EIDP

What EIDP does

EIDP, operating under the TrustEngine product brand, is an Amsterdam-headquartered developer platform founded in 2025. The company's core product, TrustEngine, is an API-first compliance automation platform that integrates with CI/CD pipelines (GitHub Actions, GitLab CI, ArgoCD) to automate regulatory compliance for software supply chains, specifically targeting the EU's CBW/NIS2, CRA, and DORA frameworks. The platform ingests CycloneDX-format SBOMs via a Python SDK or CLI, matches component hashes against CVE databases, applies VEX (Vulnerability Exploitability eXchange) filtering to eliminate false positives using runtime context, and outputs a cryptographically signed 'Compliance Passport' built on Sigstore and in-toto standards. The passport functions as a verifiable attestation artifact intended to be shared with enterprise procurement and risk teams in lieu of manual security questionnaires.

The business model is a freemium land-and-expand motion: developers sign up for a free Developer Tier to obtain an API key, while enterprise prospects are routed through a Book-a-Demo funnel. Revenue mechanics beyond the free tier are not publicly disclosed, but the dual track (developer bottom-up plus enterprise top-down) and explicit targeting of banks and large corporates suggest an intended path from individual developer adoption into enterprise-wide contracts. The platform differentiates on three axes: regulatory specificity for the EU market, cryptographic verifiability of compliance artifacts, and a 100% Sovereign EU data storage claim that explicitly avoids US Cloud Act exposure.

Name

EIDP

Legal name

EIDP, Inc.

Website

https://eidp.com

Company type

Private

Founded year

2025

Operating status

Operating

Headcount range

1–10 employees

Short description

EIDP, based in Amsterdam and operating the TrustEngine brand, builds an API-first compliance automation platform that integrates with CI/CD pipelines to generate cryptographically signed Compliance Passports for CBW/NIS2, CRA, and DORA regulatory requirements, serving software development teams and enterprise procurement and risk teams in the EU market.

Ownership category

akta.pro rank

Product category

Compliance Automation Software

akta.pro primary industry

Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD)

Keywords

• Compliance automation software
• Software supply chain security
• SBOM management platform
• Regulatory compliance tooling
• DevSecOps automation

Headquarters

HQ city

Amsterdam

HQ country

Netherlands

HQ region

Europe

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales

Core offering

EIDP operates the TrustEngine compliance automation platform, which ingests CycloneDX SBOMs from CI/CD pipelines, eliminates false-positive vulnerabilities via VEX filtering, and outputs cryptographically signed 'Compliance Passports' (signed via Sigstore and in-toto) to satisfy the EU regulatory frameworks DORA, NIS2/CBW, and CRA. Access is delivered through a Python SDK and a CLI tool, with native integrations for GitHub Actions, GitLab CI, and ArgoCD, and all customer data stored under 100% sovereign EU data residency.

Product overview

TrustEngine offers a unified compliance automation platform designed to automate regulatory compliance (CBW/NIS2, CRA, DORA) for software development teams. The core platform integrates with CI/CD pipelines via API and CLI tools (trustengine_cli), processes CycloneDX SBOMs through the Python SDK (trustengine_sdk), and generates cryptographically signed Compliance Passports using Sigstore and in-toto standards. The platform includes VEX filtering for false positive elimination and delivers 100% sovereign EU data storage. Available via API-first integration with GitHub Actions, GitLab CI, and ArgoCD.

Differentiator

Problem solved

Functional benefit

Products and services

• TrustEngine Platform Integrated compliance automation SaaS platform for enterprise customers and risk teams. Automates CBW/NIS2, CRA, and DORA compliance directly from CI/CD pipelines, ingests CycloneDX SBOMs, applies VEX-based filtering, and emits cryptographically signed Compliance Passports with 100% sovereign EU data storage.
• trustengine_sdk (Python) Python SDK providing programmatic API access to TrustEngine for software developers and DevOps teams. Enables secure SBOM upload from CI/CD pipelines using API key authentication and returns a Compliance Passport identifier.
• trustengine_cli Command-line interface for software developers and security engineers. Provides the commands 'trustengine scan', 'trustengine generate-sbom --sign', and 'trustengine publish' to scan source code, generate Sigstore-signed SBOMs, and publish Compliance Passports.

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability1 record

Recent moves5 records

Expansion highlights5 records

Others

• Sigstore: Open-source signing infrastructure (cosign, fulcio, rekor) on which TrustEngine relies for cryptographic signing of SBOMs and passsports; relevant upstream infrastructure rather than a commercial competitor.
• in-toto: Supply-chain attestation framework whose layout standards TrustEngine uses to sign release artifacts; adjacent open-source project whose adoption directly affects TrustEngine's interoperability story.
• CycloneDX (OWASP): The SBOM standard that TrustEngine natively ingests; comparable as the upstream specification/ecosystem around which supply-chain attestation tooling is built, rather than a direct commercial competitor.

Direct peers

• Anchore: Open-source-rooted SBOM and container compliance platform with CycloneDX support and CI/CD integrations; comparable offering targeting engineering teams needing SBOM-native compliance evidence.
• Snyk: Developer-first security platform covering SCA, SBOM analysis and container security integrated into CI/CD pipelines; competes for the same dev-tooling budget and SBOM-driven compliance workflows as TrustEngine.
• Endor Labs: Software supply-chain security focused on dependency graph analysis, SBOM-level risk reduction and remediation — competes for the same engineering and security buyer addressing open-source and third-party software risk.
• Chainguard: Provides hardened base images and supply-chain security tooling (including SBOM-based attestations and signing) aimed at reducing software supply-chain risk for enterprise engineering teams — directly comparable to TrustEngine's SBOM/passport model.
• JFrog (Xray / Curation): Xray and related JFrog capabilities provide software composition analysis, SBOM-level vulnerability tracking and policy controls inside CI/CD — a closely comparable function to TrustEngine's pipeline-integrated compliance automation.
• FOSSA: SBOM-centric platform for license compliance, vulnerability management and supply-chain governance; comparable in automating SBOM-driven evidence for enterprise procurement and audit workflows.
• Sonatype: Nexus Lifecycle and Sonatype's SBOM-focused platform manage software supply-chain risk, open-source component governance and policy enforcement; overlaps directly with TrustEngine's compliance and SBOM attestation capabilities.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights5 records

Customer concentration

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about EIDP