Tool profile
FOSSA: cost, fit and limits
FOSSA is a software composition analysis platform from FOSSA, Inc. that identifies open source dependencies in code and containers, checks them for license and vulnerability risk, and produces SBOMs for engineering, legal and compliance teams.
What to know first
A buyer reading the FOSSA pricing page sees three tiers: Free, Business and Enterprise. The first two have hard caps on projects and contributing developers, and snippet and binary scanning are separate add-ons sold through sales. The product leans toward license compliance, attribution notices and audit paperwork more than toward developer-side fix automation. The only AI-related capability on the pricing page is snippet scanning, which looks for copied code, including code produced by AI assistants, that never appears in a manifest.
FOSSA at a glance
| Maker | FOSSA, Inc., United States |
|---|---|
| Free plan | Yes |
| Entry price | $20 per project per month, billed annually (Business) |
| API access | Yes |
| Category | Best AI Software Composition Analysis Tools in 2026, rank 1 of 10 |
| Website | fossa.com |
Who FOSSA is best for
Legal and compliance owners
Counsel who must show which licenses sit in each product need attribution notices, obligation tracking and SBOMs. FOSSA centers its page on these outputs rather than on developer alerts.
Small teams with few repositories
A handful of projects fits the free tier at 5 projects and 10 contributing developers, and the first paid tier is priced per project rather than per seat.
Companies shipping binaries or firmware
Embedded and desktop vendors need to know what is inside compiled artifacts. Binary scanning is a listed add-on, though it requires a sales conversation.
FOSSA plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free | $0, no time limit | 5 projects, 10 contributing developers, 1 release group, 5 dependency levels, 5 imported SBOMs, container scanning, API access and SBOM export. |
| Business | $20 per project per month, billed annually | 10 projects, unlimited dependency levels, automated license and vulnerability scanning, multi-project reporting, unlimited imported SBOMs and priority support. |
| Enterprise | Quote only | Unlimited projects and release groups, custom developer counts, SSO, role-based access, advanced compliance reporting, custom retention and enterprise SLAs. |
| Snippet and Binary Scanning | Quote only (add-ons) | Snippet scanning finds undeclared code fragments including AI-generated ones. Binary scanning checks compiled artifacts and containers for embedded components. |
Checked November 2026.
What FOSSA does
- Dependency identification at any depth
- The free tier identifies transitive dependencies at any depth through the dashboard, while scan depth is capped at 5 levels there. Paid plans lift the depth cap, which matters in JavaScript trees with long chains.
- License and vulnerability scanning
- Business runs automated checks on both license terms and known vulnerabilities, with multi-project reporting so a compliance lead can see exposure across products instead of one repository at a time.
- SBOM import and export
- Teams can export SBOMs from the free plan and import third-party ones, up to 5 on Free and unlimited from Business. This helps when customers send supplier bills of materials for review.
- Snippet detection for AI-written code
- The add-on matches code fragments against open source, so copied or assistant-produced code without a declared package is still traced to a license and package record.
How FOSSA handles your data
FOSSA's privacy policy says it collects source code and metadata plus repository access tokens. Its Fossabot feature sends code to Anthropic for analysis, and the policy states that neither FOSSA nor Anthropic will use that code to train AI models. Results are kept only as long as the service needs them. AWS is the stated data center provider, non-US users are processed in the United States, and FOSSA says it is certified under the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks. Subprocessors are listed in the policy. Certifications such as SOC 2 were not checked for this page.
Where FOSSA falls short in practice
- Project caps bite early. Business stops at 10 projects and 10 contributing developers, so a company with dozens of repositories hits the Enterprise quote almost at once, and per-project pricing becomes hard to forecast.
- Key capabilities are sold separately. Snippet and binary scanning carry no printed price, so the cost of audit-grade coverage stays unknown until a sales call, and a budget built from the pricing page will be incomplete.
Works with
Alternatives to FOSSA
FOSSA: common questions
Does the FOSSA free plan expire?
No. The pricing page describes the Free plan as free forever, with 5 projects, 10 contributing developers and one release group. It limits scan depth to 5 dependency levels and one quality check, so deep trees may be truncated until you move to Business.
How is FOSSA Business billed?
Business is priced at $20 per project per month, billed annually, and the page gives an example of $207 per month for 10 developers. Yearly billing saves 10% on the toggle. Check whether your contributing developer count or project count will cross the 10-unit caps.
Does FOSSA use my code to train AI models?
The privacy policy says that for Fossabot, code goes to Anthropic for analysis and that neither FOSSA nor Anthropic will use it to train AI models. Source code is processed transiently. Retention for other product data was not detailed beyond 'as long as needed'.
Can FOSSA find code copied from open source projects?
Yes, through the Snippet Scanning add-on, which identifies code fragments not declared in manifests and returns license and package data for them. It also covers snippets produced by AI assistants. The add-on has no printed price, so you need a quote.
Where does FOSSA process my data?
The privacy policy names AWS as the data center and says non-US users' data is processed in the United States. It does not offer an EU region on the page reviewed. If your policy requires EU residency, ask FOSSA about custom deployment, which Enterprise lists.