CycloneDX
This entry runs no foundation model. Every finding below is quoted to the vendor’s own document, or marked not disclosed where the vendor publishes nothing.
Software Bill of Materials (SBOM) standard and tooling — generates machine-readable dependency inventories ensuring every smuggled package in the supply chain is explicitly known and auditable
No foundation model. CycloneDX does not run one, so there is no model provenance to record. CycloneDX is an OWASP/Ecma International specification (ECMA-424) defining a bill-of-materials document format for software supply chain transparency. It is a data standard, not software, and invokes no foundation model. Established from the product’s own public documentation and what it does. If that is out of date, tell us at right of reply.
Not yet assessed. We publish a sovereignty position only where the vendor documents one — we do not infer it from a domain or a company name.
Vannus records, from the vendor's own published documents, the legal entity a customer contracts with, the country that entity sits in, and the governing law of its terms — and whether the vendor runs its own model or resells someone else's. Each finding is quoted to its source and dated, or marked not disclosed where the vendor publishes nothing. No paid placement on a record, in the catalog or in search — affiliate status is walled off from the record, enforced by a test in the build. See the methodology →
Work here and think we got something wrong? Corrections and right of reply → — free, no account, and we publish your response next to our entry.