You own your data. All data you upload as well as any data that is generated by our tools is owned by you. We don't claim any ownership of any data connected to you.
AES-256 encryption keeps your data safe at rest. Whenever data is transferred, TLS v1.2 is used to secure your data in transit.
None of the source code or data from your database leaves your machine. The source code analysis and the database analysis happen in your own environment. Only the generated data is uploaded.
We never store secrets in plain text. All secrets are encrypted and stored following industry best practices for management of cryptographic secrets.
We monitor all technologies used in our products and development cycle for updates and regularly deploy security patches and updated versions.
All changes to production systems are made using state of the art software for infrastructure and application deployments, following the industry best practices related to infrastructure as code.
We adamantly follow the idea of least privilege access across all of our production systems. This includes minimal fine grained access control at the authorization layer and fully minimized public facing network exposure.
We regularly conduct vulnerability scans and penetration tests both during development and in production to identify potential security issues.
We can support a custom set timeout session at your request.
Yes, we support role based access, based on three roles, a ‘read’ only role, a ‘write’ role, and an ‘admin’ role. The ‘admin’ role has full access to any API endpoint and UI view. The ‘write’ role is limited to only some API endpoints and views, but has access to the majority of the application. The ‘read’ role, as limited access to certain API endpoints and UI views, and can only ever lookup or access existing data, no creating, modifying or deleting data.
The API requires a JSON Web Token (JWT, OAuth 2.0) to gain authorized access to the API.