Platform and data stay in your data center. On top, you get what professional operation of a security-critical application requires: contractually agreed response times, vetted updates straight from the publisher and a fixed contract partner who is reachable and acts when it matters.
Built on open standards
Three operating models
Our stance
Modern software consists largely of components that were not built inside your own organization. Whoever ships that software is still responsible for them. The Cyber Resilience Act and the NIS-2 implementation have turned this standard into a duty of proof: detect known vulnerabilities, assess them, fix them and document the process.
The tools that do this are mostly proprietary and rarely come from Europe. Above all, the same vulnerability in the same component is assessed again in every organization – the same triage work, repeated thousands of times.
The evidence that regulators, auditors, market surveillance and customers ask for becomes a by-product of development – not a documentation task after the fact.
What the enterprise contract covers
An enterprise contract bundles three critical aspects into one comprehensive service package. We do not just roll out DevGuard – we align it with the way your teams already work.
Together we review your target architecture, deploy DevGuard via our Helm chart and connect it to your CI/CD pipelines, SSO/OIDC and issue trackers. This includes a best-practice check of your pipelines and guided onboarding for your team.
You get a fixed allowance of support hours, binding response times and clear escalation paths. You escalate to a team that knows your installation, not to a public issue tracker.
We keep your installation current with vetted updates and, depending on your package, guide upgrades through breaking changes. The contract also establishes a formal supplier relationship with the publisher, which simplifies your supplier assessment.
Packages
Four tiers – from running DevGuard without a contract to Mission Critical for large enterprises, the public sector and critical infrastructure. Choose the service level that matches how critical your operation is.
Enterprise Standard
Small and mid-sized companies, regular operation, up to 80 repositories
Enterprise Advanced
Mid-sized and large companies, regulated industries, up to 300 repositories
Mission Critical / LTS
Large enterprises, public sector, critical infrastructure, more than 300 repositories
Enterprise Advanced
Mid-sized and large companies, regulated industries, up to 300 repositories
Request a quoteGet your quote in an introduction call or by email.
Enterprise packages are billed annually in advance as a subscription; other models are possible by arrangement. The annual fee covers support, service levels and maintenance. Initial setup is billed once, separately.
Included in every package
The provenance, components and vulnerability status of every DevGuard release are documented. That is the basis for adding DevGuard itself to your supplier management.
DevGuard ships as a bit-for-bit reproducible container image with a minimized attack surface. Its origin and build process are attested via SLSA provenance and independently verifiable with cosign.
Every artifact comes with a CycloneDX SBOM as an attestation, so you can prove at any time which components your installation consists of.
We assess vulnerabilities in DevGuard and its dependencies and publish the result as a VEX statement. For every CVE, you get a clear statement on whether you are affected instead of a raw scanner finding.
Additional services
Beyond the allowance included in your package, further services are available. Hour packages booked in advance come at a discount compared to individual billing.
If you need functionality beyond DevGuard's standard scope, we build it for you – per person-day or at a fixed price after a prior effort estimate.
As an open-source project, we contribute the features we build back into the main version of DevGuard. No separately maintained special version emerges, and you carry no fork maintenance costs.
By commissioning the work, you agree to its publication under AGPL-3.0; we do not grant exclusive usage rights. Confidential data and configurations of your organization are never published.
FAQ
What organizations want to clarify before signing an enterprise contract – from why a service package makes sense to supplier assessment under NIS-2.
The software is freely available. The service package secures its operation: binding response times, updates vetted by the publisher and a contract partner who acts when it matters. You do not escalate to a public issue tracker, but to a team that knows your installation.
Your contact
For every question about DevGuard Enterprise – from choosing the right package and service levels to pricing and setup in your data center. You can book a first conversation directly online.
