What we do, and what we do not do yet.
The posture as it runs today, in the same words we would use in a questionnaire. Where something is planned rather than done, it says so.
| In transit | TLS 1.2 and 1.3 only, on every address: the site, the app, the API and git over HTTPS. Certificates are issued and renewed automatically. |
| Repositories and artifacts | Object storage, encrypted at rest with the provider's managed keys, versioned, blocked from public access. Disks are only a cache. |
| The database | Managed PostgreSQL in two zones, encrypted at rest with the provider's managed key, with seven days of point-in-time recovery. |
| Secrets | Repository and space secrets are sealed under a keyring held in the platform's parameter store as SecureStrings, bound to their scope, and never injected into a job outside it. Identity-provider secrets are sealed under their own key. |
| Signed merges | Every merge is signed with an Ed25519 key that never leaves the deployment. Public keys are published by fingerprint; anyone can verify a merge record offline. |
| Sign-in | Password with a breach-list check, one-time code by email, or the space's own identity provider over OpenID Connect or SAML. Sessions are HttpOnly cookies exchanged for ten-minute bearers. A space can require its provider. |
| Authorization | Roles per space, grants per repository, branch protection, held paths that always need a person, and one rule nobody bypasses: whoever made an attempt cannot approve it. |
| Audit | Every act that changes who can sign in, push, decide or land is written by name and cannot be edited. Spaces read it, export it, and can hold it as long as they exist. |
| Provisioning | SCIM 2.0 per space: the identity provider adds and removes people; deprovisioning removes membership at once and keeps the account so merge records keep their names. |
| Infrastructure | One AWS region per installation. Management-plane calls are logged by CloudTrail. Application logs are kept fourteen days. Budget and health alarms page a person. |
| Backups and recovery | Database point-in-time recovery, versioned object storage, and a written restore drill that is exercised against the running stack. |
| Retention | CI artifacts are kept until a space's retention cap, in days, or until their storage partition is retired; merge records and the audit log are never subject to the cap. Closing an account revokes everything it held at once and frees the address. Received mail is kept ninety days. |
Found something?
Write to us and we answer first. We will not pursue anyone who reports in good faith.
Security reports
hello@sigbound.com, “Security” in the subject. Machine-readable at /.well-known/security.txt.
Subprocessors
Amazon Web Services for everything that runs. Anthropic for Sigbound AI reads, under terms that forbid training on your code.
Not yet
A SOC 2 report is in preparation; the controls map is public in the source when it opens. Ask by mail and you get the current state.