Cloudsmith

Name: Cloudsmith
Brand: Cloudsmith

Simply the world’s best cloud-native artifact management platform.

Est 2016|Valuation $58.6M|Raised $124.5M|11 Ref Customers

LinkedIn 15K|Web traffic 12K|FTEs 149|HQ Belfast, Northern Ireland, GB

MarketsArtifact Management

Published Oct 15, 2026

01Common complaints

You require on-prem or air-gapped deployment due to regulatory or operational constraints.
- If SaaS is disallowed by policy, Cloudsmith may not meet requirements; consider vendors that explicitly support self-hosted or air-gapped deployments.
- Source: Sonatype product pages and vendor documentation
Your usage pattern has extreme download/CI bandwidth and you need predictable costs.
- Reviewers indicate that the vendor's pricing can increase with bandwidth and storage consumption; procurement teams should model expected transfer costs.
You need detailed, executive-grade analytics and usage reporting out of the box (particularly for customer-facing distribution).
- Multiple reviewers note dashboard limitations and Docker download reporting challenges.
Your team prefers fully featured GUI workflows and minimal CLI reliance.
- Some reviewers report the platform has historically required CLI usage for certain workflows and that the web UI has missing features.

Sources:

Review platforms: https://www.g2.com/products/cloudsmith/reviews, https://www.capterra.com/p/177474/Cloudsmith-Package/reviews/

1. You require on-prem or air-gapped deployment due to regulatory or operational constraints. - If SaaS is disallowed by policy, Cloudsmith may not meet requirements; consider vendors that explicitly support self-hosted or air-gapped deployments. - Source: Sonatype product pages and vendor documentation 2. Your usage pattern has extreme download/CI bandwidth and you need predictable costs. - Reviewers indicate that the vendor's pricing can increase with bandwidth and storage consumption; procurement teams should model expected transfer costs. 3. You need detailed, executive-grade analytics and usage reporting out of the box (particularly for customer-facing distribution). - Multiple reviewers note dashboard limitations and Docker download reporting challenges. 4. Your team prefers fully featured GUI workflows and minimal CLI reliance. - Some reviewers report the platform has historically required CLI usage for certain workflows and that the web UI has missing features. Sources: - Review platforms: https://www.g2.com/products/cloudsmith/reviews, https://www.capterra.com/p/177474/Cloudsmith-Package/reviews/

Disqualifiers (poor fit)

Organizations requiring fully offline / air-gapped / on-prem-only deployments (Cloudsmith is presented as a hosted service)
Organizations that require strictly predictable, flat-rate transfer billing and cannot accommodate variable egress/transfer costs

Known limitations from customer feedback

Docker download statistics can be difficult to interpret (per-layer counting) according to reviewers
New web application usability: missing bulk selection and limited metadata visibility for some package types
Intermittent CI/CD install failures reported by some reviewers (rerunning may mitigate these incidents)

Source:

https://www.g2.com/products/cloudsmith/reviews

- Docker download statistics can be difficult to interpret (per-layer counting) according to reviewers - New web application usability: missing bulk selection and limited metadata visibility for some package types - Intermittent CI/CD install failures reported by some reviewers (rerunning may mitigate these incidents) Source: - https://www.g2.com/products/cloudsmith/reviews

Vendor-acknowledged constraints / plan gating

SCIM requires Ultra or Enterprise plans
Broadcasts feature has limited availability/early access in some documentation; analytics and customization options are plan-limited

Sources:

SCIM prerequisites: https://docs.cloudsmith.com/authentication/scim
Broadcasts help docs: https://help.cloudsmith.io/docs/broadcasts

- SCIM requires Ultra or Enterprise plans - Broadcasts feature has limited availability/early access in some documentation; analytics and customization options are plan-limited Sources: - SCIM prerequisites: https://docs.cloudsmith.com/authentication/scim - Broadcasts help docs: https://help.cloudsmith.io/docs/broadcasts

Roadmap signals

Sources:

CLI SAML auth changelog: https://cloudsmith.com/changelog/cloudsmiths-cli-now-supports-authenticating-with-saml-single-sign_on
Status page move: https://cloudsmith.com/changelog/cloudsmith-status-page-has-moved

The vendor publishes a changelog and product updates; examples include CLI SAML authentication support (Sept 25, 2024) and a status page platform migration (Apr 1, 2025). These indicate active product iteration; request a formal roadmap for long-term planning. Sources: - CLI SAML auth changelog: https://cloudsmith.com/changelog/cloudsmiths-cli-now-supports-authenticating-with-saml-single-sign_on - Status page move: https://cloudsmith.com/changelog/cloudsmith-status-page-has-moved

Mixed results / struggles

No public case studies describing failed implementations were found in the reviewed materials. Negative signals in reviews include intermittent CI/CD failures, manual rollout overhead, and analytics gaps that can affect customer-success workflows.

