By submitting this form, you agree to our 

That’s what I want for Northern Ireland’s software sector. And we are doing it together.

Northern Ireland is a great place to live. Culturally, we are a country of innovators and builders, and it is already a great place to build software. Whether you are starting something new or want to contribute to systems and tools used all over the world, the software industry in NI is well-established.

Yes, we have our challenges as a country, just like anywhere else. But we have an exciting and emerging startup ecosystem, circling venture capital, and we are the software development headquarters for big companies like Aflac, Allstate, and Liberty Mutual. And we finally have an official LEGO store.

I left Northern Ireland two days after graduating from Queen’s University Belfast in 2002, and lived in the United States and then England for a few years. But soon the love of grey skies pulled me back home and into a job at a newly minted startup, albeit one that struggled to find its feet. 

After moving on from my first NI-based startup. I then watched Danny Moore sell Wombat Financial Technologies to the mighty New York Stock Exchange in 2008. This was a signpost of what is possible with great leadership and execution. So when Lee and I founded Cloudsmith, our goal was, and still is, to build a world-class product company headquartered in Belfast.

There are many challenges with building a business, especially in a small country with just under 2 million people. We have great universities in Ulster University and Queen’s (and not forgetting our friends at the Open University), producing a steady stream of graduates; there is a growing talent pool and lots of opportunity for innovation.

Those who have tasted success can inspire, guide, and expand the limits of what is possible.

It's pretty unusual to be more than two degrees of (Kevin Bacon) separation away from anyone from Northern Ireland here. We witnessed firsthand the power of diaspora: Northern Ireland looks out for its own, and we made connections all over the world with folks who left to seek their fortune in faraway lands. Some have been absolutely key to Cloudsmith’s success to date, and it’s always a pleasure to hear the unmistakable accent come back at you over Zoom.

We need more success stories. We need to show the workforce that share options are worth something. We need more exits. We need to create more wealth.

I’ve seen the power of being in a well-funded startup with great, founder-friendly early-stage backers (thank you, Techstart, Frontline, and MMC) that can elevate you to take on the competition.

How do we get more money into Northern Ireland companies? How do we get the light from Sauron’s Eye shining on our little country? OK, that sounds ominous, but I mean it in a good way. How can we position ourselves as a hotbed of innovation and talent, to rival Silicon Valley or Tel Aviv?

That is something we are tackling at Software NI, but we need all the help we can get. 

 is dedicated to making Northern Ireland a global leader in technology and software innovation through community, education, advocacy, and support. Everything from championing software literacy in schools to affecting governmental policies to ensure software is part of our future.

We welcome you to engage with the community at the new 

, organized by Software NI. The inaugural event will take place on Thursday, 26th March, in The Mac. It promises to be an excellent opportunity to listen to industry leaders, including Danny Moore, discuss how they scaled their businesses and created value. I’ll be there too :)

Remember, Northern Ireland is amazing, Cloudsmith is building something great, and Software NI is striving to create an ecosystem where people and software companies of all shapes and sizes can thrive.

Alan Carson

Co-founder and Chief Strategy Officer

I love Software (in) NI

Before GitHub, everyone struggled to manage SVN (the “cool kid” at the time, pre-git), CVS, VSS, or, for the genuinely arcane, RCS. As a developer, there was trepidation with every check-in, hoping that nothing went wrong. Back then, source code management was held within a proverbial black box on some server you had to maintain, probably stuck under a colleague's desk in the corner.

Then, in 2008, GitHub emerged with a fully managed SaaS offering that gave developers and their teams visibility, control, and management.

Even before Cloudsmith was formed, Lee and I adopted GitHub in 2012. This was our first opportunity to move away from this insane black box, on-prem legacy so we could concentrate on the things that mattered. We never looked back.

Today, GitHub stores most of the world’s source code, both private and open source. Over the years, it has expanded its core functionality to include GitHub Actions and a limited Package Registry, among other enhancements.

