The self-hosted artifact registry
Your packages,
in your orbit.

The artifact repository manager for enterprises that own what they ship.

Your hardware. Your data. Your terms. OrbitalReg is a self-hosted binary repository, the alternative to JFrog Artifactory and Sonatype Nexus for teams who need to own what they ship: 40+ formats, native CVE detection, signature-verified pulls, and first-class air-gap mode, all in one Go binary. Established 2024, built in Germany.

Try it free for 30 days → See the product

Or see pricing

And after the trial? The security layer (scanning, curation, quarantine, pull-gates) stays free forever. No contract, no cost. See how OrbitalReg Free replaces JFrog Xray + Curation →

The threat curve

Supply-chain attacks aren't rising. They're escalating.

Every malicious open-source package ever caught, added up. What took the ecosystem four years to accumulate now arrives in a single quarter. Every one of them is a package your builds would have pulled without asking.

1,233,000

known malicious open-source packages by the end of 2025, 15× more than three years earlier.

How OrbitalReg keeps them out of your builds →

Cumulative known malicious open-source packages (npm, PyPI, Maven Central, NuGet, …). Source: Sonatype, State of the Software Supply Chain reports 2023 to 2026; the 2022 value is derived from Sonatype's finding that 2023's discoveries alone doubled all prior years combined.

Recently analysed

All supply-chain case studies →

PHP · Oct 2026

PHP2Shell: two 9.2 RCEs since PHP 5.4 →

Leaked before the patch, every runtime in scope. SBOM inventory plus a critical pull-gate on images and packages.

FinOps · Oct 2026

The FinOps view of supply-chain attacks →

$4.96M and 258 days per incident against a prevention bill priced per seat. The ledger, both columns.

Artifactory · Jul 2026

Hugging Face agent intrusion →

Autonomous agents used a registry as message board, SSRF relay, token forge and C2.

What you get

Six capabilities that usually arrive as six separate products, three licences and a sidecar.

Everything an enterprise registry should be, in one binary.

40+ package formats

Maven, npm, PyPI, Docker, Helm, Cargo, RubyGems, NuGet, Conan, Nix, Argo Workflows, Deno, Homebrew, Ollama, Kustomize, OPA Bundles and 25 more.

One unified API surface for all of them.

Native CVE detection

Every upload gets an SBOM matched against OSV advisories, and Trivy and Grype add deep scans for the projects you enable them on. Results stay on your hardware; in air-gap mode, advisory feeds and scanner databases update only once you allow them.

Sigstore signature verification + provenance checks integrated.

Verify-on-pull gates

Cryptographic signature verification before an artifact leaves the registry. CMS, OpenPGP, RSA and Sigstore are all supported. Switch the policy on and pulls of unverified artifacts are blocked at the gate, in every tier.

Customisable per-repo policies.

Air-gapped by default

Fresh installations block all outbound calls. Operators explicitly opt in to webhooks, telemetry, and external CVE feeds. The default is the safest setting.

Tested for true offline operation, with no surprise phone-homes.

Build-info provenance

Attach build-info from CI and every artifact carries its CI run, commit SHA, builder identity and Sigstore signature. Trace any binary back to its source. Promote builds across environments with confidence.

GitHub Actions, GitLab CI and Jenkins all wire up natively.

GitOps-native

Terraform provider, Kubernetes operator, and the orbital CLI ship out of the box. Helm chart with an air-gapped tarball variant. Your registry, declarative.

No microservice sprawl, no sidecars.

Why now

Most enterprise tooling is drifting away from sovereignty.

The artifact-registry market followed the rest of the industry toward SaaS-first delivery, per-user pricing, and roadmaps shaped by analyst-friendly enterprises. That's the right path for some teams. For everyone else, the available choices have been getting steadily less attractive.

Modern package ecosystems (twenty-plus that didn't exist a decade ago) have outgrown the format-specific-repository designs of the previous generation of tools. Security features that should be always-on are gated behind separate licences. On-prem deployment becomes an upcharge instead of the default.

For regulated industries, defence, finance, public sector, and the long tail of operators who simply want to own what they run, OrbitalReg is what we'd build if we were starting now. Self-hosted by default. Customer sovereignty over the entire data path.

Format coverage

40+ formats, one API surface.

The same auth, the same policies, the same audit trail, whichever ecosystem a team happens to build in.

Browse all formats and what each supports →

Security included

Every security feature.
Every tier. Always on.

Most artifact registries gate security behind separate licences, add-on products, or higher tiers. OrbitalReg ships every feature in every tier, including the free version. Security is the product, not an upcharge. That's why OrbitalReg Free is a working replacement for scan-and-curate add-ons like JFrog Xray and Curation. See the feature-by-feature comparison.

