Sold by: Cloudsmith
Deployed on AWS
Cloudsmith is the only cloud-native, global, universal artifact management platform to securely develop and distribute software.
4.5
Overview
Video
Cloudsmith
Video
Product video
Cloudsmith is a fully managed artifact management and software supply chain solution, designed to significantly lower infrastructure costs while boosting developer productivity. Whether you're deploying artifacts to your distributed teams, or shipping licensed software to your customers, our architecture is optimized for secure, controlled, lightning-fast delivery.
At the core of our product is a truly universal, cloud-native approach to package management. With support for 30 package formats, organizations of any scale really can create a single source of truth for their teams. Because we're cloud-native, your teams get fast, reliable artifact management. Along with world class support, you get happy developers who can ship without distraction.
Your software artifacts are your intellectual property. That's why Cloudsmith is ISO27001 accredited and built to put you in control. Manage access, ensure compliance and implement security best practices, all in one product.
Highlights
- Cloud-native artifact management. Once your software is compiled, you need to put it where developers can get it quickly. Store your software packages, containers and infrastructure artifacts with Cloudsmith. Because we're cloud-native, your teams get fast, reliable artifact management no matter where they are in the world.
- Dependency firewall. Your team needs to stop pulling packages from open-source repositories. Use Cloudsmith as your dependency firewall. Cache packages from open-source repositories, scan for vulnerabilities and policy complianse, and ship to developers when you know they're safe to use.
- Zero trust security. Shift away from network-level security. Take control of all your valuable software IP by automating zero-trust workflows across services, teams and users - mitigating risks before they happen.
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Enterprise subscription | This Enterprise subscription includes 10TB of Package Delivery and 5TB of Artifact Data. | $159,995.00 |
Vendor refund policy
All Charges payable under the Agreement are non-refundable, except as otherwise provided in the Agreement.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Engineering-led support. From first touch to final resolution, your engineers talk to our engineers on every case - for a shared language and understanding that expedites problem-solving.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Cloudsmith
By Sonatype
Top
10
In Source Control
Top
10
In Centralized Risk Management, Agile Lifecycle Management
Top
10
In Continuous Integration and Continuous Delivery, Application Development, Security
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Universal Package Format Support
Support for 30 package formats enabling organizations to create a single source of truth for artifact management across diverse software types.
Dependency Firewall with Vulnerability Scanning
Caching of packages from open-source repositories with vulnerability scanning and policy compliance validation before distribution to developers.
Zero Trust Security Architecture
Automated zero-trust workflows across services, teams and users for controlling software intellectual property and mitigating risks.
Cloud-Native Global Distribution
Fully managed, cloud-native architecture optimized for fast and reliable artifact delivery across distributed teams and geographic locations.
ISO27001 Accreditation and Access Control
ISO27001 accredited platform with comprehensive access management, compliance enforcement and security best practices implementation.
Multi-Format Package Support
Supports up to 18 package formats including Java, npm, NuGet, Docker, PyPI, and RubyGems in a single deployment.
Enterprise Replication and Failover
Provides automatic failover capabilities and component replication to improve uptime and ensure fast artifact availability.
Component Intelligence and Analysis
Evaluates open source and third-party components for license types, security vulnerabilities, popularity, and age.
Centralized Artifact Repository
Manages components, binaries, and build artifacts across the entire software supply chain from a centralized location.
Scalable and Secure Infrastructure
Delivers enterprise-grade resiliency with scalable architecture designed for DevOps pipeline acceleration and secure artifact management.
Universal Artifact Management
Support for 60+ natively supported package and file types, including ML models and generic repositories across the software supply chain.
Integrated Security Analysis
Comprehensive security solution with contextual vulnerability analysis, vulnerability prioritization, anti-tampering mechanisms, and signed provenance integrated across the entire software supply chain.
Supply Chain Visibility and Control
Single system of record providing complete visibility and control over all inputs and outputs across the software supply chain with evidence-based governance embedded in development workflows.
Secure Software Distribution
Fast, secure distribution of verified multi-repository release bundles with capability to sync large-scale geo-distributed teams and accelerate deployments to SaaS, self-managed, or connected devices.
AI and ML Asset Governance
Control and governance of AI models, agent skills, and MCP servers alongside traditional artifacts with detection, security, and control capabilities for every AI asset.
Standard contract
No
No
No
Customer reviews
Dan M.
Exemplary Support and an Easy Web UI That Boosts Team Efficiency
Reviewed on Jul 28, 2026
Review provided by G2
What do you like best about the product?
Cloudsmith's feature-set and their support are exemplary. They have been very fast to respond to suggestions and improvements we have requested, and are always quick to resolve any issues encountered. The new web-UI is very easy to use, and has helped our team be more efficient. I have very much valued the long-term relationship we have had with them.
What do you dislike about the product?
We could benefit from some more visibility of the redundancy and backups provided, especially when we place so much trust in storing valuable assets.
