Security built in, not bolted on.
Encryption, isolation, and least-privilege access are the default on every workspace - so your code and secrets stay protected without any extra setup.
Encrypted at rest
Pipeline secrets are encrypted with AES-256-GCM under a data key belonging to that repository alone, itself wrapped by a versioned master key. Plain values never touch disk, and are decrypted only at the moment a runner claims the build that needs them.
Encrypted in transit
Everything moves over TLS. Git flows over Smart-HTTP and an SSH server with Ed25519 host keys - no plaintext transport, ever.
Strong authentication
Passwords are hashed with Argon2id. Sessions are DB-backed httpOnly cookies, and personal access tokens are stored as sha256 hashes you can revoke anytime.
Isolated CI
Every pipeline step runs in its own throwaway Docker container. Runners carry their own credentials, secrets reach only the runner that claims a build, and every value is masked on its way back through the logs.
Private by default
Private repositories are invisible to non-members - not just access-denied, but absent from listings, search, and the API surface entirely.
Full audit trail
Every push, merge, secret access, and permission change is recorded in an audit log the database itself refuses to rewrite. Recording is on for every workspace on every plan; history is kept 90 days, and indefinitely on Business and above.
Under the hood
Found a vulnerability?
We take security reports seriously and respond fast. Disclose responsibly and we'll work with you on a fix and credit.