What do we run?
Application
Workday HR
- Lifecycle
- Active
- Criticality
- Critical
- Needed by
- 4 records, at any depth
- Data flows
- 2 out: Finance Ledger, Zoom Meetings
- Found in
- Entra ID, linked
An application catalog that stays true.
Softwarden is the open-source system of record for the software, SaaS, integrations and AI agents your IT team runs. Every record has an owner and a review date. What is missing shows up as a named gap you can act on.
- Apache 2.0
- Self-hosted with Docker Compose or Helm
- No telemetry
Needs attentionContoso, demo data
| Record | What needs doing | Status |
|---|---|---|
| Service Desk PortalApplication | No business ownerNo technical owner | Unreviewed |
| Zoom ProRenewal | Record a decision before the action deadline | Overdue |
| Nightly Payroll ExportComponent | Its link to Workday HR changed owner after it was confirmed | Needs verification |
| Invoice Triage AgentAI agent | No technical ownerNo human-in-loop decision | Unreviewed |
| Workday 2027R1 upgradeChange assessment | The affected set changed since the snapshot was taken | Stale snapshot |
| New Vendor PortalDiscovery, Entra ID | Link it to a record, create one or dismiss it | New |
The home screen. Each row says what is missing and what to do next.
What do we run?Who owns it?When does it renew?
The three questions every IT team gets asked. Softwarden keeps the answers in one place, and each record shows when someone last confirmed them.
Who owns it?
Application
Employee Timesheets
- Business owner
- Priya Raman
- Technical owner
- No technical owner
- Support team
- IT Applications
The gap puts the record in Needs attention until someone fills it.
When does it renew?
Renewal
Workday subscription
- Renewal date
- March 31
- Notice period
- 2 months
- Action deadline
- January 31 Calculated
March 31 minus the two-month notice period. Entered and assumed deadlines are labelled the same way.
Records from the Contoso demo organization that ships with the seed data.
And the questions that come next
Each answer is a screen in the app, with its filters in the URL so a link shows the same view.
What breaks if we change this?
Dependencies to any depth, with loops marked and not followed twice. Save the affected set as a change assessment before an upgrade or a retirement; it says when its snapshot goes stale.
Dependencies, Map, Change assessments
What are we running that nobody registered?
Discovery reads Microsoft Entra ID: enterprise applications, app registrations, their owners and expiring secrets, and the sign-in logs for shadow IT. Findings wait in a queue. You link, create or dismiss, and curated data is never overwritten.
Discovery, Shadow IT
Which AI agents do we have, and who signed off?
A register of agents, providers and models. Each agent has owners, a data access scope and a human-in-loop decision. An agent without them shows up as a gap.
AI agents, AI models
What do we pay, and for how many seats?
Contracts with lines split across the applications they cover, license pools with seats purchased and assigned, and renewals whose action deadline is worked out from the notice period. Each deadline says whether it was entered, calculated or assumed.
Contracts, License pools, Renewals
Is it still supported, and is the vendor still covered?
End-of-life dates from endoflife.date for each version you run. A risk file per vendor: assurance reports, the DPA and subprocessors, with reminders before documents expire.
End of life, Vendor risk
Where does confidential data go?
Integrations record the kinds of data they carry. The data-flow map flags personal data sent to a vendor with no signed DPA, flows with no authentication and flows classified above the record that receives them.
Data flows
What is missing from the catalog?
Gaps are named, such as "No technical owner", and collected in one Needs attention queue. A daily digest goes out by email or Microsoft Teams.
Needs attention, Data quality
Who changed that, and when?
Every write goes through one path and records an audit event with the before and after values. Each record has its own history.
Audit log, History
Also in 1.0
- CSV import with a previewMap your own columns, decide on possible matches, then commit everything or nothing.
- REST API and webhooksAn OpenAPI schema, read-only or read-write tokens, and signed webhooks with retries.
- MCP serverLets an AI assistant read the catalog through the API with your token.
- Catalog as codeThe catalog as YAML files in git. Plan and apply through the same checks as the app.
- Single sign-onOpenID Connect per organization, set up as a draft, tested, then activated.
- Backups and checksNightly encrypted backups from the worker, a restore rehearsal and manage.py doctor.
What breaks if Workday HR changes?
The payroll chain from the demo data. Choose a record to see everything that depends on it, at any depth. A link that leads back to a record already on the path closes a loop: it is marked and not followed again. Data flows are drawn apart, since moving data is not an operational dependency.
Records in this map
If Workday HR changes
4 records depend on it. One link closes a loop and is marked, not followed again.
- Nightly Payroll Export Component, scriptdepends on it directly
- Finance Ledger Application2 steps away, through Nightly Payroll Export
- Executive Dashboard Application3 steps away, through Nightly Payroll Export, then Finance Ledger
- Budget Planner Application Closes a loop3 steps away, through Nightly Payroll Export, then Finance Ledger
Data flows, not operational
- Sends to Finance Ledger: payroll feed (SFTP, nightly; implemented by Nightly Payroll Export)
- Sends to Zoom Meetings: user provisioning (SCIM, continuous)
Workday HR depends on nothing in this map.
Every link in words
- Nightly Payroll Export depends on Workday HR (reads approved payroll).
- Finance Ledger depends on Nightly Payroll Export (loads payroll journals from the export).
- Executive Dashboard depends on Finance Ledger (reads actuals).
- Budget Planner depends on Finance Ledger (reads actuals).
- Finance Ledger depends on Budget Planner (reads budget codes).
- Finance Ledger and Budget Planner depend on each other, so the explorer marks one of the two links as closing a loop.
- Workday to Finance Ledger payroll feed: data from Workday HR to Finance Ledger (SFTP, nightly; implemented by Nightly Payroll Export). A data flow, not an operational dependency.
- Workday to Zoom user provisioning: data from Workday HR to Zoom Meetings (SCIM, continuous). A data flow, not an operational dependency.
Running in a few minutes
One Compose file brings up the app, the worker, PostgreSQL 17 and Caddy. Secrets are generated on first start, so there is no settings file to write. The install guide takes a fresh Ubuntu VM to a signed-in Admin with backups running.
- Server
- 2 vCPU, 4 GB RAM, 20 GB disk
- Software
- Docker Engine with Compose
- Network
- A DNS name and ports 80 and 443
# the full stack at https://localhost
$ git clone https://github.com/Softwarden/softwarden
$ cd softwarden
$ docker compose up -d --build
# prints the setup address and a one-time token
$ docker compose exec app python manage.py bootstrap_adminEditions
Most of Softwarden is in the community edition. It is free, and the code is yours to run and change.
Community
Free and open source, Apache 2.0
- Applications, components, integrations, AI agents, people, teams and vendors
- Owners, reviews, Needs attention and the daily digest
- Dependencies, change assessments and the data-flow map
- Renewals, contracts and license pools
- Microsoft Entra ID discovery, shadow IT, SSO and MFA coverage, license waste (API only in 1.0)
- Vendor risk files and end-of-life tracking
- Custom fields, attachments, saved views, bulk edit and data-quality rules
- CSV import and export, catalog as code and a full organization export
- OpenID Connect sign-in, API tokens, webhooks, the MCP server and the audit log
- Ticket links on assessments and renewals, with Jira status refresh
EnterpriseComing soon
For larger teams and stricter environments
- SAML 2.0 sign-in
- SCIM 2.0 provisioning of users and groups
- Discovery from Azure, Power Platform and HaloITSM
- Assistant suggestions for discovery candidates
- The compliance profile (GxP fields)
- Audit log export for a SIEM, as JSON lines