SettleTop
SettleTop is a Newburyport, MA-based software company that provides SBOM and software supply chain risk management for U.S. defense agencies and large enterprises, and now operates the CodeRoot platform for AI-assisted code provenance and governance.
- Company typePrivate
- Founded2020
- HeadquartersBoston, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What SettleTop does
SettleTop, Inc. is a Newburyport, Massachusetts-based private software company that builds tools for software supply chain risk management and, more recently, AI-assisted code provenance. The company sells two interlocking product lines: a legacy SBOM and software-quality suite — including the SetVIEW scorecard platform, SetIntel continuous monitoring, and an SBOM Vendor Management module that supports onboarding, enrichment, compliance assessment (against NTIA, CISA, CycloneDX, SPDX, SWID), and continuous monitoring — and a newer AI provenance platform branded CodeRoot, launched September 2025, that captures the origin and lineage of AI-assisted and human-written code into a semantic graph and exposes the data through a conversational interface (supporting Claude). The CodeRoot offering is distributed both as an enterprise/government SaaS subscription and as a free Visual Studio Code extension backed by GitHub integration, enabling a product-led land motion in addition to direct enterprise and federal field sales.
SettleTop serves two primary customer segments: U.S. Department of Defense and federal government agencies (US Air Force, AFWERX, Cloud One, BES Eagle Eye, and government contractors such as Perspecta) where SBIR Phase I/II contracts, CMMC, and NTIA compliance drive adoption, and large commercial enterprises — including SolarWinds — that need SBOM governance and visibility into AI-assisted development. The company is quote-based across an enterprise and government subscription model with annual billing, supplemented by professional services for supply chain risk assessment, Open Source Scans, and policy support. Distribution combines direct field sales, a government channel partnership with Alaska Northstar Resources, and a self-serve developer motion through the VS Code marketplace; SettleTop also maintains a multi-vendor AI tool partner ecosystem. The company is privately held, was founded circa 2019-2020, has 11-50 employees, and has raised a disclosed $1.25M SBIR Phase II award from AFWERX plus an undisclosed early-stage investment from SNL Partners.
SettleTop firmographics
Firmographics- Name
- SettleTop
- Legal name
- SettleTop, Inc.
- Website
- https://settletop.com
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- SettleTop is a Newburyport, MA-based software company that provides SBOM and software supply chain risk management for U.S. defense agencies and large enterprises, and now operates the CodeRoot platform for AI-assisted code provenance and governance.
- Ownership category
- akta.pro rank
SettleTop industry classification
Industry- Product category
- Software Supply Chain Security
- NAICS
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (51821)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Data Platform (Unified Data & Analytics) Suites (HDAEABAD)
Keywords
Where SettleTop is headquartered
LocationHeadquarters
- HQ city
- Boston
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
SettleTop business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- SaaS Platform Subscription (SetView / CodeRoot Platform): SettleTop sells its software quality scorecard and provenance platform as an enterprise SaaS subscription. The platform provides risk scorecards, SBOM management, AI provenance tracking, and software intelligence dashboards on a recurring subscription basis. Pricing is quote-based for enterprise accounts.
- SBOM Vendor Management (SBOM as a Service): Dedicated SBOM management and vendor management solution sold as a service. Includes SBOM onboarding, enrichment, compliance assessment, and continuous monitoring through a single dashboard view. Delivered as a cloud-hosted managed service with subscription pricing.
- Professional Services and Consulting: SettleTop provides supply chain risk assessment, policy support, and consulting services. The company's Open Source Scans include dedicated Audit Services for assessment and remediation of known vulnerabilities. These are delivered as professional services engagements alongside the software platform.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Free Developer Tier (Marketplace) |
| Subscription | Annual | Enterprise / Government Platform (Quote-based) |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels7 records
SettleTop product offering
Product offeringCore offering
SettleTop builds and sells the CodeRoot platform, a semantic data platform that captures the provenance and lineage of AI and software data from vibe coding through AI agentic agents. The platform produces a system-level graph connecting provenance data with risk, compliance, ROI, and governance insights, and includes a conversational AI Data Provenance Analyst for querying the data natively within IDEs such as Visual Studio Code and GitHub repositories.
