Tidelift

Tidelift operates as a managed open source subscription service, providing enterprises with a streamlined approach to handling the complexities of open source software. The company was founded in 2017 by Donald Fischer, Havoc Pennington, Jeremy Katz, and Luis Villa, a team with extensive backgrounds in open source from organizations like Red Hat, the Wikimedia Foundation, and the Mozilla Foundation. This collective experience shaped Tidelift's core mission: to create a viable economic model for open source maintenance, ensuring the software that underpins countless applications remains secure and reliable.

The business model is centered on a subscription service sold to enterprise clients. These clients pay a recurring fee, which grants them access to a curated catalog of vetted open source components. This catalog provides assurances around security, licensing, and maintenance, directly addressing major pain points for organizations that rely heavily on open source. A significant portion of this subscription revenue, with a commitment of at least 50%, is then paid out to the independent developers and maintainers of these open source projects. Payments to these 'lifters' are determined by factors like subscriber usage and the strategic importance of their packages, creating a direct financial incentive for them to adhere to secure development practices.

The Tidelift Subscription offers a suite of tools that allow development teams to manage their software supply chain effectively. Key features include the ability to create customizable catalogs of approved components, monitor for security vulnerabilities and licensing issues, and receive recommendations for package updates. The platform integrates with a client's existing systems, analyzing their software bills of materials (SBOMs) to track dependencies and report on compliance and violations. This provides organizations with continuously updated data and attestations needed for compliance with standards like the NIST Secure Software Development Framework. Tidelift serves a diverse clientele, including prominent names like Cisco, Fannie Mae, and the U.S. Air Force. In late 2024, it was announced that Sonar had signed a definitive agreement to acquire Tidelift, with plans to extend its code quality and security coverage to open source libraries.

Keywords: open source management, software supply chain, security assurance, developer tools, license compliance, managed open source, vulnerability management, maintainer compensation, enterprise software, dependency tracking