Cloudsmith was built to solve the same challenges of visibility, control, and management but for the software supply chain and secure delivery, including binaries, artifacts, packages, and containers. In much the same way, it brings a fully managed SaaS offering to store most of the world’s packaged code, both private and open source.

Our primary goal was to help developers and operations remove the need for an artifact registry on a legacy black box on a server you had to maintain or even think about deeply. Instead, we provided the single source of the truth for all artifacts in a fully managed cloud-native platform leveraging all of the cloud’s positive attributes, including reduced infrastructure costs and the best scalability and performance, all at the click of a button, just like GitHub.

Today, Cloudsmith proudly sits beside GitHub in our customers' tech stacks, showcasing our commitment to “works well with others” and ensuring our customers have what they need to build secure and performant pipelines, distributing source and packaged code when and where it is required, whether internally consumed, or delivered across the world.

Our integration with GitHub gives development and DevOps teams an easy and secure way to manage source code and the resulting packages through:




Use GitHub as your IdP to sign into Cloudsmith.




Use our GitHub Action to publish packages to Cloudsmith across all popular formats.




Use GitHub as an OIDC provider for integrated authentication and more robust security.




We scan and tag your packages using scanning data sourced from GitHub's advisory databases for Hex, Java, .NET, Node.js, PHP, Python, Ruby, and Swift.




We work alongside GitHub and GitHub Advanced Security to protect software's ingress and egress risks.

With the advent of popularized Gen AI, there is now more than ever a wealth of data, with new ways to consume and query it. It’s an obvious next step to share that knowledge created by deep developer-interactive tooling like GitHub and lean into the knowledge Cloudsmith is capturing about the security and provenance of both open-source and closed-source software.

That’s why we launched Cloudsmith Navigator last year, to surface curated provenance information about open-source packages, powered in part by GitHub’s history of the source code. Navigator offers a glimpse into the nature of the holistic knowledge we have access to, and it’s this knowledge that forms the foundations of additional risk-based policies and controls.

A wise wizard once told me (okay, it was last weekend), “[it’s important] to bring more of the developer tools in the place where they already work.” In other words, you want to build a bridge towards existing tooling and make it easy for others to integrate rather than being isolationist and building all-in-one platforms that are anti-competitive. It makes sense to achieve genuinely “works well with others” and fits into our strategic thinking and positioning for Cloudsmith.

We believe it will take a village of partnerships, with at least two cathedrals (GitHub and Cloudsmith 🙂), to put the best guardrails in place to minimize the risks of open-source and closed-source software. That means continuing to partner with companies that share our cooperative mission to secure software delivery, like our friends at Docker, CircleCI, Stacklok, Chainguard, and GitHub.

How to Integrate Cloudsmith with GitHub Actions

Using GitHub Actions to Push Packages to Cloudsmith

Two Cathedrals: Cloudsmith + GitHub

 is exciting! The promise of a better work life and smoother software production is within reach. But given artifact management’s position at the center of your CI/CD process, we also know there’s a lot at stake if you choose the wrong solution.

To make your shortlisting and selection more successful, I’m here to arm you with info about the features and services that define truly modern artifact management tools. These are game-changers for streamlining your development pipeline and elevating your DevOps team's efficiency. I’ll also describe what good looks like, so that you’re better equipped to compare and evaluate your options.

Mature organizations commonly use multiple programming languages in their software. This is great for developers, who get to code in the formats they know inside-out, but it can be a nightmare for your operations teams that have to manage that plethora of tooling. Creating, maintaining, and updating access, security, integrations, etc, across multiple management environments is repetitive, time-consuming, and error-prone. Workflow complexity becomes dizzying, as every package format’s native tooling has different limitations that necessitate unique configuration. Finally, the more touch points there are in a system, the more likely it is that something can go wrong.

A tool that can store, manage, and secure ALL of your organization’s package formats, together, allows your DevOps team to focus on delivering high-quality software without the hindrance of format-specific package management. By centralizing your assets in a single platform, you can:

streamline monitoring, ops, and workflows;

introduce consistent dependency management;

increase knowledge sharing and cross-team collaboration;

enable teams to adopt a consistent set of commands and practices, which leads to faster development cycles;

effortlessly enforce identical security practices with all asset types.

