Every licence in your stack, SPDX-ID: accounted-for and defensible.
Orcro is a software supply chain compliance practice with deep open source expertise — built for the era of the Cyber Resilience Act, SBOM mandates, and AI-assisted code.
Programmes that hold up to audit, M&A and [something appropriate with compliance/legal].
// services! [marketing tag here][lower]OpenChain ISO/IEC 5230
Implement an internationally recognised open source compliance programme — and certify it. Orcro is the UK’s first accredited certification provider.
→ §2[higher]Code scanning & clearance
Know your code and your obligations. SBOM generation, composition analysis, and clearance — including M&A due diligence on both sides of the table.
→ §3Regulatory readiness
Cyber Resilience Act scoping, SBOM obligations, and data protection — turned into practical, defensible processes rather than shelf-ware policies.
→ §4Tooling & DevOps integration
[update list]Black Duck, Flexera, Mend.io, SW360, FOSSology — configured, tuned, and wired into your pipeline so the expensive tools you own actually earn their keep.[hyperlinks to case studies]
→ §5[higher]Counsel to counsel
Software supply chain expertise for law firms and professional services firms advising on transactions, disputes, and compliance programmes.[put some wording here, what would legal want to see?]
→ §5ai something something
[something about ai use and licensing]
→ → §5capability modelling
[something about capability modelling goes here]
→Successful outcomes
// engagements, anonymisedNine-figure deal, IP clean lines proven
Process-level diligence under ISO 5230 — not a static scan report — protected valuation and expedited closure.
Supply chain · §C-06What the automated scanners missed
An entire embedded Linux stack shipping with zero compliance documentation — found by process audit, fixed without halting production.
Innovation · §C-07A market-first insurance product
ISO 5230 built into underwriting parameters, letting a specialty insurer quantify open source risk in technology deals.
Compliance is a journey. We can’t flatten the hills — we make the climb manageable.
// the Orcro approachneeds to be done. We start with your business culture, risk appetite and budget — then define scope.
it gets achieved. Processes, governance, technology and training that fit how your teams actually work.
does it. Clear ownership, with detailed costings up front — no surprises, no scope drift.
We’re self-proclaimed geeks — lawyers and engineers in the same room. We want compliance to be a competitive advantage — something that grows your business, not a brake on it.
Relax. You’ve found Orcro.
Tell us where your software supply chain stands today, and we’ll tell you — plainly — what it would take to make it defensible.
get_in_touch → [fix button, add contact page]