United States
- U.S. enterprise clients may request SBOM or dependency review for procurement/security approval.
Trust Center
Dependencies and license review
Open-Source and Software Supply Chain
How open-source approval, license review, restricted licenses, dependency inventory, vulnerability scanning, SBOM requests, vendor SDKs, and AI-generated code review are handled.
How this page supports country onboarding
Country pages link here for enterprise, IP, procurement, and security review.
Important note
This page is general onboarding and review information. It is not legal, tax, regulatory, cybersecurity, financial, or compliance advice, and it does not create certification claims or service commitments. Final obligations belong in signed agreements and approved project documents.
Why it matters
Modern software is built from dependencies
Open-source and third-party packages can improve delivery speed, but they introduce license, security, maintenance, transitive dependency, vendor, and end-of-life risk.
Review
Review areas
Review can include approval process, license type, restricted licenses, dependency inventory, vulnerability scanning, transitive dependency risk, container images, vendor SDKs, third-party APIs, AI-generated code license concerns, and SBOM availability where required.
Client role
Client restrictions should be disclosed early
Clients should disclose open-source restrictions, approved package registries, license policies, SBOM requirements, export/security requirements, and dependency review expectations during discovery.
Preparation
Buyer checklist
Identify license restrictions and approved dependency rules.
Scan dependencies where tooling is configured.
Review vendor SDKs and third-party APIs.
Track end-of-life packages and critical vulnerabilities.
Prepare SBOM or dependency list where required by scope.
Review materials
Available artifacts
- Dependency inventory
- License notes
- SBOM where applicable
- Vulnerability scan summary
- Vendor SDK review
Local overlays
Country-specific notes
United Kingdom
- United Kingdom security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for United Kingdom: Legal review, Privacy review, Security review, UK transfer review when applicable.
- Hosting and access options to discuss: Client-owned UK cloud, UK or EU hosting by agreement, Limited production access model.
European Union / EEA
- European Union / EEA security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for European Union / EEA: GDPR review, SCC review, Security review, AI use-case review when applicable.
- Hosting and access options to discuss: Client-owned EU cloud, EU-only hosting by agreement, Limited production access model.
South Korea
- South Korea security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for South Korea: PIPA review, Cross-border transfer review, Security review, Procurement review, Regulated-industry review when applicable.
- Hosting and access options to discuss: Client-owned South Korea cloud, South Korea region hosting by agreement, Limited production access model, No-production-data-access model.
Canada
- Canada security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for Canada: Privacy review, Security review, Procurement review.
- Hosting and access options to discuss: Client-owned Canadian cloud, Canadian hosting by agreement, Limited production access model.
Australia
- Australia security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for Australia: Privacy review, Security review, Procurement review.
- Hosting and access options to discuss: Client-owned Australian cloud, Australian hosting by agreement, Limited production access model.
Singapore
- Singapore security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for Singapore: Privacy review, Security review, Procurement review.
- Hosting and access options to discuss: Client-owned Singapore cloud, Singapore hosting by agreement, Limited production access model.
United Arab Emirates
- United Arab Emirates security review should use the project risk level, data categories, hosting model, access needs, and regulated-industry flags captured in technical discovery.
- Review flags for United Arab Emirates: Privacy review, Security review, Procurement review, Regulated-industry review when applicable.
- Hosting and access options to discuss: Client-owned UAE cloud, UAE hosting by agreement, Limited production access model.
Next review
Related trust pages
IP
How client-specific deliverables, VarenyaZ background materials, open-source software, third-party tools, AI-assisted outputs, repository handover, and portfolio permissions are handled.
Secure SDLC
How security requirements, secure design, code review, testing, dependency scanning, secret scanning, CI/CD controls, release approval, and monitoring fit into delivery.
Code Review
How pull requests, reviewer assignment, protected branches, sensitive-change review, dependency review, AI-generated code review, and emergency changes are handled.
Connect this review to country onboarding
Use this page with the country onboarding guide so your legal, procurement, security, privacy, finance, and engineering teams have the right review path before contract signature.