Snapshot 179348
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security & Trust Security and Trust at Harness We take a comprehensive approach to data privacy and security — protecting our infrastructure, our products, and your data. A geographically diverse security team operates and continually strengthens our security and compliance programs. Get started Contact us Report a security bug Compliance posture SOC 1 SOC 2 ISO 27001 ISO 27017 ISO 27018 GDPR & CCPA 01 Security Availability & Disaster Recovery Multi-region architecture across separate geographies lets the platform scale rapidly if a primary location fails. Failover is tested at least annually, with frequent database backups enabling point-in-time restore. Personnel Security Rigorous interviews and background checks for every hire. Security and privacy training is required at onboarding and repeated annually thereafter. Secure Software Development Security is embedded across the SDLC. Every production change is peer-reviewed and approved, tested through CI, scanned for vulnerabilities, and ships with roll-back procedures. Vulnerability Management We scan infrastructure and application code at least monthly, remediating findings in line with NIST vulnerability timelines. Incident Response A dedicated IR team follows the SANS PICERL and NIST SP 800-61 guides. Operational incidents post to our Status Page, and impacted customers are notified without undue delay. 02 Data Security Customer Data Protection We collect minimal PII. All customer data carries our most critical classification — encrypted in transit with TLS 1.2+ and at rest with AES-256. Data Isolation Customer data never touches non-production. Dev, test, and staging are strictly separated from production, and every account is logically isolated by a unique Account ID. Identity & Access Management Least-privilege RBAC with unique accounts per employee. SSO is enforced for critical business systems and two-factor authentication is implemented wherever possible. System Monitoring We continuously collect signals from infrastructure and endpoints — access, performance, vulnerabilities, utilization — and alert security and operations teams on anomalies. Compliance & Certifications Independently audited, continuously certified We’re SOC 2 compliant and ISO 27001 / 27017 / 27018 certified. Request our latest reports and explore our full security posture and controls in the Harness Trust Center. Visit the Trust Center SOC 1 Type II SOC 2 Type II ISO 27001 ISO 27017 ISO 27018 FedRAMP 20x Class A GDPR DORA NIS2 HIPAA ⓘOnly applies to Runtime Protection Agent PCI DSSⓘOnly applies to Runtime Protection Agent 03 Assessments, Audits & Compliance Penetration Testing Each year we engage an external firm to conduct a penetration test against our application and external network. Risk Management Risk assessments run at least annually and after major changes — classified by likelihood, impact, and mitigation, then reviewed with stakeholders and tracked in a risk register. Vendor Management A vendor risk program continuously monitors and assesses suppliers against our security and compliance requirements — covering both business systems and technical assets. Laws & Regulations We comply with GDPR, CCPA, and other applicable privacy laws. The Privacy Statement details what we collect; data-subject rights can be exercised via a Privacy Request. 04 Product Security Authentication & Authorization Local auth or integration with your corporate Identity Provider, with SSO and Two-Factor Authentication enforced through Harness or your IdP. Access Management Advanced Role-Based Access Control gives granular control over what users and service accounts can do across the platform. Auditing A comprehensive, out-of-the-box Audit Trail at the account and organization levels captures every event and change in the platform. Delegate Security The Harness Delegate runs in your environment to connect internal systems to the platform — over a secure WebSocket connection protected by TLS. Secret Management A built-in Secrets Management solution on top of GCP KMS stores the secrets used in your account, pipelines, and connectors securely and conveniently. Container Hardening We build on hardened images and ship a vetted ‘safe image’ — third-party dependencies sourced from trusted resources, with relevant OS hardening applied. Reporting Security Issues Found a vulnerability? Tell us. If you believe you’ve discovered a critical security bug or vulnerability affecting our products or services, email security@harness.io. We ask that you not publicly disclose the issue until we’ve had a chance to address it. Interested in our private bug bounty? Reach out with your preferred email address. Report a security bug We respond within 24 hours