02Why they buy

Key differentiators supported by product documentation and customer feedback

Multi-format, single platform for multiple package ecosystems
Vendor-documented distribution controls for software vendors (entitlement tokens and Broadcasts) that support customer distribution without creating vendor-managed user accounts
Security governance integrated into artifact flows: policy management, audit trails/log exports, OIDC tokens, and identity integrations

Sources:

G2 reviews (multi-format feedback): https://www.g2.com/products/cloudsmith/reviews
Entitlement tokens: https://docs.cloudsmith.com/software-distribution/entitlement-tokens
Broadcasts: https://cloudsmith.com/product/cloudsmith-broadcasts
Homepage security & governance: https://cloudsmith.com/

- Multi-format, single platform for multiple package ecosystems - Vendor-documented distribution controls for software vendors (entitlement tokens and Broadcasts) that support customer distribution without creating vendor-managed user accounts - Security governance integrated into artifact flows: policy management, audit trails/log exports, OIDC tokens, and identity integrations Sources: - G2 reviews (multi-format feedback): https://www.g2.com/products/cloudsmith/reviews - Entitlement tokens: https://docs.cloudsmith.com/software-distribution/entitlement-tokens - Broadcasts: https://cloudsmith.com/product/cloudsmith-broadcasts - Homepage security & governance: https://cloudsmith.com/

Areas where competitors may have advantages

Breadth of platform: some competitors provide larger, integrated suites that may suit organizations seeking an all-in-one vendor
Deployment flexibility: some competitors offer on-prem or air-gapped deployment options

Sources:

JFrog pricing/platform: https://jfrog.com/pricing/
Sonatype deployment notes: https://www.sonatype.com/products/pricing

- Breadth of platform: some competitors provide larger, integrated suites that may suit organizations seeking an all-in-one vendor - Deployment flexibility: some competitors offer on-prem or air-gapped deployment options Sources: - JFrog pricing/platform: https://jfrog.com/pricing/ - Sonatype deployment notes: https://www.sonatype.com/products/pricing

Why customers chose Cloudsmith (as stated in reviews)

Consolidation across many package formats
Supply-chain governance capabilities (policy enforcement, visibility, dependency confusion protections)
Reduced infrastructure maintenance compared with self-hosted repositories

03Field reports

Review platform summary

G2: well rated on G2
Capterra: well rated on Capterra

Direct quotes (positive and negative)

G2 (positive):

“I highly appreciate Cloudsmith for its simplicity and comprehensive support for all artifact types…”

G2 (negative):

“I find the pricing model of Cloudsmith problematic. The pricing is based on bandwidth and storage, which can become expensive…”

G2 (mixed/critical details):

“Intermittent CI/CD install failures… a simple re-run usually succeeds, but the flakiness costs time.”
“The download stats for Docker images aren't the best. They're per layer…”

Capterra (positive):

“Cloudsmith allows us to deliver software to our customers easily and securely, via multiple repositories.”

Capterra (negative):

“Cloudsmith seems to be primarily designed for CLI usage; they have a web interface that is somewhat clunky and hard to use.”

G2 (positive): - “I highly appreciate Cloudsmith for its simplicity and comprehensive support for all artifact types…” G2 (negative): - “I find the pricing model of Cloudsmith problematic. The pricing is based on bandwidth and storage, which can become expensive…” G2 (mixed/critical details): - “Intermittent CI/CD install failures… a simple re-run usually succeeds, but the flakiness costs time.” - “The download stats for Docker images aren't the best. They're per layer…” Capterra (positive): - “Cloudsmith allows us to deliver software to our customers easily and securely, via multiple repositories.” Capterra (negative): - “Cloudsmith seems to be primarily designed for CLI usage; they have a web interface that is somewhat clunky and hard to use.”

