DejaCode
Automate open source license compliance and software supply chain integrity
About DejaCode
DejaCode is an enterprise-level application by nexB that automates open source license compliance and ensures software supply chain integrity. Powered by ScanCode, it lets you track all open source and third-party components, generate SBOMs in CycloneDX and SPDX formats, apply usage policies, and produce compliance artifacts including attribution documentation. Available as both a cloud-hosted SaaS and on-premises installation, it integrates with VulnerableCode for vulnerability tracking and PurlDB for package reference data.
Pros & Cons
Pros
- Comprehensive open source compliance in a single platform
- Powered by industry-leading ScanCode scanner
- Supports both CycloneDX and SPDX SBOM standards
- Available as SaaS or self-hosted on-premises
- Free open source community edition (AGPL-3.0)
- Integrated vulnerability tracking and package reference data
- Full REST API and webhook support for automation
- Unlimited products and components on all plans
Cons
- Enterprise pricing not publicly listed, requires contacting sales
- Interface and documentation primarily English-only
- No dedicated mobile application
- Steep learning curve for teams new to license compliance
- Limited disaster recovery documentation for self-hosted deployments
Key Features
Open source license compliance automation
Automatically track and enforce license obligations across your software portfolio
Software composition analysis (SCA)
Identify all open source and third-party components in your codebase
SBOM generation in CycloneDX and SPDX formats
Create, publish and share software bill of materials in industry-standard formats
ScanCode-powered code scanning
Leverage the industry-leading ScanCode engine for deep code and license detection
Vulnerability tracking via VulnerableCode
Monitor aggregated vulnerability data for all tracked components
Package reference data via PurlDB and LicenseDB
Access comprehensive public reference data for packages and licenses
Usage policy management
Apply and enforce usage policies at the license or component level
Compliance artifact generation
Produce attribution documentation and custom compliance reports in multiple formats
Historical audit trail
Maintain a complete history of compliance decisions and changes for audits
REST API for enterprise integration
Full REST API enabling integration with CI/CD pipelines and enterprise systems
Webhook support
Event-driven automation via webhooks for real-time workflow integration
GitHub integration
Native integration with GitHub for seamless DevOps compliance workflows
SaaS or on-premises deployment
Deploy as a cloud-hosted service or install on your own infrastructure
Custom reporting
Generate detailed reports in multiple file formats tailored to your needs
30-day free evaluation
Try the full platform with a private 30-day trial at no cost
Pricing
- Self-hosted deployment
- AGPL-3.0 licensed
- Full source code access
- ScanCode integration
- SBOM generation (CycloneDX & SPDX)
- Community support
- SaaS or on-premises deployment
- Annual subscription
- Unlimited products, components, and packages
- VulnerableCode integration
- PurlDB access
- Professional support and services
- Custom configuration