Snapshot 184961
Normalized text
Scripts and page chrome removed; this is what change detection compares.
About Our Security Commitments At Buildkite, security isn’t just a feature; it’s embedded in our architecture. Our platform is designed with a security-first approach that respects your organization’s privacy and protects your intellectual property. Customer-Controlled Infrastructure: Buildkite Agents can run on your infrastructure, meaning your source code and secrets never leave your environment. Source code access: Buildkite puts you in control of the handling of your source code. Self manage your Buildkite agents' access to source code or let Buildkite manage this for you. Data Minimization: We only collect what’s needed for orchestration, never your proprietary code. Platform Security Our security-focused approach gives you the confidence to scale your CI/CD operations without compromising security. From robust encryption to advanced authentication methods, we've built comprehensive data protection into every aspect of our service. Hosted in AWS Buildkite is hosted and run within Amazon Web Services and designed to meet AWS “Well Architectedâ€� Principles. End-to-End Encryption All data in transit is protected using TLS 1.2+ with strong cipher suites. Data at rest is encrypted using AES-256. Single Sign-On (SSO) + SCIM SAML SSO integration is available using providers like Okta, Azure AD, and Google Workspace. SCIM provisioning is available on Enterprise plans. Two-Factor Authentication (2FA) Multi-Factor Authentication is enabled by default for organisation members to add a layer of protection. Audit Logging Customers have visibility into user and API activity to support compliance and incident investigations. Granular Access Controls Team-based permissions allow you to restrict access to builds, pipelines, and organization settings. Buildkite can integrate with your cloud identity solution at a per job level via OIDC. Agent Security Buildkite’s agent architecture delivers powerful isolation and access controls that safeguard your build environments from security threats. Our design empowers you to implement defense-in-depth strategies that protect your most sensitive operations from potential threats. Customers can use Buildkite’s hosted agents or host their own agents within their own infrastructure. Isolated Builds Customers can use containers, VMs, or ephemeral agents to isolate and sandbox builds. Token-Scoped Agent Access Agent tokens are scoped per cluster to minimise blast radius. Secrets Management Customers can use their own vault (e.g., AWS Secrets Manager, HashiCorp Vault) to inject secrets securely or use Buildkite Secrets. SOC2 Compliance Buildkite maintains a SOC 2 Type II report - an independent audit performed annually that verifies the design and operating effectiveness of our security practices including access controls, system monitoring, threat detection, and incident response. Our security posture is continuously monitored and maintained across the business using our GRC platform. From infrastructure hardening to employee training and third-party risk management, we take a proactive, defence-in-depth approach to keeping your data safe. For more details of our continuous compliance model, please see our trust site. Security Testing and Practices Buildkite maintains a robust security posture through rigorous third-party testing and active participation in the security community. Regular Penetration Testing Third-party penetration tests are conducted at least annually, with remediation prioritized and tracked to completion. Bug Bounty Program We run a private bug bounty program. We welcome people to join by contacting us. GitHub Secret Scanning Program Buildkite is part of the the GitHub Secret Scanning Program which aims to enhance security for your API tokens. OpenSSF Member As a member, we are dedicated to shaping the future of open source security by contributing to solutions that protect the software everyone depends. Trust Portal To view our SOC2 report, security penetration test and other assurance artifacts please see our Trust Site. Questions or concerns? Reach out to: trust@buildkite.com Privacy Want more details about our commitment to Privacy? Buildkite’s privacy policy is here Platform Pipelines Public pipelines Test Engine Package Registries Pricing Hosting options Self-hosted agents Mac hosted agents Linux hosted agents Windows hosted agents Resources Docs Blog Changelog Example pipelines Plugins Webinars Case studies Events Migration Services Company About Careers Press Security Brand assets Contact Solutions Replace Jenkins Workflows for MLOps Testing at scale Monorepo mojo Bazel orchestration Compare All comparisons Buildkite vs GitHub Actions Buildkite vs Jenkins Buildkite vs CircleCI Buildkite vs Harness Buildkite vs CloudBees Buildkite vs Blacksmith Buildkite vs Depot Buildkite vs Dagger Legal Terms of Service Acceptable Use Policy Privacy Policy Subprocessors Service Level Agreement Supplier Code of Conduct Modern Slavery Statement Support System status Forum © Buildkite Pty Ltd 2026