One operating plan for your estate of SDKs and libraries, above free Passports it never changes.
SDK Publisher & Provenance is the SDK family's operating product: the paid plans TrustOps publishes for operating SDKs and libraries at estate scale, each monthly or annual, with their own allowance. It is a commercial entitlement only: identity, the Resolver record and the free baseline never change by buying, cancelling, refunding or exhausting it.
A publisher's SDKs, libraries and packages multiply across languages, registries and releases. Operating that portfolio needs one plan for the estate, without turning the plan into another identity.
Built for
SDK publishers operating a portfolio of SDKs, libraries or packages across several registries.
Teams that want publisher continuity and release provenance run as one plan across the estate.
Publishers who need every free SDK Passport left untouched by whatever the plan does.
What changes
One plan for the estate, sized by the tier you choose.
Identity and the free baseline kept apart from the plan.
A plan you can stop without touching any ECZ-ID.
What you receive
Concrete deliverables, not a vague trust score.
SDK Publisher & Provenance and its larger plan, each monthly or annual, with the allowance TrustOps states for it.
One paid tier per billing scope.
Your free SDK Passports, unchanged, underneath it.
The plan, beside your Passports
Covers
Your estate of SDKs and libraries, within the allowance of the tier you choose
Tier
One paid tier per billing scope
Held in
TrustOps, as a commercial entitlement
Never changes
An ECZ-ID, its Resolver record or the free baseline
Boundary
Never a certification
Illustrative structure. The tiers, their allowances and their prices are TrustOps' own, listed below.
How it works
A short path from need to something usable.
01
Hold free SDK Passports for the SDKs and libraries you operate.
02
Choose the tier that fits your estate in TrustOps, which shows whether it can be bought today.
03
TrustOps holds the entitlement; your Passports and their Resolver records stay as they are.
04
Buying, cancelling, refunding or exhausting the plan never changes an identity or the free baseline.
How it relates to your Passport
The plan sits above your free SDK Passports, never inside them. Each Passport stays free and resolvable, and the Resolver keeps publishing each record exactly as before.
Use cases
A publisher growing from one flagship SDK to client libraries in several languages and registries.
One plan per billing scope for every SDK the publisher operates.
Tiers and price
What it costs, and where you buy it.
SDK Publisher & Provenance (monthly)
Paid · Open
£29.99 per month
SDK Publisher & Provenance: up to 50 package identities — observation of each of your packages on npm and PyPI; the latest release of each package as the registry reports it every 6 hours, with its artifact digests; a new latest release is recorded as an event; whether the registry reports a provenance attestation for that release, and whether that attestation's source repository matches the one you declared; repository-field changes, and as each registry states them maintainer-set changes and deprecations (npm) and yanks (PyPI), as events in a local, hash-chained record you can export. Delivered in the Estate Operations console. Not included: verification of provenance signatures by ECZ-ID (provenance is as reported by the registry); releases published and superseded between two observations, or under a tag other than latest; ecosystems other than npm and PyPI (shown as not observed).
One payment for 12 months (annual prepaid; it does not renew)
SDK Publisher & Provenance: up to 50 package identities — observation of each of your packages on npm and PyPI; the latest release of each package as the registry reports it every 6 hours, with its artifact digests; a new latest release is recorded as an event; whether the registry reports a provenance attestation for that release, and whether that attestation's source repository matches the one you declared; repository-field changes, and as each registry states them maintainer-set changes and deprecations (npm) and yanks (PyPI), as events in a local, hash-chained record you can export. Delivered in the Estate Operations console. Not included: verification of provenance signatures by ECZ-ID (provenance is as reported by the registry); releases published and superseded between two observations, or under a tag other than latest; ecosystems other than npm and PyPI (shown as not observed). One payment for exactly 12 months. It does not renew.
SDK Publisher & Provenance Business: up to 250 package identities — observation of each of your packages on npm and PyPI; the latest release of each package as the registry reports it every 6 hours, with its artifact digests; a new latest release is recorded as an event; whether the registry reports a provenance attestation for that release, and whether that attestation's source repository matches the one you declared; repository-field changes, and as each registry states them maintainer-set changes and deprecations (npm) and yanks (PyPI), as events in a local, hash-chained record you can export. Delivered in the Estate Operations console. Not included: verification of provenance signatures by ECZ-ID (provenance is as reported by the registry); releases published and superseded between two observations, or under a tag other than latest; ecosystems other than npm and PyPI (shown as not observed).
One payment for 12 months (annual prepaid; it does not renew)
SDK Publisher & Provenance Business: up to 250 package identities — observation of each of your packages on npm and PyPI; the latest release of each package as the registry reports it every 6 hours, with its artifact digests; a new latest release is recorded as an event; whether the registry reports a provenance attestation for that release, and whether that attestation's source repository matches the one you declared; repository-field changes, and as each registry states them maintainer-set changes and deprecations (npm) and yanks (PyPI), as events in a local, hash-chained record you can export. Delivered in the Estate Operations console. Not included: verification of provenance signatures by ECZ-ID (provenance is as reported by the registry); releases published and superseded between two observations, or under a tag other than latest; ecosystems other than npm and PyPI (shown as not observed). One payment for exactly 12 months. It does not renew.
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal. Read from the TrustOps projection generated . All pricing→
After purchase
TrustOps acquires
Configure and buy in TrustOps, which owns payment and entitlement.
Dashboard operates
The entitlement appears in your Dashboard, where you operate it.
Resolver proves
Public facts stay on the Resolver; buying never changes what a record proves.
Privacy, security and evidence
What is collected, published and kept.
The plan is an entitlement held in TrustOps, not a property published on the public record.
Your ECZ-ID does not change.
It is never a certification.
Boundaries
The claims stop here.
The plan is a commercial entitlement only. It is never a certification.
Buying, cancelling, refunding or exhausting it never changes an identity, the Resolver record or the free baseline.
One paid tier per billing scope.
Integrations and questions
Works with what you already run.
Your free SDK Passports and their bindings.
Active Entity Capacity, the capacity your organisation's SDK estate is counted in.
TrustOps: the only place the plan is bought, changed or cancelled.
Each tier below states its current acquisition state, read from TrustOps. TrustOps publishes the tiers and their prices and shows whether online purchase is open.
Does the plan change my SDK Passports?
No. It is a commercial entitlement only: buying, cancelling, refunding or exhausting it never changes an identity, the Resolver record or the free baseline.
