SignPath

SignPath is a software integrity platform for policy-based code signing, founded in 2017 and based in Vienna. It moves signing out of developer workstations and into a governed service: signing policies are enforced per project and release, private keys stay in FIPS 140-2 Level 3 hardware security modules hosted by SignPath or managed by the customer, and every signature is tied to a verified build. The platform adds pipeline integrity checks and software attestation, generating SLSA provenance records, in-toto attestations and signed SBOMs, with native integrations for GitHub, GitLab, Azure DevOps, Jenkins and TeamCity alongside REST and command-line access. It maps directly to the EU Cyber Resilience Act, NIST SSDF and IEC 62443, which makes it a natural complement to certificate lifecycle management for organisations that have to prove where a signed artefact came from.