A quality solution that claims universal format support will:

cover of all of the major programming languages (expect 20 languages at minimum);

accommodate operating system packages like Windows and Linux; and

, which give you ultimate flexibility to organize your storage however makes most sense to you. For example, you might group by languages to simulate the workflows in familiar public repos, or you might instead group packages by team, by project, by environment, or by status (eg, scanned and approved vs unauthorized).

The importance of dependency management is well established in DevOps. Reliance on external libraries, frameworks, and packages to cut development time and effort is standard practice in our industry, but what we gain in efficiency we lose in security and stability. External dependencies suddenly become unavailable; are vulnerable to malware (especially public OSS packages); and their code is constantly evolving, which can jeopardize our software’s functionality and performance. We use tools like npm, Maven, and Java to manage dependencies—tracking and retrieving the correct versions for our builds—but version control is only the tip of the iceberg when it comes to protecting this portion of our software supply chains.

To increase the safety of the external components entering your pipelines, choose an artifact management platform with dependency firewall functionality. The power to apply forensic checks and controls to all of your dependencies will:

When comparing package management tools, I recommend you look for:

upstream package proxying and caching as a moat to protect your infrastructure from dangerous packages and external outages;

automated security scanning—upon initial upload and every promotion—including:

support for policy enforcement. In other words, make sure that you can customize how to handle security threats according to 

 policies—for example you might want to block all high-severity dependencies from download or create rules that quarantine medium-severity threats for examination but ignore low-severity threats; and

an API that inspects digital signatures and checksums, so you can detect unauthorized changes to dependencies and verify that teams can only use the desired version.

When you build with commercial and open-source third-party assets, most come with a EULA—a legal agreement defining how you’re allowed to use, modify, and distribute that software. Early awareness of and consistent adherence to every asset’s T&Cs is critical. Otherwise, your organization exposes itself to uncertainties over IP ownership and distribution rights (in the best case) and to the possibilities of lawsuits, fines, injunctions, and a commercially unusable product (in the worst cases). Take a copyleft license like the GNU General Public License, for example. If an OSS package with this license makes its way into your software, suddenly your IP is no longer your exclusive IP. Others technically have the right to freely modify and distribute your work. Yet manually monitoring and managing a high volume of software licenses is impractical.

Top-quality artifact managers include the feature sets you need to replicate your company’s licensing policies in your package management workflows. This helps protect you by:

making it easy and efficient to enforce your license policies across all teams;

preventing the legal, financial, and reputational risks associated with breach of contract; and

reducing the rework and delays that result from late discovery.

To choose a solution that takes license compliance seriously, keep your eyes peeled for:

features that let you specify which precise licenses are permitted to enter your pipeline and which are not;

controls to define policy rules and automate actions on how to handle packages with missing licenses, unknown licenses, and recognized licenses that don’t meet your policy requirements (eg, flag, quarantine for review, deny);

a robust schedule of policy compliance checks—for example, automatic checks whenever a package is uploaded, moved, copied or cached; and

at-a-glance reporting and a dashboard of license metrics, so you can:

monitor and audit the compliance status of your pipeline; and

quickly sort and ID all packages that use a license that no longer fits new policy updates.

Your company’s software teams and developers are probably distributed across dozens—or even hundreds—of locations. What’s more, the rise of cloud-native CI/CD means that many of the processes that your packages feed into (and emerge from) live in the cloud. So when you have people and processes that are fully remote, yet your packages are on-premises or merely cloud based, availability, performance, and productivity suffer. Engineers struggle to collaborate and access packages at the rate they need. Everyone gets hampered by downtime delays and slower build processes. And costs spiral for DevOps because you have to spend so much money and effort standing up instances around the globe; dealing with VPNs, clustering, and CDNs; and maintaining and scaling your package manager.

