One private registry for every package your teams ship.

Supply-chain security

Know what you install, and who published it

A registry is part of your supply chain. Artify checks provenance at the door and keeps every tenant's packages to itself.

How it works

Three steps from invite to first install

1. 1

   Create your tenant

   Accept your invite in the Artify console, set up your tenant and create an API token for your team.

2. 2

   Point your clients at it

   Swap the registry URL in the config your tools already read. Nothing else in your build changes.

   registry=https://npm.artify.monster/
   //npm.artify.monster/:_authToken=${ARTIFY_TOKEN}

   [global]
   index-url = https://pypi.artify.monster/simple/

   [registries.artify]
   index = "sparse+https://cargo.artify.monster/"

3. 3

   Publish from CI

   Trust a GitHub repository once and publish from GitHub Actions with its OIDC identity, or use a scoped token from any other CI. Turn on signature policies when you are ready to enforce them.

FAQ

Questions teams ask first

Is Artify ready for production workloads?

Not yet for everyone, which is why access is by invitation. Maturity differs by ecosystem: the labels above follow the protocol validation results we publish for each one. We onboard early-access teams whose package ecosystems are ready and tell you plainly where the gaps are.

Do we have to change our build tooling?

No. Each ecosystem is served over its own native protocol, so npm, pip, cargo, dotnet, helm and the rest talk to Artify the way they talk to their public registries. You change a registry URL and a token, not your build.

How are tenants kept apart?

By design, every request is resolved to a tenant at the gateway before it reaches a registry service, and package metadata, tokens and access rules are scoped to that tenant. Each tenant gets its own registry namespace, with public or private visibility per package.

How does signature verification work?

Artify checks Sigstore signatures against the certificate identities you trust (for example your GitHub organization) and looks them up in the Rekor transparency log. Each policy runs in audit, warn or block mode, so you can measure before you enforce. Coverage is broadest for npm, PyPI and Cargo and is expanding to the other ecosystems.

Where is our data stored?

On Cloudflare: package files in R2, metadata in D1, hot paths cached in KV. Cloudflare holds the SOC 2 and ISO 27001 reports for that platform; Artify itself is not independently certified yet.

How fast is it?

Requests are served by Cloudflare Workers close to wherever your CI runs, with no origin servers in the path. We will publish per-ecosystem latency figures once we have a benchmark you can reproduce. Until then we make no speed claim.

What does it cost?

Pricing is not published yet. Join the waitlist and we will share plans with you when we open access for your team.

What happens to the email I give you?

We store your email and, if you give it, your company name, and send you one email to confirm the address is yours. Once confirmed, we use it only to contact you about Artify access. Unconfirmed requests are deleted after 30 days, every email has an unsubscribe link, and privacy@artify.monster deletes your signup on request.