Cloudsmith
Cloudsmith is a Belfast-based cloud-native SaaS platform that secures, distributes, and governs software packages, containers, and AI/ML models across 30+ formats for Fortune 500 and Global 2000 enterprises via a 600+ edge PoP network.
- Company typePrivate
- Founded2016
- HeadquartersBelfast, United Kingdom
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What Cloudsmith does
Cloudsmith is a Belfast-headquartered, cloud-native SaaS artifact management platform founded in 2016 that provides a single source of truth for software packages, containers, ML models, and datasets across 30+ formats. The platform is delivered as a fully-managed service over a global edge network spanning 600+ points of presence with 99.99% uptime SLAs, multi-region redundancy, and end-to-end encryption. Core platform capabilities include the Enterprise Policy Manager (policy-as-code using OPA Rego), continuous package enrichment with vulnerability data from 15+ sources (NVD, OSV.dev, EPSS, OpenSSF), early-access AI/ML artifact support including Hugging Face, an MCP Server enabling AI-agent interaction, and zero-trust identity via OIDC, SCIM, and SAML/SSO. Developer experience is API-first with a REST API, OpenAPI 2.0 bindings in Go/Java/Python/Ruby, a CLI, a Terraform Provider, and open-source Migration Toolkit.
The company sells primarily to Fortune 500 and Global 2000 enterprises in banking, fintech, insurtech, aviation, AI/ML, and large software/technology organizations, with named customers including PagerDuty, Shopify, Kong, ConstructConnect, Thrivent, Diligent, Aer Lingus, Netskope, Carta, Font Awesome, Express VPN, and HP. GTM combines enterprise field sales (with prominent "Book a demo" CTAs, named VP of Sales and Customer Success, and shared Slack channels for Ultra and Enterprise customers) with a self-serve free trial and developer-led adoption via comprehensive documentation. Revenue is generated through tiered SaaS subscriptions (self-serve, Ultra, and Enterprise plans) with usage-based elements, plus included migration and professional services for switching from JFrog Artifactory, Sonatype Nexus, GitHub Packages, and AWS CodeArtifact.
The company has raised over $110M in outside funding across six rounds from Tiger Global, MMC Ventures, TCV (lead of both Series B and C), Insight Partners, Frontline Ventures, Techstart Ventures, Sorenson Capital, Shasta Ventures, Tapestry VC, Leadout Capital, and Amaranthine. Leadership comprises Co-Founders Alan Carson (CSO) and Lee Skillen (CTO), CEO Glenn Weinstein, CFO Mark O'Connor, General Counsel Dan Lascell, and a bench of functional VPs across sales, engineering, product, customer success, growth marketing, and design, with explicit positioning toward IPO-scale governance standards as of mid-2026.
Cloudsmith firmographics
Firmographics- Name
- Cloudsmith
- Legal name
- Cloudsmith Ltd
- Website
- https://cloudsmith.com
- Company type
- Private
- Founded year
- 2016
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Short description
- Cloudsmith is a Belfast-based cloud-native SaaS platform that secures, distributes, and governs software packages, containers, and AI/ML models across 30+ formats for Fortune 500 and Global 2000 enterprises via a 600+ edge PoP network.
- Ownership category
- akta.pro rank
Cloudsmith industry classification
Industry- Product category
- Cloud Artifact Management
- NAICS
- Software Publishers (51321), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI)
- akta.pro secondary industries
- Cloud Data Security (DSPM, Cloud DLP) (HDADADAJ), Backup, Disaster Recovery & Data Protection for Private Cloud (HDABABAJ), Cloud DR, Backup & Business Continuity (BPAEACAJ), Cloud Data Warehouses (HDAEABAA)
Keywords
Where Cloudsmith is headquartered
LocationHeadquarters
- HQ city
- Belfast
- HQ country
- United Kingdom
- HQ region
- Europe
Offices1 record
Markets served
Cloudsmith business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Enterprise SaaS subscriptions: Fully-managed cloud-native SaaS subscriptions with tiered plans including 'Ultra' and 'Enterprise' plans offering custom SLAs, shared Slack channels, dedicated customer success managers, white-glove migration support, and professional services included. Target customers are Fortune 500 and Global 2000 enterprises.
