# NVM for Windows: Full Site Context

> NVM for Windows is the Node.js version manager for Windows. It provides a free, open-source Community Build for individual developers and commercial Certified Builds for managed organizational environments.

## Project identity

NVM for Windows is a separate project from nvm-sh, not a Windows port of it. Although the projects have overlapping features and some similar commands, NVM for Windows is designed specifically for Windows.

NVM for Windows was created by Corey Butler and was originally stewarded by Ecor Ventures LLC. With version 2, stewardship moved to Author Software Inc., which maintains the open-source project and provides its commercial products.

## Community Build

The Community Build is free, open source under the MIT license, and intended primarily for individual developers and user-controlled installations. Organizations may also use it when their internal policies allow.

Core version 2 capabilities include:

- No mandatory administrator privileges
- Version pinning through `.nvmrc`, `.node-version`, or `package.json` in shim mode
- Automatic installation of missing Node.js versions, with an optional confirmation prompt
- Parallel downloads and installations
- Smaller 7zip archives
- Native extraction and caching
- Zig-based shims
- Default global module installation
- Custom version aliases
- Authenticode-signed builds
- Native Windows Apps, Event Viewer, Notification Center, and registry integrations
- Structured JSON output for automation and AI coding agents

Version 2 offers a recommended shim mode for modern workflows and retains link mode for compatibility with existing scripts and tools.

Download the Community Build from [GitHub Releases](https://github.com/nvm-windows/nvm/releases). Source code is available in the [NVM for Windows repository](https://github.com/nvm-windows/nvm), and usage documentation is at [docs.nvm-windows.com](https://docs.nvm-windows.com).

## Commercial model

Certified Builds are the required commercial foundation for managed deployment. The annual site-wide license covers one Active Directory forest, or one Microsoft Entra tenant when no forest exists. Optional add-ons are Trust Artifacts, Advanced Logging, and Governance.

| Product | Role | Annual price |
| --- | --- | ---: |
| Certified Builds | Required foundation | $600 / year |
| Trust Artifacts | Optional add-on | $600 / year |
| Advanced Logging | Optional add-on | $600 / year |
| Governance | Optional add-on | $3,000 / year |

The [Certified Builds configurator](https://nvm-windows.com/certified) estimates effective per-user cost, recommends products based on cybersecurity, procurement, or compliance priorities, and prepares a cart. Purchases are completed through the [Customer Portal](https://portal.author.io).

## Certified Builds capabilities

- **IT-managed installation:** Install NVM for Windows in a Windows-protected directory so administrators can control deployment and management on each device.
- **Organization-wide license:** Cover one Active Directory forest, or one Microsoft Entra tenant when no forest exists, with a single annual license.
- **Easy renewal and cancellation:** Receive email and desktop renewal notifications and cancel online through the Customer Portal.
- **Security pack and vendor risk controls:** NVM for Windows does not collect user data. An up-to-date security pack, privacy policy, EULA, and data-use limits are always available.
- **Microsoft Intune:** Deploy prepackaged Intune files through Microsoft endpoint management.
- **MSI installer:** Use a standard Windows Installer package with an organization's existing deployment process.
- **User-controlled NVM firewall:** Let users control approved Node.js versions, npm modules, and trusted command-line tools.

## Trust Artifacts capabilities

- **CycloneDX SBOM:** A signed software bill of materials for each certified release.
- **SLSA provenance:** Signed documentation of where a release came from and how it was produced.
- **VEX reports:** Vulnerability Exploitability eXchange reports showing whether known vulnerabilities affect a release.

## Advanced Logging capabilities

- **Structured JSON logs:** Consistent records with known event codes.
- **Dedicated native event log:** A dedicated NVM for Windows log and event source in Windows Event Viewer.
- **SIEM integration:** Structured events for centralized security analysis and auditing.

## Governance capabilities

- **Central policy management:** ADMX/ADML templates deployed through Active Directory Group Policy or Microsoft Entra with registry-backed settings.
- **IT-managed NVM firewall:** Central enforcement of approved Node.js versions, npm modules, and trusted command-line tools.
- **Advanced proxy support:** Integrated Windows Authentication and WPAD/PAC support.
- **Runtime controls:** Centrally managed Node.js and npm runtime settings.
- **Private download gateway and mirror:** Organizational control over the source of Node.js runtime downloads.
- **Certificate of Insurance:** ACORD 25 COI available on request.

## Persona recommendations

The cybersecurity configuration addresses signed-build verification, IT-managed installation, supply-chain evidence, SIEM logging, centralized policy enforcement, and a private Node Mirror. Its recommendation includes Certified Builds, Trust Artifacts, Advanced Logging, and Governance.

The procurement configuration addresses site-wide licensing, managed installation, Trust Center and security-pack access, supply-chain evidence, subscription management, a Certificate of Insurance, EULA redlining, and invoicing. Its recommendation includes Certified Builds, Trust Artifacts, Governance, and a Custom Annual Agreement.

The compliance configuration addresses signed builds, Trust Center access, supply-chain evidence, SIEM logging, centralized policy enforcement, vendor risk documentation, subscription management, a Certificate of Insurance, and documented data flows and subprocessors. Its recommendation includes Certified Builds, Trust Artifacts, Advanced Logging, and Governance.

## Operational assurances

- NVM for Windows runs on-premises and does not collect user data.
- NVM for Windows runs locally. Node Mirror users may optionally store rules on Author Software servers, which may bring that configuration within applicable AICPA service-provider scope.
- Author Software does not use customer data to train AI models.
- Payments are processed through Stripe using PCI-compliant infrastructure.
- Author Software Inc. is based in the United States.
- A current list of subprocessors and their locations is freely available in the Trust Center.
- Customers can grant auditors Customer Portal access to review current security and compliance materials.

## Custom Annual Agreements

Custom agreements can include EULA redlining, onboarding support, invoicing, and negotiated payment terms. Pricing is available by request through the contact form on the [Certified Builds page](https://nvm-windows.com/certified).

## Key links

- [Main site](https://nvm-windows.com)
- [Certified Builds configurator](https://nvm-windows.com/certified)
- [Documentation](https://docs.nvm-windows.com)
- [GitHub repository](https://github.com/nvm-windows/nvm)
- [Community Build releases](https://github.com/nvm-windows/nvm/releases)
- [Customer Portal](https://portal.author.io)
- [Author Software](https://author.io)
- [Terms of Use](https://nvm-windows.com/terms.html)
- [Privacy Policy](https://nvm-windows.com/privacy.html)
- [EULA](https://nvm-windows.com/eula.html)