Snapshot 4784
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Certified, compliant, audit-ready SOC 2 Type II Independently audited, annually PCI DSS Assessed yearly by a QSA GDPR Fully compliant as a data controller ISO 27001 Held by all our core infrastructure providers “Bitrise has been instrumental in helping us not only run builds more efficiently, but also ensuring our users’ banking information stays secure. Bitrise was the rare third-party vendor that quickly passed through the verification checks and assessments that come with bringing new technology into a regulated financial institution.” Dama Damjanovic N26 Read the customer story Choose your isolation level Match your infrastructure to your risk profile. Every tier keeps the same CI/CD experience. Explore all infrastructure options Public Build Platform Isolated VMs on shared hardware, destroyed after every build. Find out more Dedicated Build Platform Physical machines reserved exclusively for your builds on demand. Find out more Private Build Platform Hardware reserved for you at all times, own firewall, static IPs, site-to-site VPN Find out more Bitrise on AWS Runs in your own AWS account, VPC, and region. Source code never leaves your environment. Find out more Bitrise Runners Fully self-hosted, full control over data residency and policy. Find out more Build security you can count on Ephemeral, isolated VMs Each build gets a dedicated clean virtual machine, all files destroyed after. No source code storage Code only touches Bitrise if your workflow clones it, and only over SSH/TLS. Granular access controls SSO, SAML, 2FA, and role-based permissions on every secret. Leak-proof code signing iOS Connect your Apple Developer account and Bitrise automatically creates, renews, and manages your signing certificates and provisioning profiles. No manual key handling. Android Upload your keystore once, your builds reference it through a time-limited, read-only download URL. Your alias and passwords are stored as protected build variables, never in plaintext config. Protected mode Lock any signing file and it can never be downloaded, viewed, or exported again, by anyone. Builds can still use it. The only remaining actions are delete and replace. More on code signing Data and network security Encryption. AES-256-GCM at rest, TLS/SSH in transit Backups. Geo-redundant, continuously backed up Data residency. Choose your region via Bitrise on AWS (US, Ireland, Frankfurt, Singapore, Sydney) Network. Web app firewalls, IDS/IPS, static exit IPs and VPN available for Dedicated/Private tiers. Application security Code review. Every change peer-reviewed by OWASP-trained engineers. Automated scanning. Every PR scanned with RuboCop, Brakeman, and GoSec. Penetration testing. Conducted by third-party testers, annually and after every major release Vulnerability scanning. Continuous scanning via Invicti, Rapid7, and grype. Bug bounty. Standing bounty program for outside security researchers Put us through your security review Book a demoVisit the Trust Center Frequently Asked Questions What does CI security mean on Bitrise? Every build runs in its own isolated, ephemeral environment. Your source code is never stored, only pulled in over encrypted channels if your workflow clones it, and the machine is destroyed the moment your build finishes. How does Bitrise approach DevOps security? Isolation by default, access control on every secret, and infrastructure options (Dedicated, Private, AWS, self-hosted) that let you match physical control to your risk profile, not a one-size-fits-all cloud. Is Bitrise built for DevSecOps? Yes. Automated scanning runs on every pull request, third-party penetration testing happens annually and after major releases, and a standing bug bounty program keeps outside researchers testing our defenses year-round. What secure infrastructure options are available? Public Cloud, Dedicated Build Platform, Private Build Platform, Bitrise on AWS, and fully self-hosted Bitrise Runners. Explore all infrastructure options. Do you store our source code? No. It only reaches the build VM if your workflow clones it, and it stays encrypted the whole way. Can we run this in our own environment? Yes, Bitrise on AWS keeps your code in your AWS account, and Bitrise Runners let you go fully self-hosted. What reports can we request? SOC 2, PCI DSS, and penetration testing reports are all available by request via the Trust Center. Who has access to our code signing credentials? Only your project Admins can manage them. You can also lock signing files in Protected mode so they can never be downloaded or viewed by anyone again, only used by your builds.