- Usage-based / consumption pricing: While base pricing is subscription-based, AWS CodeArtifact comparison page indicates Cloudsmith's pricing is competitive for full-featured deployments and is priced higher at low volumes than CodeArtifact, suggesting usage/scale-based pricing elements (storage, bandwidth, downloads). Free trial available; free egress from any CI/CD tool is included.
- Migration and professional services: Professional services included for Ultra and Enterprise customers covering migrations from JFrog Artifactory, Sonatype Nexus, GitHub Packages, and AWS CodeArtifact via a dedicated migration engineer, custom onboarding, and bespoke support plans.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Pay-as-you-go | Free trial / self-serve tier |
| Subscription | Annual | Ultra and Enterprise plans (quote-based) |
| Hybrid | Multi-year contract | Multi-year / scale-based enterprise contracts |
Go-to-market motion4 records
Distribution channels4 records
Marketing channels10 records
Cloudsmith product offering
Product offeringCore offering
Cloudsmith is a fully-managed, cloud-native artifact management platform that serves as a single source of truth for software packages, containers, ML models, and datasets across 30+ formats. It secures the software supply chain via continuous vulnerability enrichment and OPA Rego policy enforcement, and distributes artifacts globally through a 600+ edge PoP network. Customers buy it as a SaaS subscription on Ultra and Enterprise tiers with bundled migration support and dedicated customer success.
Product overview
Cloudsmith is a single, unified, fully-managed cloud-native artifact management platform for the AI-driven software supply chain, organized as a core platform with multiple integrated product modules. The Cloud-Native Artifact Management platform serves as the single source of truth for 30+ package formats, supported by the Software Supply Chain Security module for vulnerability scanning, OPA Rego policy enforcement, and threat intelligence; Global Software Distribution for delivery via a 600+ edge PoP network; Observability and Governance for end-to-end visibility, audit trails, and MCP-server enabled AI-agent integration; Cloudsmith Broadcasts for branded distribution portals; the Enterprise Policy Manager for policy-as-code automation; the Hugging Face Registry for AI/ML model and dataset management; and developer tooling including the Cloudsmith CLI, Terraform Provider, and Migration Toolkit for switching from JFrog Artifactory, Sonatype Nexus, GitHub Packages, or AWS CodeArtifact.
Differentiator
Problem solved
Functional benefit
Products and services
- Cloud-Native Artifact Management
Quantifiable outcome
- 50% cost savings on artifact management
- +9 more outcomes
Companies that use Cloudsmith
Customer profileNamed customers18 records
Segments4 records
Ideal customer profiles4 records
Cloudsmith technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration37 records
AI capability10 records
Feature8 records
Cloudsmith partnerships and signals
Strategic signalScale indicators14 records
Recent moves6 records
Expansion highlights7 records
Cloudsmith competitors and assessment
Company assessmentDirect peers
- JFrog: JFrog is the dominant direct competitor via JFrog Artifactory, the leading self-hosted and cloud-hosted artifact repository. It is Cloudsmith's primary head-to-head rival in enterprise artifact management, with ConstructsConnect cited as a customer switching from JFrog to Cloudsmith.
- Sonatype: Sonatype operates Nexus Repository, the legacy artifact management incumbent and a direct peer in both repository and software supply chain security (via Sonatype Lifecycle). Cloudsmith explicitly targets Sonatype Nexus migrations as a core switching motion.
Broad incumbents
- GitHub Packages: GitHub Packages is a bundled artifact registry offering tied to GitHub Actions and the broader GitHub platform. Cloudsmith competes on format breadth (30+ vs ~6), pricing transparency (free egress), and policy/governance depth that GitHub Packages does not natively provide.