Cloud-native solutions like Cloudsmith, on the other hand, alleviate these pains, dramatically simplifying and optimizing the way teams work. They’re turnkey. They’re built from the ground up to capitalize on today’s cloud capabilities and the marvels yet to come. And while the benefits of cloud-native package management solutions are vast, a few notable perks include:

higher reliability—they’re built for availability and reliability on a 

 scale, ensuring that the smallest customers benefit from the same infrastructure investments that are supporting the largest customers;

faster software delivery and distribution;

greater competitive advantage—because teams now have the bandwidth to rapidly react to changes in the market and the reliability and performance they need to release more quickly;

instant platform enhancements—cloud-native platforms release new and improved features that are immediately available to users without the need for an upgrade project;

a consistent user experience everywhere in the world; and

cost savings, thanks to a lower total cost of ownership.

Don’t confuse a cloud-based platform for a cloud-native platform. This might be the biggest gotcha in choosing a new artifact management solution. The terms ‘cloud hosted’ and ‘cloud based’ have emerged as a smokescreen to disguise on-premises enterprise platforms that have simply been hosted on the cloud, as separate single-tenant instances. This means scaling up for heavy loads, and delivering globally as a CDN, will be more challenging and put more onus on the customer. 

The simplest way to tell whether a platform is cloud native or cloud based is to ask vendors outright. But if they’re evasive, know that a cloud-native solution has:

built-in high availability, so you don’t need to specify up front what geographies you might need to support or how much load you think you might need to scale for;

automatic scaling without intervention by DevOps—ideally with elastic load balancing and node layers that instantly increase capacity as service demand rises;

multiple data centers, regions, and availability zones—with redundancy built in at each service layer and platform layer.

Self-managed package management solutions divert valuable time and resources away from core development and deployment activities. They require your DevOps team to handle tasks such as server provisioning, configuration, updates, and scaling on its own. These substantial overheads make it hard to maintain a stable and secure infrastructure because day-to-day upkeep quickly becomes your full-time occupation, leaving little resource left to keep pace with evolving security threats or adopt new features and improvements.

A fully managed artifact management solution, on the other hand, offers numerous benefits, including:

more time for your team to focus on strategic initiatives;

up-to-date security patches and performance optimizations.

When evaluating package management platforms, check for these specific features and functionality to see if a tool is truly fully managed:

automated scaling—a fully managed platform should dynamically scale resources based on demand to ensure optimal performance during peak usage periods;

availability metrics—compare vendors’ 

 for uptime, performance, and incidents to determine which is delivering the most reliable, hassle-free experience and whether the platform is being fully managed 

integration with popular CI/CD tools so that it will seamlessly incorporate into your development pipeline.

built-in monitoring and analytics tools for insights into your usage patterns and potential issues.

I hope this list helps you flesh out your selection matrix, equips you for conversations with vendors, empowers you to make smart decisions, and sets your team on a path to success. Good luck, happy shopping, and if you’d like to add Cloudsmith to your mix of artifact management solutions to explore, start a fully-featured 

 and we’ll happily answer all of your questions!

6 Essential Features for Your Next Artifact Manager

I heard something recently, that resonated, about success. In a simple (but not easy) three-step plan; success happens when the following three things align:

A great example is, of course, Steve Jobs and Apple. The contrarian idea was that every single human would need a personal computer. He was proven right. And he executed expertly (with a few ups and downs obviously!)

“Innovation distinguishes between a leader and a follower.” - Steve Jobs

When we started Cloudsmith, our contrarian idea was that all software artifacts belong in the cloud. It’s the only place to democratize the accessibility of open-source software AND the software you build yourself. Back in 2016, there were some discussions about software bills of materials (SBOMs), package dependencies, and software security; but no one had yet popularised the notion of Software Supply Chain Management (SSCM).

Cloudsmith was one of the first companies to identify SSCM as a burgeoning problem and built a platform (and service) to solve this issue for customers and the wider ecosystem. It was a hard problem to solve.

We have been proved right; SSCM is now an accepted industry-wide discipline.

At the beginning of the year, as co-founder and CEO, I came to the conclusion that we needed a refresh in management. After positive discussions with the Board, we agreed to investigate the possibility of bringing in a strong go-to-market leader, based in our primary market, the US. We had a large list of other criteria but it had to include a history of success in growing startups and serving the software development community.

