Software Package Data Exchange

Name

Software Package Data Exchange

Legal name

The Linux Foundation

Website

https://spdx.org

Company type

Private

Operating status

Operating

Headcount range

101–250 employees

Ownership category

akta.pro rank

Product category

Open Source Software Compliance Standards

NAICS

Software Publishers (513210)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

DevSecOps & Supply Chain Security (DevOps toolchain security) (BPAEAKAI)

Keywords

• Software bill of materials
• Open source licensing
• Supply chain security
• Software compliance standards
• SBOM specification

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Others

Distribution channels3 records

Marketing channels4 records

Core offering

Software Package Data Exchange (SPDX) develops and maintains the SPDX Specification, a freely available international open standard (ISO/IEC 5962:2021) for representing software bill of materials (SBOMs) and other AI, data, and security references supporting risk management use cases. Its core deliverables are the SPDX Specification itself, the SPDX License List of 600+ standardized license identifiers, and SPDX Tools used to create, validate, and process SPDX documents.

Product overview

Software Package Data Exchange (SPDX) is an open standards organization that maintains the SPDX Specification, an internationally certified open standard (ISO/IEC 5962:2021) for representing Software Bill of Materials (SBOMs) and related metadata. The product portfolio centers on the SPDX Specification as the core product, supplemented by the SPDX License List and SPDX Tools. The specification supports multiple specialized profiles including Security, Licensing, AI, Lite, Build, Core, Software, Dataset, Hardware, Services, and Supply Chain, enabling organizations to document and manage software components, licensing information, and related risk data across diverse use cases.

Differentiator

Problem solved

Functional benefit

Products and services

• SPDX Specification An open international standard (ISO/IEC 5962:2021) for representing systems with software components in Software Bill of Materials (SBOMs) and other AI, data, and security references supporting risk management use cases. For organizations that need to document and exchange software component metadata across supply chains.
• SPDX License List An integral part of the SPDX Specification containing a list of commonly found licenses and exceptions used in free and open or collaborative software, data, hardware, or documentation. Includes standardized short identifiers, full names, license texts, and canonical permanent URLs for 600+ licenses and exceptions. For compliance teams, legal counsel, and developers identifying license obligations.
• SPDX Tools Workgroup-maintained reference tools and resources that enable users to create, validate, and process SPDX documents and SBOMs. For developers and integrators implementing the SPDX Specification.

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

37 partnerships are on record, tiered core and minor.

