Open source you can put in front of your auditors.
Quatrain Core gives security and IT leaders visibility, control and a chain of trust from source code to production.
Transparent governance
AGPL-v3-only: every line is auditable, no hidden telemetry, no proprietary core.
Sovereign deployment
Run on-premise, on a European cloud or anywhere else with Tycho — your data stays where you decide.
Always-current documentation
Reference docs regenerated nightly from the code — an audit trail your teams can trust.
Audited continuously, delivered with a chain of trust.
Quality gates run on every push, and a corporate-grade distribution channel is on the way.
Static analysis on SonarCloud
All three monorepos are scanned continuously: bugs, vulnerabilities, code smells and security hotspots tracked on every push.
View the SonarCloud projectsSigned corporate packagesUpcomingNIS 2 Ready
A private, subscription-based repository of cryptographically signed packages for corporate clients — audit trails, version pinning and support included.
Tycho brings together infrastructure, deployment, cybersecurity and compliance — including security tests, audits and documentation bricks.