Provenance, before install.
Most tools scan after an artifact is already on your fleet. Attestree moves the work to ingest: with a detonation host attached, each winget package gets an SBOM and an attestation before any endpoint installs it, and together they form a tree of trust across the fleet.
What we are building
One agent and one control plane for the apps on your Windows fleet — winget and Chocolatey today, with more package managers and MSI/MST transforms on the roadmap. Your device manager keeps Windows Update and drivers. Inventory across what is installed, deploy and roll back safely in rings, and get SBOM and attestation as a byproduct rather than an afterthought.
Where we are
Pre-GA and in design-partner mode. The free Community Edition is the on-ramp — self-host it on a single box, up to 200 endpoints, no cloud account. The commercial tier adds a dedicated instance in your own Azure subscription, Entra ID sign-in, and a signing key held in a Key Vault there; hardware-backed custody is on the roadmap. It's built and operated from Switzerland — waitlist data stays in the EU under a hard residency guarantee (revFADP + GDPR; see Privacy).
Talk to us
We're opening up to a small set of early design partners. If your fleet feels brittle, we would like to hear about it.