Switch the gate on and nothing unverified leaves the registry, in every tier, including the free one.

Supply-chain integrity

+ Sigstore signature verification at push and pull
+ X.509, OpenPGP, CMS, RSA: every common signing scheme
+ Trust-bundle management with key rotation
+ Build-info provenance: CI run, commit SHA, builder identity
+ Promotion gates that re-verify between environments

Runtime defense

+ OSV advisory matching on every artifact, Trivy + Grype per project
+ Pull-gate policy engine that blocks by severity, licence, signature, SBOM, age or path
+ Policy-as-code: your own Rego rules gate pulls and promotions
+ Auto-quarantine on new CVE disclosure
+ Verify-on-pull policy enforcement, per-repo
+ Human-readable "why blocked" responses for developers

Identity & access

+ OIDC token exchange for GitLab CI, GitHub Actions, Kubernetes
+ Scoped API tokens with format-agnostic, human-readable permissions
+ Service accounts with role-based access
+ SAML / SSO + SCIM user provisioning
+ Project-scoped quotas + retention policies

Audit & sovereignty

+ Structured JSON audit log, SIEM-ready out of the box
+ Reverse-dependency lookup for security forensics
+ Air-gapped mode is one config flip. No outbound calls, no heartbeat, no update check
+ No usage telemetry, no per-user metering. Outbound is the anonymous daily license heartbeat plus the opt-in update check; both off in air-gap mode
+ ISO 27001 controls mapped, SOC 2 evidence engine built-in

Comparison without names

Security features
typically sold separately.

→ CVE-scanning engines: separate licence
→ Signature verification: plugin-only
→ Sigstore native integration: Enterprise tier
→ OIDC for CI: Enterprise tier
→ SAML / SSO: Enterprise tier
→ SIEM-grade audit log: feature flag
→ Air-gapped deployment: upcharge
→ Compliance attestations: paid add-on

All of the above ship in OrbitalReg from the €100 design-partner tier upward. Security is the product.

See it in action

From upload to verified pull, in real product UI.

Six surfaces a customer engineer touches in their first week. Use the arrows or the dots to step through.

Mission Control dashboard with KPIs and format adapters

01 / 06

Mission control, day one

Projects, repositories, open findings and active trust bundles at a glance, plus every format adapter the registry serves.

Trust signals

Five things your procurement team will ask about, answered.

Drop-in migration

Importers for every major registry.

Open-source roots

Postgres · MinIO · Sigstore · Helm.

SOC 2 Type II

Audit in progress.

ISO 27001

Controls mapped to product.

EU sovereignty

GDPR-compliant · hosted in Frankfurt.

Our principles

Four commitments we hold ourselves to.

Self-hosted by default

We build software customers install, not software customers subscribe to. Deployable on your hardware, your cluster, your air-gapped network.

Sovereignty over your data

Self-hosted means your traffic stays yours. We do not meter, we do not gate features behind consent. The only outbound call we ask for is an optional daily anonymous license-state heartbeat (install ID, version, license state, nothing about your users, repos, or artifacts), and it stays off until you configure it.

Predictable cost, forever

Per-deployment pricing, never per-user. A lifetime price cap on multi-year contracts. No renewal-time surprises, no audit-driven true-ups.

Engineering integrity

Every release passes human code review before shipping. We publish reproducible builds, SBOMs, and Sigstore signatures so what runs in your cluster is provably what we wrote. Breaking changes get disclosed early; we never silently deprecate.

How it fits

Sits between three things and stays out of the way of the rest.

Between CI and developers

Build artifacts land here from GitHub Actions, GitLab CI, Jenkins and Tekton with build-info envelopes intact. Developers pull them with the registry CLI of their choice, or via OrbitalReg's own orbital tool.

Between you and the public web

OrbitalReg can proxy upstream registries (npm, Maven Central, Docker Hub, PyPI) with a configurable cache horizon, or it can refuse to talk outbound at all. Your call.

Between security and ops

Detection runs continuously; security policies block pulls that violate them. Ops sees one service with a single Postgres and a single S3-compatible bucket. No microservice sprawl.

Pricing

Three honest paths.
One lifetime promise.

Per-deployment, not per-user. Per-licence, not per-environment. We do not limit environment scaling; most providers do. Predictable annual fee, capped for life if you commit long-term. And below all of it: a free version that never expires. See these numbers next to JFrog Artifactory's →

OrbitalReg Free · forever

€0: no contract, no signup wall, no expiry cliff

After the 30-day full trial, the entire security layer keeps running free: Trivy + Grype scanning, curated proxies, patch-version quarantine, verify-on-pull gates and the SIEM-ready audit log. An expired trial never blocks a build. It's a working replacement for JFrog Xray + Curation (see the comparison).

