One legal obligation, one line on your invoice.
Priced per monitored product, never per seat. Every plan includes unlimited users and two-click cancellation. Monthly billing: cancel any time and you keep access until the end of the month you have paid for. Any month started is due, and there is no pro-rata refund.
Starter
Continuous surveillance
excl. VAT
Up to 3 products
- Versioned SBOM (CycloneDX & SPDX export)
- Automated daily vulnerability monitoring of every component
- Email alert on every newly detected vulnerability
- GitHub integration (public & private repositories)
- Unlimited users
Growth
Surveillance + the legal paperwork
excl. VAT
Up to 10 products
- Everything in Starter
- CE technical file, generated and kept up to date
- ENISA incident reporting module (24h/72h countdowns, pre-filled forms)
- Priority support
- Unlimited users
Scale
Coming soonIndustrialised compliance
excl. VAT
Unlimited products
- Everything in Growth
- API access, push scans from your CI, pull SBOMs & vulnerabilities
- Unlimited products, unlimited users
- Priority support
Coming soon
What Cemply reads today
Native, exact
npm and PyPI lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock) and pinned requirements.txt. These give resolved versions and the full transitive tree. package.json and unpinned requirements.txt also work, but only cover direct dependencies with unresolved ranges, and Cemply says so on every scan.
By import
Any CycloneDX or SPDX SBOM, whatever produced it. This is the route for Java, .NET, Go, Rust, C/C++ and embedded builds (Yocto, Zephyr, cdxgen): Cemply reads the SBOM you already generate, matches it, monitors it and keeps the evidence. There is no native pom.xml, csproj, go.mod or Cargo.lock parser yet.
Monitoring scope
The latest scanned version of each product is re-checked every night. If you support several versions in the field, register each one as its own product.
Paid plans are opening shortly. SSO, multi-entity management, larger fleets, importers or white-label? Talk to us.