Fossid AB

Open source scanning inside the development process

FossID makes a software composition analysis platform that searches a company's codebase for third-party and open source code. Its scanner works at two levels: it identifies whole components, and it also picks up small copied pieces, down to individual snippets. Each match is tied to the licence obligations attached to that code, so a team can see which conditions apply and where compliance risks lie. The company describes the scanner as language-agnostic, meaning it is not tied to a single programming language.

According to the company's site, the checks can be placed wherever the work already happens. Scanning can run inside a developer's integrated development environment, be called by an AI agent, sit alongside Git-based source control, run in continuous integration pipelines, or feed issue tracking and notification systems. The purpose is to put the findings in front of the people who write the code, rather than leaving them for a separate review at the end.

Software bills of materials for products and suppliers

FossID also handles software bills of materials, the inventories that list what a product is built from. Its platform can generate a complete bill for a product and can take in the reports that suppliers send. Supplier reports can be normalised, inspected and approved inside the platform. Reports can be imported and exported in SPDX or CycloneDX form, and they can carry licence, copyright, vulnerability, provenance and snippet-level data. The company presents this as support for compliance and procurement work, where buyers need that detail from the companies that supply their software.

Audits for acquisitions and protection of proprietary code

For mergers and acquisitions, the company describes an open source audit as a way to check licence and copyright compliance, reduce security risk and clarify what the software is worth. Its "blind scan" technique examines a target without needing the target's source code, which the company says protects the target's intellectual property while the audit goes ahead. The business also offers baselining and a virtual open source auditor service. Baselining sets out a client's starting position, and the auditor service supplies expert oversight as the work continues.

The platform can also help developers spot proprietary code fragments before they are shared with an open source project. The company says this prevents accidental exposure of a firm's own material and reduces the need to maintain costly forks.

Clients, reach and offices

Its stated audiences are large software companies, DevOps and engineering staff, compliance officers and in-house lawyers. Its customers are mainly in the United States, Europe, Japan and China, and it works through resellers in Japan and China. It has offices in Sweden, Romania and Japan, and it reports a team of around thirty people, most of them engineers.

A 2016 founding and a self-financed business

The business was founded in 2016 by people with experience of open source compliance in sourcing, legal and engineering roles. They wanted to tackle adoption from an engineering angle as well as a legal one, and the result was a purpose-built search method and a knowledge base designed for accuracy and speed. The company says it has stayed self-financed since then, that three Fortune 500 companies were early users, and that its database covers far more projects than its nearest rival, with scans it describes as much faster.