Common praise themes

Review excerpts note:

Broad format support (Docker, PyPI, npm, RPM/DEB, etc.) reducing registry sprawl
As a hosted service, reduced need to maintain self-hosted servers
Responsiveness of vendor support (some reviewers reference direct Slack access to developers)
Supply-chain security features: dependency confusion protections, policy enforcement, and scanning signals (reported by some reviewers)

Common criticisms / complaints

Recurring themes in available reviews include:

Pricing can increase with storage and bandwidth consumption
Dashboard and analytics may lack detail needed for some workflows (e.g., Docker download metrics counted per layer)
Web UI usability issues reported historically (missing bulk actions and limited metadata visibility)
Occasional CI/CD flakiness reported by some reviewers
Manual effort during initial rollout for larger enterprise deployments

Recurring themes in available reviews include: - Pricing can increase with storage and bandwidth consumption - Dashboard and analytics may lack detail needed for some workflows (e.g., Docker download metrics counted per layer) - Web UI usability issues reported historically (missing bulk actions and limited metadata visibility) - Occasional CI/CD flakiness reported by some reviewers - Manual effort during initial rollout for larger enterprise deployments

Why some customers might leave (inferred from complaints)

No direct churn statements were found in the reviewed materials. Potential churn drivers inferred from reviews include:

Unpredictable or high costs at large bandwidth/traffic volumes
Need for more detailed analytics and reporting for customer-facing distribution
UI regressions or feature gaps affecting operational workflows

Vendor-published case study highlight (customer testimonial)

The vendor's homepage includes a customer testimonial reporting improved reliability and cost savings after migrating to the hosted service. The cited metrics and outcomes are vendor-published; the underlying methodology, baseline costs, and time window are not provided in the excerpt. Prospective customers should request the full case study and validate assumptions (for example, by comparing infra and staffing costs for self-hosted tooling versus SaaS spend).

Implementation details and time-to-value (limited)

No detailed implementation timeline was located in the captured excerpts. Reviewer comments suggest small-scope migrations can be completed quickly for small teams, while enterprise-scale migrations (many repositories, multiple package ecosystems, many teams) will likely take longer and depend on scope.

04Best fit

Company sizes

Small teams and startups: the mid-tier plan pricing indicates fit for small engineering teams that need multi-format support
Mid-market and enterprise: custom upper-tier plans indicate suitability for larger organizations with governance requirements

Industries / verticals

Software vendors and SaaS companies
Regulated industries with software supply-chain governance needs (financial services, healthcare — compliance scope to be validated contractually)

Roles and personas

Decision makers: VP Engineering, Platform Engineering leaders, DevOps leadership, Security leadership
End users: DevOps engineers, build/release engineers, developers consuming packages in CI/CD

Pain points Cloudsmith addresses

Fragmented artifact storage across multiple ecosystems
Reliability issues with public upstream registries
Need to control package usage entering builds (policy enforcement)
Secure distribution to customers without complex access provisioning

05The pitch

What the product does (objective value proposition)

Notable features reported by the vendor and observed in documentation:

Universal/multi-format repositories and raw file support
Upstream proxying/caching of public registries (to improve reliability and reduce exposure)
Security controls including vulnerability and package analysis signals, policy enforcement, signing, audit trails/log exports, and SSO/SCIM features
Global distribution via CDN-like edge delivery

Cloudsmith is a cloud-hosted artifact management service used to store, secure, proxy/cache, govern, and distribute software artifacts across many formats (packages, containers, and raw binaries/files). The platform is presented as a centralized repository for software assets moving through the software supply chain, with built-in capabilities around distribution, access control, logging/analytics, and supply-chain security controls. Notable features reported by the vendor and observed in documentation: - Universal/multi-format repositories and raw file support - Upstream proxying/caching of public registries (to improve reliability and reduce exposure) - Security controls including vulnerability and package analysis signals, policy enforcement, signing, audit trails/log exports, and SSO/SCIM features - Global distribution via CDN-like edge delivery

Target market and market positioning

Cloudsmith’s messaging is aimed at:

Platform engineering / DevOps / DevSecOps teams managing multiple package ecosystems
Security and compliance stakeholders focused on software supply chain governance
Enterprises (upper-tier plans) and smaller teams via a paid mid-tier plan
Software vendors distributing software to customers (entitlements, branded portals)

Cloudsmith positions itself as an alternative to established artifact tools such as JFrog Artifactory and Sonatype Nexus.

Cloudsmith’s messaging is aimed at: - Platform engineering / DevOps / DevSecOps teams managing multiple package ecosystems - Security and compliance stakeholders focused on software supply chain governance - Enterprises (upper-tier plans) and smaller teams via a paid mid-tier plan - Software vendors distributing software to customers (entitlements, branded portals) Cloudsmith positions itself as an alternative to established artifact tools such as JFrog Artifactory and Sonatype Nexus.

Get a comprehensive analysis of Cloudsmith including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →