Know what you ship,
prove it is secure
Matelot keeps a live picture of every product, service, release and deployment: what is in it, which vulnerabilities reach production, which policies apply, and the evidence the Cyber Resilience Act expects. It runs on your own infrastructure — one `docker compose up` on a single host, or a Helm chart in your Kubernetes cluster — so your code, SBOMs and findings never leave it.
Inventory and SBOM
Every release has a bill of materials
Repositories, builds, releases, container images and deployments form one graph. The security pipeline generates an SBOM per release, correlates it with vulnerability intelligence continuously, and tells you which products, versions and environments a CVE really affects — and whether production is exposed.
Policies and gates
Decide once, enforce everywhere
Policies live at the organization, workspace, team or project and inherit downward. Pipelines evaluate them as gates; deployments can be rejected on the same rules. Exceptions are explicit, owned and time-limited. Service coverage shows which services still lack a repository, a recent scan, an SBOM, a policy or a recorded deployment.
CRA evidence
Compliance as a by-product of shipping
Each release gets a signed evidence bundle: what shipped, what was known, what was decided, what was enforced, where it ran. CRA readiness checks name the requirement each gap maps to. The audit trail records every change with who, what and why — in a database you operate.
Capabilities
What is in the box
Security pipeline
Checkout, SBOM, secrets, IaC, SAST and dependency scanning as one pipeline per service, with a policy gate at the end. Run it from the UI, the CLI or your CI.
Vulnerability and risk
Findings correlated against SBOMs and deployments; risk scored by CVSS, exploitation, exposure and criticality. The same CVE is Medium in development and Critical when internet-facing in production.
Keyless registries
Pull from and push to ECR, ACR and Artifact Registry with workload identity federation — the cell holds no long-lived registry secrets. Docker Hub, GHCR and any v2 registry work with tokens.
Managed and self-hosted runners
Every cell ships managed runners inside the cluster, so pipelines run on day one. Add your own runner pools for private networks and other clusters; jobs are routed by tags and pools.
Remediation and SLAs
A fix-first queue ordered by risk, SLA clocks per severity, owners, and issues created in GitHub, GitLab, Bitbucket or Jira with status kept in sync.
CLI, CI tokens and MCP
Every action in the UI is a matelot command. CI authenticates with signed, scoped tokens — never bearer secrets. The MCP server lets an AI assistant query the platform with your permissions.
Hierarchical RBAC and audit
Organization → workspace → team → project → service → environment, with roles that inherit downward, SSO through the cell's own Keycloak, and an audit trail on every mutation.
Built to be operated by you
One Helm chart installs the whole cell. Scheduled backups to a volume and your S3 bucket, a tested restore path, upgrades that roll only the application pods, usage per month, and a CLI for everything.
Integrations
Connects to what you already run
Only what exists today — nothing on this list is a roadmap item.
Pricing
Per user, self-hosted
Every tier is the same software, installed in your cluster from the same chart. Tiers differ in team size, integrations and support. Prices are per user and month, billed annually.
A small team getting its products under control.
- Full platform: SBOM, pipelines, policies and gates, CRA readiness
- Up to 5 users
- Managed runners in the cell
- Community support in GitHub Discussions
Several teams, self-hosted runners, issue trackers and SLAs.
- Everything in Free
- Unlimited users
- Self-hosted runner pools
- Jira / GitHub / GitLab / Bitbucket issues and SLAs
- Signed evidence bundles
- Priority e-mail support
Subsidiaries, MSSP use and a support contract.
- Everything in Premium
- Organization hierarchy for subsidiaries and MSSP customers
- SSO / SAML and MFA through the cell's Keycloak
- Support with response-time SLA, onboarding and upgrade assistance
- Early access to releases and roadmap input
Indicative — tiers and prices will be confirmed with the first commercial release. No licence key is required to install today; entitlements arrive with the commercial release and existing cells keep working.
Frequently asked
Questions we hear most often
docker compose up -d, five minutes, automatic HTTPS with a domain) or install the Helm chart in your Kubernetes cluster for production. A cell contains everything: API, worker, web app, managed runner, a container registry, Postgres, Redis and Keycloak. There is no hosted edition and no component that calls home.helm upgrade with the new chart version rolls only the application pods; the database, Keycloak, Redis and the registry keep running. Release notes with image digests are on GitHub.matelot mcp.