• The Linux FoundationcoreStrategic or Co-development PartnerSPDX is a Linux Foundation Collaborative Project hosted under the Linux Foundation Projects umbrella, receiving governance support, infrastructure, and operational framework.
• Amazon Web Services (AWS)coreStrategic or Co-development PartnerAWS is listed as a supporter of SPDX, contributing to the development and adoption of the open standard for software bill of materials.
• GooglecoreStrategic or Co-development PartnerGoogle is listed as a supporter of SPDX, contributing to the development and adoption of the open standard.
• MicrosoftcoreStrategic or Co-development PartnerMicrosoft is listed as a supporter of SPDX, contributing to the development and adoption of the open standard.
• Intel CorporationcoreStrategic or Co-development PartnerIntel is listed as a supporter of SPDX, contributing to hardware-related aspects of the specification.
• Red HatcoreStrategic or Co-development PartnerRed Hat is listed as a supporter of SPDX, contributing to open source software supply chain standards.
• IBMcoreStrategic or Co-development PartnerIBM is listed as a supporter of SPDX, contributing to enterprise software compliance standards.
• ArmcoreStrategic or Co-development PartnerArm is listed as a supporter of SPDX, contributing to hardware bill of materials standards.
• SiemenscoreStrategic or Co-development PartnerSiemens is listed as a supporter of SPDX, contributing to industrial software supply chain standards.
• SAPcoreStrategic or Co-development PartnerSAP is listed as a supporter of SPDX, contributing to enterprise software compliance.
• CiscocoreStrategic or Co-development PartnerCisco is listed as a supporter of SPDX, contributing to networking and software supply chain standards.
• VMwarecoreStrategic or Co-development PartnerVMware is listed as a supporter of SPDX.
• AnchorecoreTechnology or IntegrationAnchore is listed as a supporter and provides tools that integrate with SPDX for container security and compliance.
• SnykcoreTechnology or IntegrationSnyk is listed as a supporter and provides security scanning tools that support SPDX format for vulnerability management.
• SonatypecoreTechnology or IntegrationSonatype is listed as a supporter and provides software supply chain security tools supporting SPDX.
• SynopsyscoreTechnology or IntegrationSynopsys is listed as a supporter and provides software testing tools that support SPDX standards.
• FOSSAcoreTechnology or IntegrationFOSSA is listed as a supporter and provides open source compliance tools that integrate with SPDX.
• Eclipse FoundationcoreStrategic or Co-development PartnerEclipse Foundation is listed as a supporter of SPDX, contributing to open source standards development.
• MITREcoreStrategic or Co-development PartnerMITRE is listed as a supporter of SPDX, contributing to security and vulnerability standards.
• BoschcoreStrategic or Co-development PartnerBosch is listed as a supporter of SPDX, contributing to industrial IoT and automotive software standards.
• HuaweicoreStrategic or Co-development PartnerHuawei is listed as a supporter of SPDX.
• Hewlett Packard EnterprisecoreStrategic or Co-development PartnerHPE is listed as a supporter of SPDX.
• Wind RivercoreStrategic or Co-development PartnerWind River is listed as a supporter of SPDX, contributing to embedded software standards.
• Palo Alto NetworkscoreStrategic or Co-development PartnerPalo Alto Networks is listed as a supporter of SPDX for security standards.
• RISC-V InternationalcoreStrategic or Co-development PartnerRISC-V is listed as a supporter of SPDX for hardware specification standards.
• Yocto ProjectcoreStrategic or Co-development PartnerYocto Project is listed as a supporter of SPDX for embedded Linux build systems.
• nexBcoreTechnology or IntegrationnexB is listed as a supporter and provides open source software composition analysis tools.
• EricssoncoreStrategic or Co-development PartnerEricsson is listed as a supporter of SPDX for telecommunications software.
• ScaniaminorStrategic or Co-development PartnerScania is listed as a supporter contributing to automotive software standards.
• CARIADminorStrategic or Co-development PartnerCARIAD is listed as a supporter contributing to automotive software standards.
• The Walt Disney CompanyminorStrategic or Co-development PartnerThe Walt Disney Company is listed as a supporter of SPDX.
• Sony GroupcoreStrategic or Co-development PartnerSony is listed as a supporter of SPDX, contributing to consumer electronics software standards.
• Texas InstrumentscoreStrategic or Co-development PartnerTexas Instruments is listed as a supporter of SPDX for semiconductor software standards.
• Xilinx (AMD)coreStrategic or Co-development PartnerXilinx (now part of AMD) is listed as a supporter of SPDX for FPGA software standards.
• OpenEulercoreStrategic or Co-development PartnerOpenEuler is listed as a supporter contributing to open source Linux ecosystem.
• CAICTminorStrategic or Co-development PartnerCAICT is listed as a supporter contributing to Chinese technology standards.
• Cybertrust JapanminorStrategic or Co-development PartnerCybertrust Japan is listed as a supporter contributing to Japanese market.

Recent moves6 records

Expansion highlights5 records

Regional players

• NTIA SBOM Working Group: NTIA's SBOM working group defines minimum SBOM fields and U.S. government expectations, directly influencing how SPDX and CycloneDX are used in U.S. federal supply chains.
• CISA (Cybersecurity and Infrastructure Security Agency): CISA shapes U.S. federal SBOM policy and references SPDX as one of the accepted formats, directly influencing adoption mandates for vendors serving U.S. government.

Emerging players

• Software Heritage: Software Heritage maintains a universal archive of source code and references SPDX for describing software origins, making it an adjacent peer in software provenance metadata.
• SLSA (Supply-chain Levels for Software Artifacts): SLSA is a security framework specifying supply chain integrity levels. It complements SPDX by providing the attestation layer that consumes SPDX-formatted SBOMs.
• Sigstore: Sigstore is a Linux Foundation project for signing and verifying software artifacts. It works alongside SBOM standards like SPDX and is increasingly referenced in the same supply chain security workflows.

Direct peers

• OWASP Foundation: OWASP is the parent foundation of CycloneDX and itself develops software security standards and tooling that overlap with SPDX's security profile.
• OpenSSF (Open Source Security Foundation): OpenSSF is a Linux Foundation-hosted initiative that develops supply chain security frameworks (SLSA, Sigstore) that intersect directly with SPDX's supply chain and security profiles.
• CycloneDX: CycloneDX, under OWASP, is the principal competing SBOM standard. Both target the same software supply chain transparency use case and compete for tooling, regulatory, and ecosystem adoption.
• OpenChain (Linux Foundation): OpenChain is a Linux Foundation project setting open source license compliance process standards. Both SPDX and OpenChain address software license compliance and are frequently co-referenced in enterprise compliance programs.
• in-toto: in-toto is a supply chain integrity framework providing attestation and verification that complements SPDX's SBOM data model; both address software supply chain assurance.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Software Package Data Exchange