Snapshot 6764
Normalized text
Scripts and page chrome removed; this is what change detection compares.
SOC 2 Type II Report Available Security at Serverless We are committed to maintaining the highest standards of security and compliance. Our comprehensive security program protects your data and gives you confidence when using our products and services. Visit Trust CenterContact Security Team Compliance & Certifications Serverless, Inc. undergoes regular third-party audits to validate our security controls and ensure we meet industry standards. SOC 2 Type I Available Our SOC 2 Type I report is available, demonstrating that our security controls are properly designed and implemented to meet the security trust service criteria and protect against unauthorized access at a specific point in time. Request report via Trust Center → SOC 2 Type II Available Our SOC 2 Type II report is available, demonstrating that our security controls have been operating effectively over time. This audit validates the ongoing effectiveness of our security program against unauthorized access and security threats. Request report via Trust Center → Our Security Program Serverless, Inc. maintains a comprehensive security program built on industry best practices and continuous improvement. Data Encryption All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. Access Controls Role-based access control with least-privilege principles and regular access reviews. Monitoring & Logging Comprehensive logging and real-time monitoring of all system activities and security events. Incident Response Documented incident response procedures with defined escalation paths and communication protocols. Infrastructure Security Hosted on AWS with defense-in-depth architecture, network segmentation, and regular patching. Vendor Management Rigorous vendor security assessments and ongoing monitoring of third-party service providers. Security Policies & Practices Our security policies are reviewed annually and align with SOC 2 trust service criteria. Secure Development Lifecycle Code reviews for all changes Automated security scanning in CI/CD Dependency vulnerability monitoring Responsible vulnerability disclosure program Employee Security Background checks for all employees Security awareness training Confidentiality agreements Secure endpoint management Business Continuity Disaster recovery planning Regular backup testing Multi-region redundancy Defined RTO and RPO objectives Privacy & Data Protection Data minimization principles Clear data retention policies Customer data isolation Data protection best practices On-Premise Option Using the CLI Without the Dashboard For organizations with strict security requirements, the Serverless Framework CLI can operate as a fully on-premise tool with minimal external connectivity. Source Available for Security Review The Serverless Framework CLI is source available, allowing your security team to review the complete codebase. Inspect exactly what runs in your environment and verify our security practices firsthand. View source on GitHub → The Serverless Framework CLI is locally installed software that, by default, does not interact with Serverless, Inc. servers except for limited network requests for license compliance. The optional Serverless Framework Dashboard provides additional features like Observability and Secrets Management, but it is not required. Many enterprises rely exclusively on the Serverless Framework CLI for mission-critical workloads. As a locally executed tool, the CLI offers full control and customization, aligning well with strict corporate security and compliance requirements. License Keys If your organization wants to use only the CLI and not the Dashboard, License Keys are the solution. Using License Keys disables Dashboard access by default, ensuring the CLI operates solely as an on-premise product. Simple Identifiers License Keys validate and track subscription usage only; no access control or permissions. Disables Dashboard Eliminates all Dashboard requests except License Key validation and telemetry. No Expiration Keys don't expire, avoiding service disruption while still allowing rotation as a best practice. Flexible Distribution Create and distribute as many keys as needed, by company, team, app, or developer. Learn more about License Keys → Network Requests When not used with the Dashboard, the CLI makes the following network requests to Serverless, Inc. backend services: Check Version Checks for the latest version of the CLI. https://install.serverless.com/versions.json Update Version Downloads updates when required. https://install.serverless.com/archives/* Validate License Validates the License Key during initialization. https://core.serverless.com/api/bff Send Telemetry Sends minimal usage data for license compliance. https://core.serverless.com/api/events/* License Telemetry The CLI collects minimal telemetry to measure usage for subscription billing. This data uniquely identifies each Service Instance (a deployed serverless.yml in a specific Stage and Region): Data Property Description License Key Used to attribute usage to the correct organization & subscription. Service Name The "service" value in the serverless.yml configuration file. Region Name The AWS region where the application is being deployed. Stage Name The environment (e.g., "production", "development", "testing"). AWS Account ID The unique identifier of the AWS account for deployment. AWS CloudFormation Stack ID The unique identifier of the CloudFormation Stack managed by the CLI. Reporting Security Vulnerabilities We appreciate the security research community and encourage responsible disclosure of any vulnerabilities you discover. Serverless Framework For security vulnerabilities in the source-available Serverless Framework CLI, please report them through GitHub Security Advisories for coordinated disclosure. Report via GitHub Advisory Serverless Dashboard For security issues related to the Serverless Framework Dashboard, APIs, or any Serverless, Inc. hosted services, please contact our security team directly. Email security@serverless.com Have Security Questions? Our security team is available to assist with inquiries, security questionnaires, or compliance documentation requests. Contact Security TeamVisit Trust Center