Tidelift

The business model is centered on a subscription service sold to enterprise clients. These clients pay a recurring fee, which grants them access to a curated catalog of vetted open source components. This catalog provides assurances around security, licensing, and maintenance, directly addressing major pain points for organizations that rely heavily on open source. A significant portion of this subscription revenue, with a commitment of at least 50%, is then paid out to the independent developers and maintainers of these open source projects. Payments to these 'lifters' are determined by factors like subscriber usage and the strategic importance of their packages, creating a direct financial incentive for them to adhere to secure development practices.

The Tidelift Subscription offers a suite of tools that allow development teams to manage their software supply chain effectively. Key features include the ability to create customizable catalogs of approved components, monitor for security vulnerabilities and licensing issues, and receive recommendations for package updates. The platform integrates with a client's existing systems, analyzing their software bills of materials (SBOMs) to track dependencies and report on compliance and violations. This provides organizations with continuously updated data and attestations needed for compliance with standards like the NIST Secure Software Development Framework. Tidelift serves a diverse clientele, including prominent names like Cisco, Fannie Mae, and the U.S. Air Force. In late 2024, it was announced that Sonar had signed a definitive agreement to acquire Tidelift, with plans to extend its code quality and security coverage to open source libraries.