What problems is the product solving and how is that benefiting you?
Cloudsmith allow us to have a single controlled source of dependencies for our projects. This means we can control what dependencies can be used, and more easily audit them.
Marketing and Advertising
Cloudsmith: Effortless Artifact Management with Powerful Security Scanning
Reviewed on Jul 24, 2026
Review provided by G2
What do you like best about the product?
Cloudsmith is a cloud native and fully managed solution for artifact management. I don't have to operate anything special on my end, it just works. It provides me with a single source of truth for all of my artifacts with a rich feature set supporting all of the formats I use and more. I love the security scanning and BOM it provides out of the box. Other solutions support this but none of them can scan my build artifacts inside of the final Docker container product; they all require an intermediary package for scanning. This made it simple to update my build processes to simply point to Cloudsmith with no additional setup. The support team is also fantastic and made onboarding a breeze. They took the time and attention to understand our needs, make actionable recommendations, and made us aware of early access and preview features we were very excited to try out such as the Enterprise Policy Management. Lastly, everything is completely configurable with IaC using Terraform, from retention rules to policies we implement. I can't ask for a better tool. We were able to onboard and see value from the feature set within weeks of signing a contract.
What do you dislike about the product?
One feature we would really like is the ability to get a complete picture of all vulnerabilities for all packages as a single dashboard so we can provide this to our stakeholders as a self-serve option to see high-level risk with the ability to drill down into the details for developers to understand and address. This is the only major gap we've identified.
What problems is the product solving and how is that benefiting you?
Cloudsmith is the single source of truth for us and unifies several tools we were self managing. The operational overhead of self managed container storage, artifact bill of materials, and vulnerability scanning is now completely gone. Additionally, we use cooldown policies to protect both our supply chain and our developers from compromised packages in external, public repositories like NPM and PyPI. As the frequency of these attacks increase, we have the confidence that we will not be breached and need to respond to a security incident because of our supply chain.
Benjamin J.
Streamlined Artifact Management with Stellar Support
Reviewed on Jun 04, 2026
Review provided by G2
What do you like best about the product?
I use Cloudsmith for centralizing the storage, consumption, and distribution of internal and external artifacts at DPG Media. I appreciate that it offers a great balance between pricing and features without over-offering functionality. I really like their customer support because they are very approachable and helpful, just one click away within Slack. The UI is really intuitive, and they support a lot of package managers, which makes it very convenient. The initial setup was very easy thanks to the workshops and guidance from the team at Cloudsmith, making it a smooth sailing experience.
What do you dislike about the product?
A lot of 'solutions', usually for niche problems, are behind feature flags. So we often have to raise an issue before it gets fixed, but then it does usually get fixed quite quickly, even if there is no feature flag available for it yet. Also, authentication is a little buggy on the website.
What problems is the product solving and how is that benefiting you?
I use Cloudsmith to centralize storage, consumption, and distribution of artifacts with a balance of pricing and features without over-offering functionality.
Semiconductors
An Excellent Platform for a Secure Software Supply Chain
Reviewed on Mar 18, 2026
Review provided by G2
What do you like best about the product?
We adopted Cloudsmith as a modern, cloud‑native replacement for Artifactory to improve our software supply‑chain posture through mandatory authentication, fine‑grained access control, policy enforcement, and strong CI/CD integration. Our teams really value its broad support for package types (npm, NuGet, Docker, PyPI, raw binaries) and its ability to consolidate ingress mirroring, internal artifacts, and external distribution into a single platform, reducing fragmentation and bespoke solutions. The team at Cloudsmith has also been an incredible partner, working very closely with us on our migration as well as new features needed to meet our use cases.
What do you dislike about the product?
Moving from Artifactory with its file-system based organization of raw repos to Cloudsmith's label based organization can be tricky. Support for security scanning of AI models is not yet publicly available.
What problems is the product solving and how is that benefiting you?
It’s great to have all our packages in one central service, giving us clear visibility across our software supply chain. We really like the model of having a single repo be able to handle multiple package types/ecosystems as it greatly simplifies things for our developers.
Rob G.
Excellent Security and Support, Smooth Package Management
Reviewed on Mar 18, 2026
Review provided by G2
What do you like best about the product?
I like that Cloudsmith offers excellent customer support, they are very hands-on, easy to get hold of and respond quickly. Good performance for everyone wherever they are located, which is great. Cloudsmith allows us to effectively manage our security posture, including defining policies for handling malicious packages, open source licensing and more.
What do you dislike about the product?
The UI refresh is nearing completion not complete quite yet, with some features only available in the older UI. It's just a few minor features that we still rely on, like the recycle bin.
What problems is the product solving and how is that benefiting you?
Cloudsmith helps us manage over 100,000 packages and images, improving our security by handling supply chain risks and vulnerabilities. It provides insights into package usage for better response to threats, and it supports our global teams with consistent performance.