- AWS CodeArtifact: AWS CodeArtifact is the AWS-native artifact repository service and a primary alternative for AWS-resident workloads. Cloudsmith competes on multi-region architecture by default, broader format support (8 vs 30+), and enterprise policy/edge distribution.
- GitLab Container Registry: GitLab bundles a container and package registry inside its DevOps platform. As a broad incumbent it competes with Cloudsmith for artifact management mindshare in enterprises already standardized on GitLab for source control and CI/CD.
- Docker Hub: Docker Hub is the de facto public container registry, and Docker partnered with Cloudsmith on Docker Hardened Images. It serves overlapping container registry use cases but lacks Cloudsmith's universal format breadth and enterprise policy/edge distribution.
Emerging players
- Chainguard: Chainguard focuses on hardened container images and software supply chain security. It is integrated with Cloudsmith (Chainguard Images listed as a partner integration) and competes for overlapping enterprise supply chain security budgets.
- Anchore: Anchore provides software composition analysis, SBOM generation, and container security — adjacent to Cloudsmith's supply chain security module. It overlaps in vulnerability scanning and policy enforcement, especially in regulated enterprises.
- Kusari: Kusari focuses on software supply chain security with SBOM and dependency firewall capabilities. Listed as a partner integration for Cloudsmith, it competes for overlapping security-budget share rather than core artifact storage.
Others
- Cloudflare R2 / Workers: Cloudflare's edge network and R2 object storage underpin Cloudsmith's 600+ PoP delivery model. As infrastructure/edge providers they are adjacent ecosystem enablers rather than direct competitors, but they shape Cloudsmith's underlying distribution economics.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
Cloudsmith social profiles
Digital presenceCloudsmith compliance and trust
Trust signalCompliance6 records
Cloudsmith financial estimates
Financial estimateRevenue estimate
Valuation estimate
Cloudsmith leadership team
Management profileNumber of profiles
Profiles13 records
Cloudsmith funding detail
Funding detailFunding overview
Funding rounds6 records
Investors11 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Cloudsmith M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Cloudsmith
What does Cloudsmith do?
Cloudsmith is a fully-managed, cloud-native artifact management platform that serves as a single source of truth for software packages, containers, ML models, and datasets across 30+ formats. It secures the software supply chain via continuous vulnerability enrichment and OPA Rego policy enforcement, and distributes artifacts globally through a 600+ edge PoP network. Customers buy it as a SaaS subscription on Ultra and Enterprise tiers with bundled migration support and dedicated customer success.
Is Cloudsmith a public or private company?
Cloudsmith is a private company. It is classified as venture growth investor backed and is currently operating.
When was Cloudsmith founded?
Cloudsmith was founded in 2016. It employs 101 to 250 people.
Where is Cloudsmith based?
Cloudsmith is headquartered in Belfast, United Kingdom, in the Europe region.
How does Cloudsmith make money?
Three revenue lines are on record. Enterprise SaaS subscriptions are the primary driver. The others are usage-based / consumption pricing and migration and professional services.
Who are Cloudsmith's main competitors?
Direct peers on record are JFrog and Sonatype. Broad incumbents are GitHub Packages, AWS CodeArtifact, GitLab Container Registry and Docker Hub. Emerging players are Chainguard, Anchore and Kusari. Cloudflare R2 / Workers is listed as an others.
Does Cloudsmith have an API?
Yes. Cloudsmith offers a first-class, rich REST API enabling automation and integration. Authentication via Service Accounts and API keys, with OIDC support for short-lived tokens in CI/CD. OpenAPI 2.0-compliant SDK bindings available in Go, Java, Python, and Ruby. Includes a comprehensive Logs API for searching and querying data, webhooks for event-based triggers, and a dedicated CLI. Developer documentation is at docs.cloudsmith.com/api.
What industry is Cloudsmith in?
Cloudsmith's product category is Cloud Artifact Management. Its primary akta.pro industry code is HDABAHAI, Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC), with a secondary code of HDADADAJ, Cloud Data Security (DSPM, Cloud DLP). Its NAICS code is 51321 and its SIC code is 7372.