also gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamps, and evidence snapshots in an immutable audit trail. Integrations include GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider. Community Edition is self-hosted under AGPL 3.0. It can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings need Dependency-Track or imported VDR files. External deployments require TLS.
Good
- Versioned SBOM and XBOM organization
- Release evidence can be retained for 10+ years
- Approval decisions enter an immutable audit trail
- Self-hosted Community Edition is available
Watch out
- Scanning and policy findings require Dependency-Track or VDR files
- External deployments require TLS
Who it suits
ReARM suits teams that need to track software bills of materials, release evidence, and approval decisions. Its self-hosted Community Edition is an option for organizations able to manage Dependency-Track when they need vulnerability scanning or policy findings.
Verdict
ReARM brings composition records, security findings, and release approvals into a governance workflow. Check its Dependency-Track requirement for findings and TLS requirement for external deployments before selecting a setup.
Plans and prices
From ReARM's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| ReARM CE | Free | Self-hosted · Single organization · Community support · Core SBOM/XBOM storage and retrieval · Vulnerabilities and violations via self-managed Dependency-Track integration · Free Forever |
| ReARM Pro - Enterprise | $75 a month | 40+ users · All Standard features · Premium support (24x7, 1 hour response time) · Option for air-gapped deployment · Free 60-day trial · $75 per user per month |
| ReARM Pro - Starter | $195 a month | 1-14 users · Up to 65GB compressed artifact storage · Priority support (8 hours response time) · Managed Dependency-Track · Free 60-day trial · $195 Per Month |
| ReARM Pro - Standard | $1,350 a month | 15-39 users · All Starter features · Private VPC/VNet with SSO and unlimited artifact storage · Option for on-prem deployment · Enhanced support (24x7, 4 hours response time) · Free 60-day trial · $1,350 Per Month |
The facts
Each one read from ReARM's own pages, with the date it was checked.
What it does
- Dependency analysis limit
- The installation documentation says ReARM can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require Dependency-Track or imported VDR files.checked 29 Sep 2026
- Evidence retention
- The product page says it stores HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata with releases for 10+ years.checked 29 Sep 2026
- Findings aggregation
- ReARM aggregates vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools, with triage and audit across organization, product, component, or release scope.checked 29 Sep 2026
- Integrations
- The documentation lists GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider integrations.checked 29 Sep 2026
- Product
- ReARM describes itself as a release governance platform that tracks product composition, security posture, shipment clearance, supporting evidence, and what actually shipped.checked 29 Sep 2026
- SBOM enrichment
- Reliza BEAR automatically enriches SBOMs with metadata including supplier, copyright, and license information.checked 29 Sep 2026
- SBOM/XBOM management
- It organizes versioned SBOMs and XBOMs by release, component, and product, and supports cross-version dependency diffs and portfolio-wide dependency search.checked 29 Sep 2026
- Security deployment
- The installation documentation says TLS is required for deployments outside localhost because login fails on a plain-HTTP page.checked 29 Sep 2026
- Self-hosting
- ReARM Community Edition can be installed with Docker Compose or a Kubernetes Helm chart and is licensed under AGPL 3.0.checked 29 Sep 2026
- Supported compliance needs
- The documentation says ReARM helps fulfill xBOM requirements of EU CRA, US Executive Orders 14028 and 14144, Section 524B of the FD&C Act, and India's RBI and SEBI.checked 29 Sep 2026
- Transparency Exchange API
- ReARM says it supports the Transparency Exchange API for distributing SBOMs and artifacts to downstream consumers.checked 29 Sep 2026
The company
- Founded
- 2019checked 28 Sep 2026
- Headquarters
- Ottawa, Ontario, Canadachecked 28 Sep 2026
Where it runs
- Release approvals
- Release policies can automatically check releases, support manual and automated approvals, and record approver identity, timestamp, and evidence snapshot in an immutable audit trail.checked 29 Sep 2026
Alternatives to ReARM
- 1
Vita3K
Free planOpen sourceAndroidLinuxmacOSWindows7.7Free plan - 2
DuckStation
Free planAndroidLinuxmacOSSelf-hosted7.3Free plan - 3
mkpsxiso
Free planLinuxmacOSWindows6.5Free plan - 4
Avocado
Free planAndroidLinuxmacOSWindows6.4Free plan - 5
Jam Pad
Android6.2 - 6
QuackStation
AndroidLinuxmacOSWindows6.2