Trace software to its source
Third-party code you ship is part of what you are selling.
Import SPDX or CycloneDX from the tooling you already run, and Intangible HQ places those components in the ownership picture: which product uses them, under which licence, and what that means for a package that is about to move.
SBOM & Third-Party Components
- SPDX import
- CycloneDX import
- Licence metadata
- Dependency relationships
How it helps
What you get with SBOM & Third-Party Components
Standards in, not scanners rebuilt
SPDX and CycloneDX import keeps your existing SCA tooling authoritative for detection. This layer answers the ownership question.
Licence context per product
Component licences are read against the product and package that include them, where copyleft or attribution terms actually bite.
An SBOM is not a title opinion
Composition data proves what is present. It says nothing about who owns the proprietary code around it — the platform keeps the two apart.
Software Provenance
The rest of Software Provenance
Connect repositories, contributors, agreements, components, releases and SBOM data to legal ownership.
Repositories
Inventory repositories, organizations, releases and technical custody.
Learn moreContributors & Agreements
Connect contributor identities and contribution periods to the agreements that cover their work.
Learn moreSoftware Products & Components
Model proprietary products, shared core components and brand-specific derivatives separately.
Learn moreAI Models & Datasets
Track models, training and fine-tuning datasets, evaluation sets and related rights.
Learn moreBuild the ownership record before somebody asks for it.
Register what exists, connect the relationships, attach the evidence. The answer you need under deadline is the one you maintained beforehand.
Evidence-backed relationships Multi-entity by design Built for transfer and diligence