Business solution

SBOM & software-composition evidence

Turn software composition and provenance into evidence a buyer can actually review.

The SBOM solution organises software-component, dependency and provenance evidence around the digital product being supplied, so reviewers can understand what is in scope and what changed.

Open in TrustOps Talk to us

Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.

For agent operators

Why it matters when the subject is an AI agent.

An agent is software, and a buyer's supply-chain review will reach it. Where a customer asks what an agent is built from and what changed between releases, this solution ties that evidence to the agent's enduring identity instead of to a file that goes stale.

The questions it helps answer

What is this agent built from, and what changed in this release?
Can composition evidence follow the agent across versions without a new identity each time?

Fit

Who it is for, and what changes.

Best for

Software publishers facing enterprise supply-chain review.
Agent, SDK, plugin, API and service teams managing third-party components.
Organisations that want SBOM evidence tied to an enduring product identity rather than an isolated file.

Outcomes

More reviewable software-composition evidence.
A clearer link between a release, its product identity and its supporting provenance.
Less manual reconstruction of component evidence during customer or regulatory review.

Inside

What is included, and how it works.

What is included

Structured software-composition evidence around the relevant ECZ-ID subject.
Release and provenance context where supplied by the customer workflow.
Support for buyer-facing evidence packaging.
Managed and enterprise depth for larger programmes.

How it works

Identify the software product or service whose composition must be evidenced.
Collect the relevant composition and provenance inputs.
Organise them against the enduring ECZ-ID identity and release context.
Re-use and update the evidence as dependencies and releases change.

Boundaries

What the FREE Passport already gives you, and what this never does.

Already included free

Versions of an agent are never separate Passports, so composition evidence can follow one identity across releases.

£0 · No card required · Permanent, not a trial.

What it never does

An SBOM describes composition and evidence; it is not a declaration that software is secure.
ECZ-ID does not turn missing source evidence into verified facts.
Identifying an agent is not controlling it. ECZ-ID does not authorise, restrict, supervise, pause or stop what an agent does — its operator and the party relying on it stay responsible for that.

Regulated finance
DORA ICT-vendor evidence
The DORA solution helps an ICT provider organise identity, service, resilience and supporting evidence into a reusable review pack for financial-sector customers and their procurement or risk workflows.
Boundary: ECZ-ID supports evidence preparation and review; it does not certify DORA compliance.
See details Open in TrustOps(opens in a new tab — trustops.ecocitizenz.com)
Counterparty
DCI — Digital Counterparty Infrastructure
DCI combines identity, public proof and reusable evidence around the digital surface a counterparty actually encounters — such as a website, API, portal or machine service.
Boundary: DCI is identity and evidence infrastructure; it is not a counterparty risk score or approval.
See details Open in TrustOps(opens in a new tab — trustops.ecocitizenz.com)
Evidence/history
LedgerCore
LedgerCore is the evidence layer for ECZ-ID: lifecycle events, eligible receipts and tamper-evident anchors that help a reviewer understand what was recorded and when.
Boundary: An anchor shows that a recorded item has not changed since anchoring; it does not make the statement true.
See details Open in TrustOps(opens in a new tab — trustops.ecocitizenz.com)

Every Agent product

Start with the identity. Add SBOM & software-composition evidence when it earns its place.