Sigrid
Amsterdam-based Software Improvement Group's platform for measuring maintainability, architecture and security across software portfolios
Quick Overview
| Company | Software Improvement Group B.V. |
|---|---|
| Category | Static Code Analysis Tools |
| Headquarters | Amsterdam, Netherlands |
| Founded | Not stated |
| EU Presence | Yes - Netherlands (EU) |
| Data Location | SaaS, or Sigrid On-Premise in your own infrastructure |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - Sigrid On-Premise (Kubernetes deployment documented) |
| Main Features | Maintainability rating, architecture drift detection, security findings, open source health, SBOM import, SARIF import, Sigrid Axis guardrails for coding agents |
| Pricing | Free trial; pricing on request |
| Best For | Organisations governing quality and technical debt across many systems |
| Replaces | Veracode (portfolio reporting), SonarQube, Checkmarx |
Detailed Review
Sigrid scores systems against a benchmark of 40,000+ systems and an ISO/IEC 25010-based quality model, and SIG states its lab is ISO/IEC 17025 accredited. It reports on maintainability, architecture, security and open source health.
The controller named in the privacy policy is Software Improvement Group B.V., Fred. Roeskestraat 115, Amsterdam.
Core and Axis
Sigrid Core is the portfolio control centre with board-ready reports, while Sigrid Axis puts deterministic guardrails around coding agents and can start with a single system.
Security through imports
The documentation describes importing security findings from tools such as Fortify and Checkmarx, and importing custom findings via SARIF. Sigrid therefore works as a governance layer as well as a scanner.
On-premise
The documentation includes a Sigrid On-Premise setup with Kubernetes deployment, for organisations that cannot send code to a SaaS service.
Limitations to Consider
Sigrid is aimed at portfolio governance and measurable quality, so a single small team may find it heavier than a pull request scanner. Pricing is not published. It is less a drop-in SAST replacement than a quality and risk platform, so pair it with a security-focused scanner such as Aikido Security where needed.
Who Should Use Sigrid
CTOs and engineering leaders at larger organisations who need a benchmarked view of quality, architecture and risk across many systems from a Dutch vendor.
Pros and Cons
Pros
- Benchmark of 40,000+ systems
- Architecture drift detection
- On-premise option
- Imports security findings from other tools
- Dutch vendor with ISO/IEC 17025 accredited lab (per vendor)
Cons
- Portfolio focus, heavy for small teams
- Pricing on request
- Security often relies on imported findings
- Less known to developers than SonarQube
Alternatives to Sigrid
Other European static code analysis tools worth comparing before you decide:
SonarQube
Switzerland · Swiss code-quality platform with SAST, secrets detection and AI fixes
Qodana
Czech Republic · JetBrains code quality platform that runs the IDE inspections in CI
Teamscale
Germany · Software quality platform covering code, tests, security and architecture
Codacy
Portugal · Automated code review and quality gates with AI-assisted fixes
See all European static code analysis tools or compare them directly against Veracode (portfolio reporting) on our alternatives page.
Frequently Asked Questions
It reports security exposure and can import findings from tools such as Fortify and Checkmarx, but its core strength is maintainability, architecture and portfolio governance.
Yes, the documentation describes Sigrid On-Premise with a Kubernetes deployment.
Axis is the product that applies guardrails and auto-fix to code written by coding agents, separate from the portfolio view in Sigrid Core.