SOC 2 program
Controls and audit evidence program active across CC1–CC9 trust service criteria.
In ProgressSecurity
Enterprise security posture and reporting
Security controls are managed with explicit status labels so teams can evaluate what is verified today and what is in progress.
Core security controls in production
- Strict JWT issuer, audience, and expiration verification across protected routes.
- Workspace-scoped authorization checks for pipeline and run actions.
- Signed webhook verification with anti-replay timestamp windows.
- SSRF protections on outbound connector and integration requests.
- Immutable security audit events for sensitive operational actions.
GDPR alignment
Data handling patterns designed for GDPR workflows.
VerifiedRole-based access
Access is scoped to least privilege and audited actions.
VerifiedDPA templates
Standard Data Processing Agreement available for enterprise onboarding.
VerifiedSecure engineering lifecycle
- Static security analysis and dependency review in CI.
- Secret scanning on code changes with project-specific false-positive rules.
- OpenAPI-to-TypeScript consistency checks to prevent drift in client/server contracts.
- Security regression tests for token validation and route protections.
Report a vulnerability
Use the contact form with reproduction steps and impact details. We acknowledge valid reports within 48 hours.