TripleCheck

What TripleCheck does

TripleCheck GmbH is a privately held German software company founded in Darmstadt in 2013 that provides forensic software composition analysis (SCA) and source code plagiarism detection for enterprise software vendors operating in regulated industries. Its flagship product, the Xray engine, is built in Java with no third-party dependencies and operates entirely offline on either customer-supplied hardware or TripleCheck's own air-gapped infrastructure. The engine matches code against a proprietary offline archive spanning approximately 2.5 petabytes of publicly available software, containing 1.9 billion file fingerprints and 1.2 billion code snippets across 55 programming languages, and performs both SHA1 exact fingerprint matching and binary similarity detection. TripleCheck is the only provider of deep forensic SCA technology fully based in Europe and was ranked by NCC Group (UK) as one of the top three SCA technologies globally.

TripleCheck generates revenue through two primary streams. The first is professional audit services priced at 6,800 EUR per block of up to 500,000 lines of code, delivered by a dedicated two-person team (technical auditor and legal advisor) and including license compatibility assessment, plagiarism detection, compliance certificate, and a two-year warranty. The second is an annual on-premises Xray tooling license at 28,200 EUR with unlimited files, CPUs, and products, designed for customers that cannot transfer software off-site. Engagements are sold direct to enterprise buyers in telecom, aerospace, and transportation industries, with payment on net-45 terms and quotes available in EUR, GBP, or USD. On-premises audits are available for high-security customers, requiring EU/UK nationals on audit teams and incurring per-diem travel costs.

The company is founder-led by Managing Director Max Brito, remains bootstrapped with no disclosed institutional funding, and operates from three European locations — Darmstadt (headquarters), London (training academy), and Madrid (legal operations) — alongside a US phone contact for North American outreach. TripleCheck markets primarily through an educational blog covering GPL compliance and licensing topics and direct enterprise sales engagement, with no public reseller or marketplace channel.

Name

TripleCheck

Legal name

TripleCheck GmbH

Website

https://triplecheck.tech

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

1–10 employees

Short description

TripleCheck is a German software composition analysis company that provides offline forensic code auditing and plagiarism detection for enterprise software vendors operating in regulated industries such as telecom, aerospace, and transportation.

Ownership category

akta.pro rank

Product category

Software Composition Analysis (SCA) / Open Source License Compliance

NAICS

Testing Laboratories and Services (54138)

SIC

Services-Testing Laboratories (8734)

akta.pro primary industry

Third-Party Risk, Vendor Due Diligence & Supply Chain Compliance (BPAEAPAG)

akta.pro secondary industries

Third-Party/Vendor Risk Management (TPRM) & Due Diligence (BPAKADAH), Corporate Due Diligence & Third-Party Risk Investigations (BPAKAEAC)

Keywords

• Software composition analysis
• License compliance auditing
• Source code plagiarism detection
• Open source compliance
• Software bill of materials

Headquarters

HQ city

Darmstadt

HQ country

Germany

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Operations, Marketing or Sales

Revenue model

1. Software Audit Services: Professional software composition analysis (SCA) audit services priced per block of 500,000 lines of code. Includes license compatibility assessment, plagiarism detection, remediation support, compliance certificate, and a two-year warranty. Average audit time per block: 2-6 calendar weeks.
2. On-Premises Tooling License (Xray): Annual license for installing and running TripleCheck Xray tooling within customer secure environments where the audited software cannot leave the premises. Fixed annual price with unlimited files, CPUs, and products. Includes full support and updates. License is confined to customer premises (excludes contractors and customers). Output can be redistributed.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels3 records

Core offering

TripleCheck sells forensic software composition analysis (SCA) services and offline tooling that identify third-party components, detect source-code plagiarism, and audit license compatibility inside enterprise software products. Customers receive a software inventory (Bill of Materials), license conflict remediation, an official compliance certificate, and a two-year warranty. The Xray tool can also be licensed annually for on-premises installation within customer secure environments.

Product overview

TripleCheck offers a single-product portfolio centered on its flagship Xray forensic software discovery platform, supplemented by professional audit services and an offline estimator tool. Xray (currently in its second generation) is the core technology that performs plagiarism detection and license compliance analysis offline, while the Open Source Audit service provides end-to-end professional support including inventory creation, license compatibility assessment, conflict resolution, and a two-year warranty. The Estimator tool enables customers to generate code metrics for pricing without transmitting identifiable code. All products emphasize offline operation, privacy, and European jurisdiction.

Differentiator

Problem solved

Functional benefit

Brands

• Xray: The main forensic software composition analysis tool developed by TripleCheck for identifying third-party items, plagiarism, and license compliance in source code. Currently in its second generation (2.x.x).