We got lucky. Again.

Fairly early on in the process, I was introduced to Glenn Weinstein, then the Chief Customer Officer at Twilio. We had an instant rapport, and a fun initial conversation relating his background to Cloudsmith.

About a week later, we scheduled interviews with three “round 2” candidates on the same day. I remember the feeling of relief when I realized the first call was with Glenn. It was an important moment. The feeling was really telling. He instantly jumped to the top of the list.

We spoke to some fantastic candidates all with excellent pedigree but Glenn always and consistently stood out.

A Computer Science graduate, a veteran of the US Navy, a co-founder of a startup that grew into a mature exited business, and a customer-focused C-Level executive at one of Silicon Valley’s best tech companies.

When we kicked off the process, Jason at Daversa Partners said if we did everything right, we could get someone hired in about 4 months.

do everything right but still managed to do it within 4 months.

Fortune favors the bold. We’ve been bold 

Glenn started on August 21st, and it's been an awesome whirlwind for us both. His people skills, his awareness, and his positive attitude have given the team a new growth mindset.

I look forward to many years working closely with him, to build Cloudsmith into the tech juggernaut we know it will be.

So to Glenn, I ask one thing; Go execute massively.

PS: Thank you to the following people for their support and advice throughout this process; Steve, Nicola, Jason, Sarah, Will, Danielle, and last but never least, Lee.

Welcoming new leadership at Cloudsmith - a note from Alan Carson

Yesterday we launched the third iteration of cloudsmith.com

JUST LOOK HOW AWESOME AND BEAUTIFUL IT IS!

The new website is a significant upgrade in every way, from tech stack to color, structure to copy. Absolutely everything with the existing site was poked, probed, questioned, and rebuilt from the ground up.

The project, headed up by our own Paul May, working with 

, have built something great. A new brand, a new site, and a whole new design language that embodies the Cloudsmith product and mission; to provide world-class support for artifact management, software distribution, and helping companies lower their risk with software supply chain management.

Perhaps the most significant change is the new brand mark. The new logo represents the next stage of evolution for Cloudsmith. We are past the initial startup stage, firmly into scale-up mode, and slowly over time, a maturity has seeped into the company. And the new logo is a reflection of that.

Cloudsmith was named as such to represent our passion and drive for cloud-native, and a product sitting central to the ecosystem of dev tools for building software pipelines.

There were some fairly obvious attempts (by others) to brand cloudsmith (with a small c here to represent the others that used the name, or variations of the name) as a cloud with a hammer.

When we came to branding Cloudsmith initially we didn’t want to be so obvious. After a few rounds of pitching and discussion, we landed on the mark that we’ve used since 2016.

A sort of amorphous blob, that kind of looked like a ‘C’, kind of looked like a cloud (on its side) and kind of looked like the common share icon. Married up to the text mark, in Ubuntu Bold font (we were proud of that choice) we ended up with a logo that remained pretty consistent as it has spread over the internet, events, and merch over the last seven years.

We grew to really love it. We had fun with it. We used to hide it both in plain sight and somewhat subtly in stock images we used for blog images. When we started generating art in-house for the blogs, we’d be creative with it.

It wasn’t without issue though. Its “center of gravity” wasn’t central, and so for places like Twitter where it was enclosed with a box or circle, we had versions where it was off-centered so that it looked central. And over the years, similar logos have appeared in lots of places. But as we were building awareness, we were reluctant to change something that seemed so core to the company, product, and ourselves.

There is nothing permanent except change.
(Heraclitus)

It was time. Time to change. Time to grow up and relinquish some control. Take all the things we’ve learned about the company, the market, and our amazing customers, and distill it down into something new.

Cloudsmith has always been about delivery. Distribution. Providing the artifacts you need, to where you need them. Building software pipelines, deploying software, distributing software to your customers. We provide that fully-managed core infrastructure for you, twenty-four hours a day, seven days a week. It’s foundational tech that drives business value and saves you a lot of heartache.

