SW360
SW360 is an open-source catalogue for keeping software component, release, and project information together across an organization.
What SW360 is
SW360 is an open-source catalogue for keeping software component, release, and project information together across an organization. It tracks components used in projects or products, manages license information and obligations, and supports workflows for creating license-related documents. Software Bill of Materials management is also a listed use case, and the service matches vulnerability information with components in its component service. It provides a REST API with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. SW360 can start a FOSSology clearing process and import the resulting reports; license scanning itself is handled by FOSSology, not SW360. The project is free under the EPL-2.0 license, with self-managed deployment. The recommended v20 setup uses Docker- or Podman-compatible containers and includes a frontend, Keycloak, CouchDB, and a Spring Boot backend. Its listed roles include quality managers, developers, legal counsels, software architects, and R&D managers.
Good
- Tracks components, releases, and project information.
- Manages license information and obligations.
- Supports SBOM management and vulnerability matching.
- Offers a REST API and multiple authentication options.
- Free, open source, and self-managed.
Watch out
- Does not scan licenses or source code itself.
- Deployment requires managing a self-hosted setup.
Who it suits
SW360 suits organizations that need to track software components and license obligations across projects or products. Its listed audiences include quality managers, developers, legal counsels, software architects, and R&D managers.
Verdict
SW360 brings component records, license obligations, SBOM use, and vulnerability information into one software catalogue. Organizations needing scanning must connect specialized tools such as FOSSology rather than rely on SW360 to scan directly.
Plans and prices
From SW360's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SW360 | Free | Open source · EPL-2.0 · Self-managed deployment |
The facts
Each one read from SW360's own pages, with the date it was checked.
What it does
- API and integrations
- SW360 exposes its functionality through a REST API and documents HTTP Basic, API token, OAuth2, and Keycloak authentication options.checked 5 Oct 2026
- Component tracking
- SW360 tracks software components used in projects or products and maintains related component, release, and project information.checked 5 Oct 2026
- Deployment
- The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend.checked 5 Oct 2026
- FOSSology integration
- SW360 can trigger a FOSSology clearing process and import its reports; FOSSology performs the license scanning.checked 5 Oct 2026
- Latest release shown
- The Eclipse project page lists version 20.1.0, dated July 29, 2026.checked 5 Oct 2026
- License
- The project is open source and licensed under EPL-2.0.checked 5 Oct 2026
- License compliance
- The application manages license information and obligations and supports workflows for producing license-related documents.checked 5 Oct 2026
- Notable limitation
- License scanning and source code scanning are outside SW360’s scope; it delegates scanning to specialized tools and exchanges data with them.checked 5 Oct 2026
- Purpose
- SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization.checked 5 Oct 2026
- SBOMs
- The user guide lists Software Bill of Materials management as a use case.checked 5 Oct 2026
- Security configuration
- The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers.checked 5 Oct 2026
- Support and community
- The documentation lists a developer mailing list, a public Slack channel, and open developer meetings.checked 5 Oct 2026
- Vulnerabilities
- SW360 collects vulnerability management information and matches it with components stored in its component service.checked 5 Oct 2026
- Who it is for
- The project identifies quality managers, software developers, legal counsels, software architects, and R&D managers among the roles served.checked 5 Oct 2026
The company
- Founded
- 2016checked 28 Sep 2026
Alternatives to SW360
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
FOSSology
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 3
ScanCode.io
Free planWebAPILinuxmacOS7.0Free plan - 4
SourceTrust
Free planWeb6.7From $299 a year - 5
FOSSA
Free planWebAPILinuxSelf-hosted6.4Free plan - 6
DejaCode
WebAPILinuxSelf-hosted6.3From $500 a month