Sovri

What it does

Certifications

Sovri states it currently has no ISO 27001, SOC 2, HDS, or SecNumCloud certification.checked 11 Oct 2026

Compliance references

Findings can include GDPR, DORA, and NIS2 references derived from CWE mappings when the confidence gate passes.checked 11 Oct 2026

Configuration

Repositories configure Sovri through a .sovri.yml file and environment variables for GitHub App credentials and LLM API keys.checked 11 Oct 2026

Deployment

The Community bot is distributed as a multi-architecture container image on GitHub Container Registry or as a standalone Node.js process built from source.checked 11 Oct 2026

LLM providers

The README describes bring-your-own LLM support for Anthropic, Mistral, OpenAI, and OpenAI-compatible endpoints; the active self-host providers listed are Anthropic and Mistral.checked 11 Oct 2026

Provenance

Each finding includes a provenance trail with the model, prompt digest, and hosting region.checked 11 Oct 2026

Purpose

Sovri is a GitHub pull-request review bot for regulated EU organizations.checked 11 Oct 2026

Release status

The README describes the product as pre-alpha and says the v0.10.1 bot is not yet the complete self-host Community product.checked 11 Oct 2026

Review output

It reads pull-request diffs and posts a walkthrough with inline findings.checked 11 Oct 2026

Scanner integration

The pre-alpha v0.10.1 release adds SARIF 2.1.0 ingestion and merges external scanner findings with LLM findings using cross-tool deduplication.checked 11 Oct 2026

Security design

The Community edition runs on customer infrastructure without a Sovri-controlled backend and publishes Apache 2.0 source with pinned dependencies and an SBOM at each release.checked 11 Oct 2026

Target users

The README identifies banks, healthcare providers, public-sector operators, and defense or dual-use industries as intended users.checked 11 Oct 2026