Cloudsmith is a managed artifact management platform for software packages and containers. It stores and distributes many package formats, including a Docker- and OCI-compliant container registry, and can proxy and cache public upstream repositories. It scans packages for malware, known vulnerabilities and licence risks, and supports policy enforcement and promotion workflows. It is delivered as a fully managed service.
The operator is Cloudsmith Ltd, based in Belfast, Northern Ireland. The United Kingdom is outside the EU and EEA. The company's website names TCV as the lead investor in its most recent funding round. The pages reviewed do not state where customer data is stored or whether an EU hosting option exists, and the privacy and legal pages could not be retrieved, so the GDPR position and processing terms are unconfirmed. European organisations should ask for the storage region and a data processing agreement before publishing internal packages or container images.