Everything we do, we do to make developers' lives easier.

The new logo represents that. A simple design (simple is hard, btw) that encapsulates the thematic pipelines and artifacts that drive our value to you. The inner circle harks back to the old logo and where we came from. The mechanical nut similarity emphasizes the ‘smith’ side of building something great.

A New Lick of Paint

"Life moves pretty fast, if you don’t stop and look around once in a while, you could miss it."
Ferris Bueller, 1986

It is… isn’t it? As another year comes to a close, we thought we’d highlight just some of the amazing things we’ve accomplished in 2022, and give a little insight on what goes on behind the scenes at Cloudsmith.

Let’s start with a BANG! Our resident art wizard, Shannen, has created this retro video game themed infographic with some of our metrics and major achievements for the year. I hope you’ll agree that it’s been an impressive year of growth for Cloudsmith, despite a difficult year for many across the globe.

We are trying to solve problems in an ecosystem that’s quickly changing. We see artifact management as software supply chain management - Cloudsmith is a fully managed, cloud-native platform that can provide isolation from public upstreams, full observability, provenance, and control over software artifacts. A reliable single source of truth that they can trust.

The last ~5 years have been about security. The next 5 years are going to be about trust. Our mission is to be at the forefront of that category. To solve developers' problems. To make developers' lives easier. To trust Open Source. To reduce risk for organizations. We are super excited about tackling these challenges next year.

Lastly, I want to wish you all a peaceful holiday season. Relax. Recharge.

Cloudsmith 2022

plans (OSS not affected by changes); however, significant features have been moved down (or added). We did it to build a better Cloudsmith. You may find a better fit at a lower or higher tier, so view your organization's subscription page to see the vital differences.

Buckle up. This is a long post but a necessary one!

You’ve probably heard that we changed the pricing plans late last week. And we wanted to dig into the why behind the changes, give you our reasoning for doing so, and let you know why it represents incredible value across all plans. So let’s talk about it...

This pricing change is the first that we’ve made since 

, before the global pandemic, and only the second in the company's history; would you believe we have been talking about the shape and structure of our pricing 

Over the last three years, we have watched our community grow; we constantly listened to you, our illustrious customers, and our swathe of advisors, stakeholders, and partners. All of whom held strong opinions on how we should charge and what should be charged.

We don’t make changes without deep thought and consultation, and the decisions for things like this are never easy. The bottom-line driver for the change is building, delivering, and supporting more value than ever before. It’s a reinvestment for growth.

So, let’s revisit why we’re doing this in more detail, and then we can arrive at what it means for everyone, both for us and you. Ultimately, though, it’s to 

To enable security at the core of the software supply chain

We are a part of your software supply chain and, in some cases, the driving factor, so as a vital link in worldwide distribution from source to the point of delivery, security is at the core of our concerns (as it should be, yours!) Building a high-quality and secure product isn’t easy or cheap, but it’s an essential part of our investment in the ecosystem.

In addition to implementing deep security at Cloudsmith and ensuring that we meet standards such as ISO27001 and SOC2, we also want to ensure that any customer using Cloudsmith can quickly and simply implement secure artifact management best practices and processes, something that we coined as Continuous Packaging.

To evolve Cloudsmith into something even better than before

We want to build the world’s best Artifact Management solution in the Cloud 

. A lot has changed around artifact management since 2019 - improved solutions for automation, wider adoption of DevOps, more focus on security, and a dramatic rise in software supply chain attacks. The post-pandemic world is also a very different economy, and together with the evolution of the ecosystem, companies worldwide (including Cloudsmith) need to adapt.

We believe Cloudsmith is well-positioned to help organizations adapt to the changing landscape by enabling them to solve problems of scale and complexity through cloud-based artifact management. We provide end-to-end visibility and control of software assets, data, and dependencies, from source to delivery.

We believe strongly in listening to our customers as we build a product that solves their needs. In addition to driving our product roadmap, your feedback also contributed to the new plans we’ve rolled out. We want to ensure customers can find a plan that meets their needs now and as their organizations grow and require more complex compliance and security.