Products and services

• TripleCheck Xray Forensic software discovery tool that detects licenses, plagiarism, and generates software inventory lists (Bill of Materials). Runs offline against a proprietary 2.5-petabyte archive of publicly available software with 1.9 billion file fingerprints and 1.2 billion code snippets across 55 programming languages. Currently in its second generation (Xray 2.x.x).
• Open Source Audit Service Professional software composition analysis service priced at 6,800 EUR per 500,000 lines of code. A dedicated audit team (technical auditor + legal advisor) identifies third-party components, audits license compatibility, prioritizes and solves license conflicts with the customer's development team, prepares the software as a distribution package, and issues an official compliance certificate with a two-year warranty. Average audit time per block: 2–6 calendar weeks.
• Xray On-Premises Tooling License Annual subscription (28,200 EUR/year) that licenses Xray tooling for installation inside customer secure environments where audited software cannot leave the premises. Includes unlimited files, CPUs, and products, plus full support and updates; license scoped to customer premises (excludes contractors and customers); output can be redistributed.
• TripleCheck Estimator Offline command-line tool (triplecheck-estimator.exe) that counts lines of code, performs basic surface-level license detection, and generates a compact data string (e.g., '1v0i1-iz-24fj-bc-7m') for secure email transmission when requesting a price quote. Does not modify files or use any network connection.
• TripleCheck Xray 2.x.x (Second Generation) Second generation of the Xray forensic software composition analysis engine, featuring 6x deeper plagiarism detection vs. the prior version, horizontal scaling across workstations/servers on the same network, automatic inventory generation in SPDX/Excel/HTML formats, a full desktop UI that reduced average manual audit time from 8 hours to ~3 hours, completeness checking for dependencies in source/resource/executable files, and original license terms extraction for each third-party component.

Quantifiable outcome

• Manual audit effort reduced from ~8 hours to ~3 hours per project (62.5% reduction) using Xray 2.x.x desktop UI
• +3 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature6 records

Scale indicators6 records

Recent moves5 records

Expansion highlights5 records

Broad incumbents

• Synopsys Black Duck: Market-leading Software Composition Analysis and open source license compliance platform acquired by Synopsys. Competes with TripleCheck on SCA depth and license-compliance reporting, but sells a broad, integrated AppSec portfolio to enterprise and embedded buyers.
• Snyk Open Source: Developer-security platform with an SCA product (Snyk Open Source) that detects vulnerable and license-noncompliant open source dependencies. Competes with TripleCheck on open-source risk identification, embedded inside a broader DevSecTool portfolio.
• Revenera (formerly Flexera Software Supply Chain): Software composition analysis and license-compliance business spun out from Flexera in 2024. Direct competitor to TripleCheck on SCA, open source license audits, and SBOM delivery to enterprise software vendors.
• Flexera (Software Composition Analysis): IT asset management and software composition analysis vendor (incorporating the former Palamida). Competes with TripleCheck on enterprise license-compliance audits and SBOMs, alongside a broader software-asset-management portfolio.

Direct peers

• Mend (formerly WhiteSource): SCA and open source license compliance platform focused on enterprise software supply-chain risk. Closely comparable to TripleCheck on license-conflict detection, SBOM generation, and remediation workflows, sold as a SaaS subscription.
• FOSSA: SCA and license-compliance SaaS targeting enterprise software teams. Direct competitor to TripleCheck on third-party component detection, license conflict identification, and SBOM/BOM generation, with a more SaaS-native delivery model.
• nexB ScanCode Toolkit: Open-source license and provenance scanner (ScanCode) used to detect third-party code, snippets, and licenses in codebases. Comparable to TripleCheck on detection methodology (fingerprinting, snippet provenance) and target use case (open source license compliance).

Others

• OpenChain (Linux Foundation): Open-source license-compliance standard managed by the Linux Foundation. Comparable to TripleCheck as part of the same compliance ecosystem, setting process standards that complement TripleCheck's forensic audit and warranty offering.

Emerging players

• JFrog Xray: Software composition and security analysis module of the JFrog platform (notably sharing the 'Xray' product name with TripleCheck's tool). Overlaps with TripleCheck on third-party component scanning, although JFrog Xray is positioned primarily as a vulnerability and license scanner inside an artifact-management suite.
• ClearlyDefined: Open-source project harvesting license and provenance metadata at scale. Overlaps with TripleCheck on identifying licenses and origins of third-party components, but operates as an open data clearinghouse rather than a forensic audit service.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/triplechecked

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about TripleCheck