Archipelo

Archipelo operates a Developer Security Posture Management (DevSPM) platform that establishes execution provenance across software production activity carried out by human developers, AI copilots, and autonomous agents. The company's stated premise is that code is now produced by multiple actors across distributed systems, while the resulting artifact does not preserve how it was produced or who is responsible; traditional security tooling analyzes code, artifacts, and runtime environments but does not identify the developers and agents that produced them.

The platform is built on Salmon, described as an execution provenance protocol that records and verifies events of software production, including code changes, AI interactions, agent actions, and pipeline executions, producing a canonical record from which responsibility is derived rather than reconstructed from logs or telemetry. On top of this data foundation, the DevSPM layer supplies security, policy, and governance functions. Named capabilities include Developer Vulnerability Attribution (attributing CVE scan results to the human, copilot, or agent that introduced them), an AI & Agent Actions Monitor, Developer Security Posture, and an automated Developer Tool Inventory covering CI/CD and developer tooling across connected repositories and developer environments.

The described workflow has four stages: connect (integrating with source control, CI/CD pipelines, AI copilots, and agent frameworks to capture execution events), record (creating a deterministic record of events linked to the acting developer or agent), attribute (associating actions and findings with the responsible actor), and govern (applying security policies and governance controls across actor types).

Business model

Archipelo sells its platform to organizations, with the website routing prospective customers through a "Request a Demo" / "Book demo" motion rather than self-service sign-up.