Our services will continue to evolve to ensure we can meet the needs of our customers in the future, and we will solve problems of trust at scale with a single global source of truth for all software, underpinned by the best-in-class Artifact Management in the Cloud; exactly as designed based on your feedback wants and needs.

Like security, scaling isn’t easy, and we need to balance supporting customers and building more value into the service. The pricing increase will enable us to re-invest more back into the product while still maintaining our capability to help you as you grow with Cloudsmith. In short, more and better value across your organization faster than before.

Pricing has increased across all paid plans; however, significant features have been moved down (or added) to enable secure artifact management across all plans. To best understand the impact on your organization, please view your subscription page in the application to see the vital differences. The changes make it easier and cheaper for you to lean into Cloudsmith and reap the benefits of global distribution at scale, with more control and visibility built-in.

Providing universally secure Artifact Management at the core

We care deeply about security. We see Cloudsmith becoming a vital part of our customer's security toolkit every day. We want to enable any team using Cloudsmith to implement best practices in terms of security. We’ve moved Single Sign-On via SAML, Audit Logs, Sigstore Cosign, and Service Accounts from Ultra-only features down to Team (and beyond). We’ve also introduced the ability to quarantine packages, with automation being introduced later.

Supporting your ability to Automate Everything via Service Accounts

Service accounts are finally here! One of the most requested features, we’ve rolled these out for all paid plans. Service accounts will allow you to create bot users without associating them with a Human, which will enable us to deliver the promise to help you automate everything (one of our core philosophies). When hooking up your favorite CI tool, like CircleCI, you can use a restricted-access service account to help you automate efficiently.

Introducing scalable usage-based storage and bandwidth

One of the exciting things about artifact management and end-to-end software supply chain is that it is constantly changing. The flow of artifacts from your private CI processes or the pull from open source means that the “catalog” of available artifacts is continuously in flux.

Every time there’s a change, we process those changes. Our team is continually monitoring the stability and security of the Cloudsmith platform. As you scale, we scale. So when we charge for storage and bandwidth, we do so because it’s managed storage and bandwidth.

That doesn’t mean it has to cost the earth, and we listened to your feedback regarding both the tiered scaling of storage/bandwidth pricing and the limits imposed.

The new Cloudsmith plans include the following changes:

Substantially increased the “free” storage and bandwidth you get per tier. Before, each tier had a flat 30GB of storage and 60GB of bandwidth. Now Team provides 50GB of storage and 100GB of bandwidth; for Velocity, it is 200GB of storage and 400GB of bandwidth, and so on.

Removed the hard limit cap for Team and Velocity, which previously would have forced you to move up tiers to unlock more. In other words, there’s no boundary to which you can scale storage and bandwidth.

Active limits for users and entitlement tokens

We’re introducing usage-based limitations to plans for active users and active entitlement tokens for the first time. These are currently for monitoring purposes and won’t be actively enforced until a later date (more on that later). First, let’s define what we mean by “active.”

An “active user” is defined as a user in your organization who interacts with the service, either via the UI or by using their API key, within the current billing period. For example, you may have 30 users invited to an organization, but in the past 30 days, only five have logged in, and only 1 uses their API key, then there would be six active users.

An “active token” (entitlement token) is a token in your repositories that interacts with the service, usually by downloading assets, within the current billing period. For example, if you have 200 customers, but in the past 30 days, only 100 used their token to download software, then there would be 100 active tokens.

These changes are intended to be usage-based later, to facilitate organizational growth without moving up plans (and ensure we’re delivering values at the proper levels, either for internal developers/deployers or external distributors).

The “When are the changes happening?” section later describes the “when” for rollout.

Your plan will vary depending on your organization's needs, your belief in Cloudsmith, and your desire for specific features or outcomes. You may be best staying on the same plan (and, in some cases, better off), or you may wish to either downgrade or upgrade. The first step is to compare your existing plan with the new plans via your organization's subscription page to see the differences.

