Security built in, not bolted on.
Encryption, isolation, and least-privilege access are the default on every workspace. Every claim on this page names the mechanism behind it, so you can check it rather than take it.
Nine things that are already true.
Not a roadmap and not a tier.Every one of these is on for every workspace on every plan, including the free one.
Encrypted at rest
Pipeline secrets are encrypted with AES-256-GCM under a data key belonging to that repository alone, itself wrapped by a versioned master key. Plain values never touch disk, and are decrypted only at the moment a runner claims the build that needs them.
Encrypted in transit
Everything between you and Rezee moves over TLS. Git flows over Smart-HTTP and an SSH server with Ed25519 host keys - no plaintext transport reaches the internet. Internal service traffic sits on a private network with no published port and authenticates on every call.
Strong authentication
Passwords are hashed with Argon2id, and any account can add an authenticator app code with one-time recovery codes. Sessions are database-backed httpOnly cookies, and personal access tokens are stored as sha256 hashes you can revoke anytime.
Isolated CI
Every pipeline step runs in its own throwaway container. Runners carry their own credentials, secrets reach only the runner that claims a build, and every value is masked on its way back through the logs.
Private by default
Private repositories are invisible to non-members - not just access-denied, but absent from listings, search, and the API surface entirely.
Least privilege, by verb
A role is a set of verbs and a grant says where it applies - the workspace, a team, a project, a single repository. Every gate decides on the verb it needs rather than on what somebody is called, nobody can hand out what they do not hold, and five verbs stay the owner's alone.
A room, not the workspace
Somebody outside your company can be given one channel, at read or write, and nothing else: no rail, no search, no directory, no Inbox. The invitation is addressed rather than merely linked, so a forwarded copy gets whoever holds it an account and a refusal.
Identity you can prove
A workspace claims its domain with a DNS TXT record we re-check in both directions; an address is either asserted by your identity provider or proved by its owner. A password reset ends every session and revokes every token behind it, and deleting an account scrubs the row rather than erasing what was said.
Full audit trail
Every push, merge, secret access, and permission change is recorded in an audit log the database itself refuses to rewrite. Recording is on for every workspace on every plan; history is kept 90 days, and indefinitely on Business and above.
Under the hood.
The primitives, named.Each one is a choice somebody can look up rather than a word that sounds reassuring.
- Password hashing
- Argon2id with per-user salts
- Two-factor sign-in
- TOTP codes, hashed recovery codes, required if asked
- Secret encryption
- AES-256-GCM, per-repository data keys
- Key rotation
- Re-encrypt on demand: rezee secrets rotate
- Token storage
- sha256-hashed, scoped, revocable PATs
- Sessions
- DB-backed, httpOnly, revocable cookies
- SSH transport
- Ed25519 host keys
- Log safety
- Automatic secret redaction in logs
- Runner trust
- Per-runner tokens; secrets released at claim
- Audit log
- Append-only, enforced by a database trigger
- Permissions
- Verbs and scoped grants, evaluated server-side
- Domain claim
- DNS TXT, re-verified every six hours
- Address proof
- Single-use tokens; a reset revokes everything
- Account deletion
- Scrubbed, never cascaded over what you wrote
Where your data lives.
The last row is the one most pages leave out. Rezee holds no SOC 2 report and no ISO 27001 certificate today, and we would rather you read that here than find it halfway through a review.What we can hand you instead is specifics: this page, a data processing addendum that applies without being negotiated, and every company that can touch your data. When a report exists, this list will say so and give the date.
- Application & database
- Google Cloud, us-east1 (United States)
- CI runners & artifacts
- AWS us-east-1, artifacts in S3
- Site & app delivery
- Vercel - static bundles, no data at rest
- Downloads
- Cloudflare R2 - release binaries only
- Backups
- Nightly, verified as taken, kept 14 days
- Off-host copy
- Versioned bucket, another region, kept 30 days
- Restore rehearsal
- Weekly, into a throwaway database
- Breach notice
- Within 72 hours of us becoming aware
- Third parties with access
- 8, each listed with what it can reach
- Third-party trackers
- None. No analytics, no ads, self-hosted fonts
- Certifications
- None yet - no SOC 2 report, no ISO 27001
Bring your next project.
Start free, with no card. Connect the agent you already use, hand it an issue, and approve its first merge today.