Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Projects and billing

← All articles

Projects are billed at a monthly or yearly rate. Activation uses one slot. Custom domains and extra watched branches are add-ons. Archive frees the slot.

Security monitoring and extra watched-branch selections are retained when a subscription ends. Checkout lists them in its initial estimate and review. Use Manage retained add-ons to close checkout and open Billing → Add-ons before starting again. Security Disable remains available after cancellation or free-access expiry. Add-on removal is blocked while a payment is overdue or the subscription is paused; resolve that state first. Local cleanup after a subscription ends creates no credit.

Only owners and admins can restore archived projects. A project activated by publishing or exporting returns as active, subject to paid capacity or free-plan rules. A never-activated project returns as a draft without using active-project capacity. Restoring does not publish a public page.

Free OSS qualification continues when an established public GitHub connection has a known dependency-file sync problem. A failing Testing branch can keep its sync warning while reviewed Production content is published or exported without using the lifetime Community allowance. Access failures, private or unknown visibility, and failures whose cause is unclear still require qualification again. The monthly OSS activation limit and ordinary review requirements are unchanged.

SourceTrust bills by active projects once an organization is paid. Free organizations may publish one lifetime Community page plus public-GitHub OSS projects (SourceTrust promotion on every free page). Free OSS publishing is capped at 10 OSS publishes per organization per calendar month, resetting on the 1st (UTC). Deleting a project does not give the month's OSS publishes back. Creating drafts, importing, and reviewing stay free. A project's first publish activates it. For In-app / export only or Public page and in-app export delivery, the first export activates a draft the same way. On a paid org an activation uses one project slot; on a free org it uses Community or OSS capacity instead. Exporting an already-active project never uses another slot. If an active project on a free organization loses its free qualification (the subscription ended, or its GitHub repository is no longer public), its published page stays online, but publishing changes and exporting need a public GitHub repository connection or a paid plan again. Upgrading ends free tiers for the whole organization and removes SourceTrust promotion from every public page.

Pricing (USD)

  • Project slot: $29/month or $299/year per active project.
  • Custom domain add-on (per hostname, up to 10 per organization): $49/month or $499/year.
  • Extra watched branch (per project, beyond 2 included): $5/month or $50/year per slot.
  • Security monitoring add-on (org-wide): $200/month or $2000/year.
  • Prices include VAT / sales tax where applicable. Nothing is added on top at checkout.
  • If this organization's first payment is for a monthly project plan, that payment is eligible for a full refund to the original payment method within 30 days. Yearly project plan payments, later monthly renewals, and add-ons are not eligible for refunds to the original payment method.

Project states

  • Draft: Free to create, import, and review. First publish activates it (Community/OSS while free, or a paid project slot once upgraded). When disclosure delivery is in-app only or both, first export activates the same way.
  • Active: Uses one slot. Can publish (unless in-app only), export, and stay on the public URL when published.
  • Archived: Does not use an active-project allowance. Data is kept. The public page is taken offline. Paid extra branch capacity remains billed until released from Billing. Remove watched branches and release unused capacity there without restoring the project.

Activation and billing management

  • Activation: First publish activates the project. In in-app-only or both modes, first export also activates. Paid orgs use one project slot per activation. Free orgs use the lifetime Community publish or a public-GitHub OSS activation (up to 10 OSS activations per calendar month). Only owners and admins can activate. Checkout when upgrading must cover every current active project.
  • Mid-cycle slot changes are prorated through Paddle.
  • Open Billing to change project count, manage add-ons, or open the Paddle customer portal for payment methods and invoices.
  • Billing shows paid extra watched branches across active and archived projects. Archived projects have cleanup controls there: Remove branch permanently deletes that branch’s inventory, reviews, findings and comments. Release capacity is a separate action for unused paid capacity. Published history is kept.

Checkout activation and remaining access

After checkout, Continue becomes available when subscription access is ready. Until then, activation is pending. If activation takes longer than 30 seconds, you can safely close the window and contact Support using the Billing category. Avoid starting another checkout for the same purchase. If access becomes ready while the window is open, Continue resumes your original action.

If a cancelled subscription still has access remaining, Billing shows when existing active projects stop being usable. New project activation stays blocked, and the subscription has not restarted. Use Support for help. A checkout attempt that reports existing access has made no new purchase or subscription change. Closing it or opening Support does not resume a publish, download, or restore action. Once subscription access has expired, Billing offers Start subscription again.

Billing email recipients

Choose 1-5 current member addresses in Billing → Recipients for SourceTrust payment receipts and billing emails. If no recipients are configured, payment receipts go to the organization owner. Download official Paddle invoices from Billing payment history. Recipient settings do not change your Paddle customer contact details; contact support to update those separately.

After changing and verifying your account email, sign in again to sync your profile. An authorized member must explicitly edit Billing and Security recipients to use the new address. When a member leaves or deletes their account, invoice and renewal-reminder lists keep only addresses of remaining members. Security recipients can include external mailboxes: departure removes the member's current exact address, without guessing which older addresses belonged to them.

Extra watched branches

Every project watches two branches for free. To watch more (for example additional release branches), open Billing → Extra watched branches, pick the project, and choose Buy extra branch. Your card is charged the prorated amount for the rest of the billing period. You can add up to 8 extra branches per project, billed organization-wide as the total across your projects.

Buying capacity does not start watching a branch by itself. On the same Billing page, type the branch name into the project's Branch field and click Add to assign a paid slot to it. The project must have a connected repository, and SourceTrust checks that the branch exists there before it starts watching it. Assigning uses capacity you already paid for, so the assignment itself adds no charge.

Payment history and exports

  • Payment dates use the actual capture time when available, then the billed time, then the latest update time.
  • Settled zero-value payments are shown and exported. Zero-value failed or unsettled records remain hidden.
  • History and exports include at most the latest 500 payments. When the result is truncated, Billing shows a warning and keeps both export options available.
  • Refunds and chargebacks remain authoritative in Paddle. The original settled payment row may remain visible in SourceTrust's in-app history.

Discount codes and free access

  • Some organizations get free access through a discount code instead of a subscription, with no payment method required.
  • A code can grant free access forever, or for a limited number of months.
  • A promotion that reduces a payment to zero does not by itself grant permanent free access.
  • When a limited period ends, active projects are archived and their public pages go offline, the same as archiving from Project Settings → Danger zone. Nothing is deleted: package inventory, publish history, and drafts all stay exactly as they are.
  • After a limited free period ends, subscribe from Billing. Then restore each archived project and publish its page again.