Great! As you know, we love open-source software. If this is your organization, you won’t need to take any action. OSS repositories will continue to access most of the Team plan features as before (excluding SAML and Upstream Proxying). We realize that the active users limit makes this awkward, but they’re not enforced yet and won't be for OSS organizations. We’re likely to move you to a unique OSS plan (or something similar) later that takes care of this. The bottom line is that we support you and will find a home for you at Cloudsmith, no matter what, and you won't need to make any changes.

Your organization is on a Legacy (pre-Team/Velocity/Ultra) plan.

If your organization is on a plan type that predates our Team, Velocity, and Ultra plans, you’ve been supporting Cloudsmith for a long time - and we appreciate that!

There are three key considerations to determine the best plan for your organization:

What are the features your organization needs?

How much storage and bandwidth do you usually need?

Based on those inputs, you may find that downgrading to the Core (free) plan or upgrading to the Team plan suits your needs better. Regardless of your pick, you’ll likely see significant additions to the features. If you need help deciding or want to discuss your options, ask us, and we’ll be happy to help!

The Cloudsmith Team plan increased in cost - but in addition to an increased quota for built-in storage and bandwidth, it also had significant features added to it, including SSO with SAML, service accounts, audit logs, and quarantine.

We believe these new features bring the best essential artifact management and security to the Team plan. However, if your organization does not require these features, or if you’re an individual or small company, you can now consider the Core (free) plan too.

Your organization is on the Velocity plan.

The Cloudsmith Velocity plan increased in cost - but in addition to a significantly increased quota for built-in storage and bandwidth, with an unlimited overage allowed, it’s become the sweet spot for organizations that need advanced insights, control, security, and team management, that aren’t quite yet at a point of requiring Enterprise-grade compliance features.

Suppose your organization does not benefit from the increased storage and bandwidth and doesn’t need the advanced insights, controls, and user/token capacity. In that case, you may want to consider downgrading to the Team plan instead.

The Cloudsmith Ultra plan is best for teams tackling significant problems of scale that need Enterprise-grade compliance, performance, and support. If you are already an Ultra customer, that’s likely because this description matches your needs. Otherwise, if you need a customized quote, you can contact us (see below) to get one that fits your needs.

Beyond Enterprise-grade artifact management, you can access volume-based discounts, an excellent option for customers with high storage and bandwidth needs to control their costs better. We also offer Enterprise-tier support as an add-on, with several benefits, including a first response SLA, rolling support hours, emergency escalation, a dedicated technical account manager, and more.

These changes will affect accounts on their first billing cycle renewal after July 1, 2022. So for those on annual subscriptions, it may be at a much later date. Please check the billing management page for your organization for more details.

We hope that gives adequate time to prepare for the changes, but as with everything related to billing and costing, please reach out if you’d like to discuss the timeline in more detail or need additional help dealing with them.

As for enforcement of the “active” limits (such as active users, active tokens, etc.), these won’t be enforced until 

(a) listen to feedback on these changes before finalization of limits and;
(b) notify you in advance before activating enforcement of the limits, and;
(c) ensure there are dashboards and notifications in place for monitoring first.

We've spent a lot of time and effort crafting plans that enable our customers to get the best out of the Cloudsmith platform. We've listened to feedback and looked at the data, and we hope we've found the right mix of features, limits, and value for each of the tiers.

We hope this post answers all the questions you have, but if you are still unsure what plan is right for you, get in touch. We would be happy to discuss your use case and see how we can ensure Cloudsmith can meet your needs.

Cloudsmith Blog

I love Software (in) NI

Two Cathedrals: Cloudsmith + GitHub

6 Essential Features for Your Next Artifact Manager

Welcoming new leadership at Cloudsmith - a note from Alan Carson

A New Lick of Paint

Cloudsmith 2022

Pricing: Building A Better Cloudsmith

Pricing: A Message from the Founders of Cloudsmith

Understanding and Implementing a Software Bill of Materials

Improvements to Dart Package Support

th3_GR1NCH who wanted to steal Christmas

Cloudsmith By the Numbers 2021