Product overview
SettleTop is an AI data provenance and intelligence company offering a unified platform with CodeRoot as its core product. The platform provides provenance tracking and intelligence across the AI development lifecycle through a modular architecture combining the CodeRoot semantic data platform, Visual Studio Code extension, SBOM Management module, and specialized solutions for AI Risk, AI Governance, ROI measurement, and Supply Chain Risk Management. The platform enables organizations to record, track, and manage all AI data with capabilities spanning ingestion, inventory, intelligence, and interaction.
Differentiator
Problem solved
Functional benefit
Brands
- CodeRoot: A software provenance platform for AI-assisted code development that provides record of origin, software intelligence reports, and seamless integration with IDEs like Visual Studio Code and GitHub repositories.
- SBOM Vendor Management Solution
- SetVIEW Platform
- SetIntel Platform
Products and services
- CodeRoot Platform A semantic data platform that records the origin and lineage of all AI activities — from vibe coding to AI agentic agents — and provides intelligence on productivity, risk, ROI, and governance posture. Sold as an enterprise SaaS subscription and free VS Code extension.
- SBOM Management AIBOM and SBOM management solution enabling centralized onboarding, enrichment, compliance assessment, and continuous monitoring of AI Agentic BOMs and SBOMs across the software supply chain, including SetIntel Platform risk alerts and remediation recommendations.
- SBOM Vendor Management Solution Manages SBOMs provided by external third-party vendors; assesses completeness and accuracy of vendor SBOMs, verifies risk/security/compliance of included components, and ensures vendor adherence to contractual and regulatory requirements (CISA, NTIA, FASCSA). Delivered as a cloud-hosted managed service.
- Professional Services and Consulting Supply chain risk assessment, policy support, and consulting services including dedicated Audit Services for the assessment and remediation of known vulnerabilities, delivered as professional services engagements alongside the software platform.
- SetVIEW Platform (Software Risk Scorecard) Software risk scorecard platform that provides comprehensive software risk assessment and SBOM as a service solutions for commercial and government customers.
Quantifiable outcome
- 62% of organizations experienced a software supply chain attack in 2021, rising to 91% in recent surveys — driving demand for SettleTop's provenance and SBOM solutions.
- +4 more outcomes
Companies that use SettleTop
Customer profileNamed customers6 records
Segments4 records
Ideal customer profiles4 records
SettleTop technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration3 records
AI capability8 records
Feature8 records
SettleTop partnerships and signals
Strategic signalPartnerships
Three partnerships are on record, tiered core and flagship.
- AFWERX / Air Force Research Laboratory (AFRL)coreSettleTop was selected by AFWERX for a SBIR Phase II contract to develop a software contributor and social network mapping platform for the Department of the Air Force. AFRL and AFWERX partnered to streamline the SBIR/STTR process. The contract was focused on addressing the most pressing challenges in the Department of the Air Force's software supply chain security.
- Alaska Northstar ResourcescoreSettleTop partnered with Alaska Northstar Resources to win and deliver a United States Air Force contract for software quality scanning for Cloud One programs. Alaska Northstar Resources acted as a channel partner enabling SettleTop's SetVIEW platform to be deployed within the US Air Force environment.
- AI-Assisted Development Tool Vendors (Partner Ecosystem)flagshipSettleTop (CodeRoot.ai) partners with the world's most innovative AI-assisted development tools spanning the entire AI development lifecycle — Create, Test, Deliver, and Govern. These partnerships bring provenance, trust, and governance to AI development tools. SettleTop positions itself as a neutral provenance platform that makes AI tools stronger rather than replacing them. The company maintains a visual partner ecosystem featuring leading AI platforms and actively recruits new partners through a partnership inquiry form. A 2025 partner logo strip features multiple leading AI brands.
