CleanStart: Secure Software Supply Chain and Hardened Container Images
CleanStart Security · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
Organizations today face significant risks from vulnerabilities in base container images and opaque software supply chains, which often lead to security breaches and compliance failures. Traditional image building processes lack transparency and frequently include unnecessary packages that expand the attack surface. CleanStart addresses these challenges by providing a software platform that builds container images from the ground up using a deterministic and hermetic build system.
The platform delivers hardened, debloated container images that are built from source and aligned with SLSA Level 4 principles for strong provenance and transparency. By ensuring near-zero known vulnerabilities at the time of release, CleanStart provides a secure foundation for enterprise applications. This transition from vulnerable public images to verifiable, minimal images allows security teams to maintain a proactive posture against supply chain threats.
Show the rest of the publisher’s description (1 more line)
Core capabilities include native SBOM and AI BOM generation, cryptographic verification, and policy-driven enforcement for container security. CleanStart helps organizations simplify compliance with standards such as CIS Benchmarks, DISA STIGs, and FIPS 140-3. Typical use cases involve securing cloud-native applications, establishing trusted internal registries, and automating vulnerability management within the DevOps lifecycle.
Highlights
Highlighted by the publisher on AWS Marketplace.
Secure and verifiable container images built from source using deterministic and hermetic build systems aligned with SLSA Level 4 principles.
Automated generation of SBOM and AI BOM providing full transparency and traceability for all components within the software supply chain.
Hardened and debloated images that comply with CIS Benchmarks and DISA STIGs to reduce attack surface and simplify security audits.
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment
Plans and pricing as listed
1 listed- Units
Refund terms
As stated by the publisher on AWS Marketplace.
All fees are non-refundable. We do not provide refunds or credits for partial subscription periods or unused services. All sales are final.
Sources
Publisher resources
2 linksLinked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.