Wisec

Wisec is a CI-focused service for collecting and preserving software-build security evidence. It is best suited to teams that need signed build records, release controls, and audit evidence in their delivery pipeline. Its free plan is a practical starting point, but meaningful growth brings steep capacity and price jumps.

Overview

Wisec links builds into a cryptographically signed chain using Ed25519, with SLSA provenance and public Sigstore/Rekor timestamping. It also generates signed CycloneDX SBOMs and VEX documents describing whether detected CVEs are exploitable. That combination gives teams a record tied to specific builds, not just a collection of security documents.

The CI agent runs without cloning repositories, and Wisec says it withholds scanner-quoted code before transmitting findings. The agent is open source under Apache-2.0; the platform is managed and hosted in the EU. The maker says data is encrypted in transit and at rest, with platform data hosted in France and residency in the EU. Self-hosting is limited to Enterprise, so organizations requiring deployment in their own environment must budget for a custom arrangement.

Key features

Eleven anomaly rules run on each build: five calibrated to project history and six aimed at known-bad patterns. Teams can define block or warn policies for secrets, vulnerable dependencies, unapproved contributors, risk thresholds, and CVE severity, then enforce them at the CI gate. This is useful for teams that want security checks to affect release decisions; it also puts policy design and maintenance at the center of the service's value.

Dedicated CI/CD integrations cover GitLab CI, GitHub Actions, Jenkins, and Azure DevOps. CircleCI and Travis CI are described as coming soon, so teams on those systems should not count on dedicated support now. Wisec also imports SARIF v2.1.0 findings from CodeQL, Semgrep, Snyk, Trivy, and other compatible tools, letting teams bring scanner results into the build-evidence workflow.

For audit work, Wisec maps evidence to NIS2, SOC2, ISO 27001, and CRA and exports PDF reports. Its CRA and ISO 27001 mapping is evidence support, not a conformity claim. Teams should treat it as help organizing evidence rather than a substitute for establishing compliance.

Pricing

Wisec has a free plan, paid plans, and a 14-day trial. Business and Pro show founder-rate pricing alongside higher standard rates from 2027; those future rates materially change the long-term cost calculation.

Plan	Price	Limits and support
Free	free	3 projects, 1,000 builds/month, 30 days of history, 1 PDF certificate/month, community support
Business	€990 a year; billed €990/yr at founder rate, standard rate €5,000/yr from 2027	10 projects, 20,000 builds/month, 1 year of history, email support with a 48-hour response
Pro	€2,990 a year; billed €2,990/yr at founder rate, standard rate €15,000/yr from 2027	Unlimited projects and builds, lifetime archives, priority support with a 24-hour response
Enterprise	Custom pricing	Unlimited projects and builds, on-premise or private cloud deployment, dedicated 24/7 priority support, custom billing

Free is aimed at small projects and security exploration, but the 30-day history and single monthly PDF certificate make it a limited home for ongoing audit records. Business targets growing teams needing notarization and expands build volume and retention, though its 10-project cap and 48-hour email support remain constraints. Pro removes project and build quotas and adds lifetime archives and faster priority support, making it the more suitable paid tier for organizations demanding full control of capacity. Enterprise is the only route to on-premise or private cloud deployment; teams pay custom pricing for that flexibility and dedicated support.

Platforms

Wisec supports API, Linux, macOS, self-hosted, web, and Windows environments. Self-hosted deployment is an Enterprise option rather than a general deployment choice.

Who it's for

Wisec fits software teams that already use CI and scanners and want build-linked provenance, SBOMs, VEX, policy gates, and exportable compliance evidence in one workflow. It is particularly relevant to teams preparing CRA evidence or managing audit requirements across NIS2, SOC2, and ISO 27001. Small teams can explore the service at no cost; teams with high build volumes, long retention needs, or deployment-control requirements should weigh the paid tiers carefully. It is a weaker fit for teams that need dedicated CircleCI or Travis CI support today, or that expect evidence mapping itself to establish conformity.

Pros and cons

• Pros: Signed build chains, SLSA provenance, signed SBOMs, and VEX documents connect several kinds of security evidence to builds.
• Pros: Block-or-warn policies and anomaly rules can make security findings part of CI release decisions.
• Pros: SARIF imports support findings from several named scanners, while PDF exports and framework mapping support audit preparation.
• Pros: The open-source CI agent runs without cloning repositories; the maker also says it withholds scanner-quoted code and keeps platform data in the EU.
• Cons: Free retention is only 30 days, with one PDF certificate per month and a 1,000-build monthly cap.
• Cons: Business and Pro list founder rates alongside much higher standard rates from 2027, which makes future subscription cost a major consideration.
• Cons: Self-hosting requires Enterprise, and dedicated CircleCI and Travis CI support is not yet described as available.

Alternatives

For a broader comparison, browse Software Supply Chain Security Software. Consider Sonatype Nexus Repository if its free Community Edition, ecosystem support, CI/CD integration, or external PostgreSQL option better matches your repository needs. ActiveState Platform may suit organizations whose free tier for public projects is sufficient or those seeking its paid enterprise offering.

DevGuard is another freemium option in this category. Choose GUAC if you want a free, MIT-licensed project and are prepared to set it up with Docker, Docker Compose, and jq. StepSecurity offers a free Community plan for unlimited public repositories on GitHub-hosted runners in GitHub Cloud.

Chainloop offers a free, open-source, self-hosted Community Edition without a UI or curated policy library, a different trade-off for teams prioritizing self-hosting. SafeDep Platform may appeal to teams that want its free open-source tools without a SafeDep account. Choose Sigstore if free signing infrastructure for developers and software providers is the priority.

Verdict

Wisec is a strong fit for CI-driven teams that need signed, build-linked evidence and enforceable security policies, especially when audit preparation matters. Its clearest advantages are the combination of provenance, scanner imports, policy gates, and evidence exports. Look elsewhere if you need self-hosting without Enterprise, current dedicated CircleCI or Travis CI support, or a paid plan whose standard pricing remains close to the founder rate.