Scale indicators5 records
Recent moves6 records
Expansion highlights5 records
SettleTop competitors and assessment
Company assessmentBroad incumbents
- JFrog: Artifactory/Xray platform with native SBOM generation, binary security, and software supply chain capabilities. Overlaps with SettleTop's SBOM management and federal buyer base (DoD, federal contractors).
- Snyk: Developer security platform with broad SCA, SBOM, and code security capabilities. Competes with SettleTop across the SBOM and secure development workflow categories; broader portfolio and substantially greater scale.
- GitLab: DevSecOps platform with built-in SBOM generation, dependency scanning, and compliance reporting. Overlaps with SettleTop's SBOM vendor management and software supply chain risk offerings as a bundled, single-vendor alternative.
- GitHub Advanced Security: Native SBOM, Dependabot, and code scanning inside the GitHub platform — the default supply chain security choice for many enterprises. Competes with SettleTop's SBOM and CodeRoot GitHub-integrated provenance by bundling features into an existing developer workflow.
Direct peers
- Anchore: SBOM and software supply chain security platform purpose-built for federal compliance (FedRAMP). Closest comparable to SettleTop in targeting DoD and federal SBOM requirements as a standalone vendor.
- Sonatype: The leading independent SBOM and software supply chain security platform (Nexus IQ, Lifecycle). Most direct competitor to SettleTop's SetVIEW/SetIntel SBOM and vendor management offering, serving the same enterprise and federal buyer with the same product category.
- Black Duck Software (Synopsys Software Integrity Group): Pioneer in SBOM and open-source software composition analysis, now part of Synopsys. SettleTop advisory board member Bill Ledingham is Black Duck's former CTO. Direct overlap in SBOM management, vendor SBOM assessment, and federal/commercial supply chain security buyers.
Emerging players
- Chainguard: Emerging leader in software supply chain security with a focus on hardened container images and provenance. Comparable to SettleTop's narrative around software provenance and supply chain integrity, particularly for cloud-native and federal customers.
- Cyera: AI-native data security and governance platform. While focused on data rather than code provenance, Cyera is the most analogous emerging player targeting AI governance and risk — adjacent category that may converge with SettleTop's AI provenance roadmap.
- Endor Labs: Startup focused on software supply chain security and dependency management with an SCA/SSDF posture. Targets enterprise development and security teams with overlap to SettleTop's developer-led SBOM and provenance narrative.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks7 records
Key highlights7 records
Customer concentration
SettleTop social profiles
Digital presenceSettleTop compliance and trust
Trust signalCompliance2 records
SettleTop financial estimates
Financial estimateRevenue estimate
Valuation estimate
SettleTop leadership team
Management profileNumber of profiles
Profiles10 records
SettleTop funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SettleTop M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SettleTop
What does SettleTop do?
SettleTop builds and sells the CodeRoot platform, a semantic data platform that captures the provenance and lineage of AI and software data from vibe coding through AI agentic agents. The platform produces a system-level graph connecting provenance data with risk, compliance, ROI, and governance insights, and includes a conversational AI Data Provenance Analyst for querying the data natively within IDEs such as Visual Studio Code and GitHub repositories.
Is SettleTop a public or private company?
SettleTop is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was SettleTop founded?
SettleTop was founded in 2020. It employs 11 to 50 people.
Where is SettleTop based?
SettleTop is headquartered in Boston, United States, in the North America region.
How does SettleTop make money?
Three revenue lines are on record. SaaS Platform Subscription (SetView / CodeRoot Platform) is the primary driver. The others are SBOM Vendor Management (SBOM as a Service) and professional Services and Consulting.
Who are SettleTop's main competitors?
Broad incumbents on record are JFrog, Snyk, GitLab and GitHub Advanced Security. Direct peers are Anchore, Sonatype and Black Duck Software (Synopsys Software Integrity Group). Emerging players are Chainguard, Cyera and Endor Labs.
Does SettleTop have an API?
No public API is recorded for SettleTop.
What industry is SettleTop in?
SettleTop's product category is Software Supply Chain Security. Its primary akta.pro industry code is HDAEABAD, Data Platform (Unified Data & Analytics) Suites. Its NAICS code is 51821 and its SIC code is 7372.