Dependency Security · pricing · Updated September 2026
FOSSA pricing (2026)
FOSSA's paid plans start at $20/mo (Business) as checked on 2026-09-27, read from FOSSA's own pricing page; 3 plans. Best for license compliance. Every figure below links to its source and the date we captured it.
At a glance
- Entry price: $20/mo (Business) · 10% off with annual billing
- Free tier: Yes
- Compliance: HIPAA — · SOC 2 Yes · GDPR —
- Best for: license compliance; SBOM management; legal/compliance teams; regulated industries requiring attribution reports
As of · every figure below links to its source STALE · 2026-09-02
FOSSA plans & pricing
| Plan | Monthly | Annual | Billing | Notes | Source |
|---|---|---|---|---|---|
| Free | $0 | — | Flat monthly | Forever free. 5 projects, 10 contributing developers, 1 release group, 5 dependency levels, 1 quality check (outdated packages), 5 imported SBOMs. Includes container scanning, basic email support, API access, SBOM export. | fossa.com |
| Business | $20 | −10% | Flat monthly | $20 PER PROJECT/month billed annually (priced per project, NOT per developer). Up to 10 projects, 10 contributing developers, 1 release group, unlimited dependency levels, full quality check suite, unlimited imported SBOMs. Automated license and vulnerability scanning, multi-project reporting, priority support. ~10% savings with annual billing. | fossa.com |
| Enterprise | not priced monthly | — | Custom / quote | Custom pricing, contact sales. Unlimited projects, custom developer count, unlimited release groups and dependency levels. Adds enterprise APIs, SSO, RBAC, custom deployment options, advanced compliance reporting. Optional add-ons: Snippet Scanning, Binary Scanning. | fossa.com |
Last verified 2026-09-27. STALE · 2026-09-02 Pricing re-verified at fossa.com/pricing on 2026-06-18. Free $0, Business $20 PER PROJECT/month (billed annually) — not per developer — Enterprise quote-only. SOC 2 confirmed via fossa.com/trust; HIPAA not stated. Re-verified 2026-09-02 against the live pricing page; published figures unchanged.
Price changes
Price on record
$20/moFirst on record 2026-06-27
A new dated entry is stamped here each time the price moves — the record builds itself.
Tracked since June 2026. No change record has cleared two sources yet, so nothing is published on the wire.
Capabilities
Integrations: GitHub, GitLab, Bitbucket, Jenkins, GitHub Actions, Jira, Docker.
Key features: License compliance focus with deep dependency-level analysis; SBOM import and export across all tiers including free; Snippet scanning for AI-generated and unlicensed code (Enterprise add-on); Binary scanning for compiled artifacts and containers (Enterprise add-on).
Plan limits: Free: 5 projects, 10 developers, 5 imported SBOMs, 1 quality check; Business: 10 projects, 10 developers, annual billing required; Business: priced per project ($20/project/mo), FOSSA CLI required for scanning.
Frequently asked questions
How much does FOSSA cost?
FOSSA's paid plans start at $20/mo (Business), and it lists a $0 plan (Free); it has 3 published plans. Verified 2026-09-27.
Is FOSSA cheaper billed annually?
Yes. FOSSA publishes a 10% discount for paying annually (on the Business plan). Verified 2026-09-27.
Does FOSSA support HIPAA?
FOSSA's public pages do not say whether it supports HIPAA. Its public pages also state SOC 2 compliance.
Does FOSSA have a free plan?
Yes — FOSSA publishes a free tier.
FOSSA vs alternatives
Compare all dependency security · SOC 2-certified dependency security · Open data · MCP
More dependency security tools
Related categories
Display this standing
FOSSA currently holds a bronze deskmark here — Rank 4 of 6 · Dependency Security. Anyone may show it. There is nothing to apply for, nothing to pay, and displaying it changes no score: the standing comes from the published algorithm and money never touches it.
The image is drawn from our live data, so it follows the standing rather than freezing it: if FOSSA moves up or down a tier, the plaque on your own site says so at our next publish. Nothing is tracked beyond the ordinary web-server log that records any image request.