Get it free →

Design Partner · Limited cohort

€100/year

1 cluster licence · feedback in exchange for full access

✓ 1 cluster licence, full-featured access
✓ Shape the product roadmap
✓ Optional graduation to Commercial after year 1

You commit to: regular feedback calls, use-case sharing, beta-testing new features, a public quote we can use after the trial.

Commercial · Year 1 entry

€10,000 in year 1

3 cluster licences · upgrade to Lifetime-locked for multi-year price guarantee

✓ 3 cluster licences (dev, main, prod)
✓ Scale up your clusters, unlimited. Add clusters, regions and replicas with no per-instance fees, ever
✓ Importers + migration CLI for Artifactory, Nexus and five more
✓ Email support during business hours
✓ All security features always-on, no upcharge

Long-term Partner · Lifetime price lock

Lifetime-locked

Multi-year contract · sized to your company · the price you sign for never rises

✓Lifetime price guarantee: the price never rises, ever
✓Sized to your company, with fair pricing and no enterprise list-price markup
✓Multi-year contract (3 years), price locked for the entire term
✓3 cluster licences (dev, main, prod) · scale each unlimited
✓Roadmap influence + 24/7 support optional add-on

Lifetime promise

What you will never pay for.

✕ Per-user fees
✕ Per-environment scaling charges
✕ Per-replica or per-cluster surcharges
✕ Security-feature unlocks
✕ Mandatory upgrade fees
✕ Renewal-time price hikes

Self-hosted means we cannot see your usage. We bill what we agree on, year after year. No metering, no surprise audit clauses, no "true-up" invoices.

Prices in EUR. Multi-year pricing requires a 3-year commitment to lock the cap; renewal at the same cap is at your option, never ours.

Full pricing: what's free, what's licensed, and what happens after the trial →

Questions

What is an artifact registry, and is OrbitalReg a JFrog or Nexus alternative?

What is an artifact registry?

An artifact registry (also called an artifact repository, binary repository manager or package registry) stores the build outputs your software depends on (container images, npm and Maven packages, Python wheels, Helm charts, Terraform providers) and proxies the public registries so every build pulls from one governed place. OrbitalReg is a self-hosted one: it runs on your Kubernetes cluster, keeps every byte on your hardware, and scans, signs and gates what goes in and out.

Is OrbitalReg an alternative to JFrog Artifactory or Sonatype Nexus Repository?

Yes. OrbitalReg covers the same job. It is a universal, self-hosted repository for 40+ package formats with remote proxies, virtual repositories, retention and SSO, and it ships the security features those products sell as add-ons (CVE scanning, curated proxies, quarantine, verify-on-pull gates) in every tier, including the free one. A migration CLI imports from Artifactory, Nexus, GitHub Packages, GitLab and the cloud registries.

Which package formats does OrbitalReg support?

Maven, npm, PyPI, Docker/OCI, Helm, Cargo, RubyGems, NuGet, Conan, Nix, Terraform providers, Argo Workflows, Deno, Homebrew, Ollama, Kustomize, OPA bundles and more than 25 others: 40+ formats behind one API surface. The support matrix in the docs lists every adapter and its maturity.

Can OrbitalReg run air-gapped or on-premises?

Air-gapped is the default. A fresh installation makes no outbound calls; operators opt in to webhooks, telemetry and external CVE feeds explicitly. The Helm chart has an offline tarball variant, and the registry runs as one Go binary with Postgres and S3-compatible storage, whether on-premises, in your own cloud account, or with no internet at all.

How much does OrbitalReg cost?

There is a free version that never expires: after a 30-day full trial the complete security layer keeps running at no cost, with no contract and no signup wall. Commercial licences are priced per deployment, not per user, at a predictable annual fee that is capped for life on a long-term commitment. Published figures are on the pricing section and next to JFrog Artifactory's list prices on the comparison page.

More depth: JFrog alternative (Artifactory, replaced) · Sonatype Nexus alternative · format support matrix · migrating from Artifactory or Nexus · JFrog Artifactory pricing compared · trust & security

Invite-only access

We're onboarding our first cohort of customers now.

Saw something in the walkthrough that fits? Tell us what you're building, what you're running today, and where a self-hosted registry would help. We'll take it from there.

Email info@orbitalreg.com Existing customer? Sign in →

The self-hosted artifact registry
Your packages,
in your orbit.

The artifact repository manager for enterprises that own what they ship.