Security Practices

1. Executive Summary

CloudRepo is a cloud-native software artifact and package repository operated by ChenPo LLC (d/b/a CloudRepo), a US-based company headquartered in Fargo, North Dakota. Founded in 2016, CloudRepo has over 10 years of operational history serving development teams who need reliable, secure artifact management.

We are bootstrapped and independent: we took no venture capital, so we answer to our customers. We have no enterprise sales team and no reason to trade security for short-term growth. We build a high-quality product and sell it at fair, predictable prices.

No known security breaches in our history.

2. Infrastructure Security

CloudRepo's origin runs on Amazon Web Services in the US-West (N. California) region, behind a global content delivery network (CDN). One metadata table also replicates to two other US AWS regions. Artifacts stay in one region.

Compute and Networking

• Cloud-native architecture with multi-AZ redundancy
• All production infrastructure runs within AWS with managed services handling availability and redundancy

Storage

• Artifact storage: Amazon S3 with 99.999999999% (11 nines) durability. Versioning is enabled on all artifact buckets.
• Metadata and database: Amazon DynamoDB with automated backups and point-in-time recovery

Network Security

• DDoS protection: AWS Shield Standard provides baseline protection against common network and transport layer DDoS attacks, automatically, on the AWS services we use
• TLS: Every connection to CloudRepo uses TLS 1.2 or later

Data Residency

• All customer artifacts and account data are stored in the United States (AWS)
• Certain operational subprocessors process limited categories of data (including billing contacts, operational records, support conversations, email addresses, and error and session metadata) and may do so outside the United States; see our subprocessor list for the current set

3. Data Protection

Encryption at Rest

• All S3 objects are encrypted using AES-256 server-side encryption
• DynamoDB tables use encryption at rest
• Row-level encryption is not implemented. Data is protected by encryption at rest combined with strict access controls at the application and infrastructure layers.

Encryption in Transit

• Every connection to CloudRepo uses TLS 1.2 or later. Unencrypted HTTP connections are rejected or redirected.

Credential Storage

• All user passwords are hashed using PBKDF2 with BLAKE2b-512, 50,000 iterations, and a 12-byte random salt per credential
• Passwords, MFA secrets, the tokens and keys CloudRepo issues, and the upstream registry and SSO client secrets you configure are stored only as one-way hashes or encrypted with AWS KMS, never in plaintext

Data Classification

• Customer artifacts and associated metadata are treated as confidential
• System metrics and logs are treated as internal. Logs may contain user IDs for troubleshooting purposes.

4. Access Controls

Production Infrastructure

• AWS Console access requires multi-factor authentication (MFA) for all users
• Production access is limited to essential personnel only, following the principle of least privilege
• No shared credentials exist for any production system; all access uses individual accounts with MFA

Source Code

• All source code is hosted on GitHub with MFA required for all contributors
• Code changes require review before merging to production branches

Access Reviews

• Access to production systems and source code is reviewed regularly to ensure appropriateness

5. Authentication

User Authentication

• Username and password authentication
• Multi-factor authentication (MFA) is included on every plan. Members who sign in with a password can protect their account with a time-based one-time password (TOTP) from an authenticator app, and get ten single-use backup codes when they set it up.
• Password policy: 8 to 256 characters

Password Security

• Hashing algorithm: PBKDF2 with BLAKE2b-512
• Iterations: 50,000
• Salt: 12-byte random salt, unique per credential

Password Reset

• Token-based reset using UUID tokens
• Tokens expire after 2 hours and are single-use
• Reset links are sent only to the account owner's registered email address, and we store only a salted hash of the secret in each link

SCIM 2.0 Provisioning

• SCIM 2.0 provisioning from Okta and Microsoft Entra ID: included on every plan
• The organization owner connects it in the portal, once single sign-on is on
• Your identity provider adds and updates your members, and removing or deactivating someone there after SCIM is connected ends their CloudRepo access

Single Sign-On

• SSO (SAML and OIDC): included

6. Application Security

Development Practices

• Automated code analysis is integrated into the development workflow
• Pre-commit validation and testing gates are enforced in the CI/CD pipeline
• Code is tested before it reaches production
• Code review is required for all changes to production code

Vulnerability Management

• We recommend integrating automated vulnerability scanning tools such as Snyk or Trivy into your CI/CD pipelines
• Independent security researchers have reported potential vulnerabilities, which we triaged and addressed.

7. Incident Response

Contact

• Dedicated security contact: security@cloudrepo.io
• We respond to security reports within one business day

Track Record

• No known security breaches in our history.

Response Process

1. Identification: Detect and confirm the security event
2. Containment: Isolate affected systems to prevent further impact
3. Eradication: Remove the root cause
4. Recovery: Restore normal operations and verify integrity
5. Post-incident review: Document lessons learned and implement improvements

Customer Notification

• Customers are notified without undue delay, and within 72 hours after we become aware of a breach, as our Data Processing Agreement provides.

8. Business Continuity & Disaster Recovery

Data Durability

• Artifact data is stored in Amazon S3 in a single AWS region (US-West-1) with 99.999999999% (11 nines) durability and object versioning for overwrite and deletion recovery within a 30-day window. Artifacts are not replicated to other regions.
• DynamoDB automated backups with point-in-time recovery protect metadata and configuration

Architecture Resilience

• Cloud-native architecture on AWS managed services with multi-AZ redundancy within our US-West region

Monitoring

• System health is monitored via Grafana Cloud with automated alerting on anomalies and threshold breaches

BCP/DR Plan

• We do not maintain a formal documented Business Continuity Plan or Disaster Recovery plan. Our cloud-native architecture on AWS managed services provides inherent resilience, and our operational procedures cover recovery scenarios.

9. Vendor Management & Subprocessors

All subprocessors are reviewed periodically for compliance and appropriateness.

The full subprocessor list is also published at cloudrepo.io/subprocessors.

10. Data Privacy

GDPR

• Data deletion requests are processed within 30 calendar days of a verified request. Deletion is an operator-run procedure covering artifacts and repository content in S3. Account and identity records (organization, users, credentials, API tokens, SSO configuration) and repository metadata rows are retained, and prior copies remain recoverable from S3 object versioning and DynamoDB point-in-time recovery for their retention window. Cancelling a subscription does not by itself delete data
• Customers can delete any repository and its contents themselves, at any time, through the portal or the API
• We collect email addresses where we need them, including on signup forms before signup finishes, and use them, with account information and usage, error and session-recording data, to run, support, debug and improve the service
• Download our Data Processing Agreement from the Trust Center. For a countersigned copy, email security@cloudrepo.io.

CCPA

• California residents can exercise their CCPA access, deletion, and do-not-sell rights by contacting privacy@cloudrepo.io. We do not sell personal information. Deletion requests are handled by the same operator-run procedure described above, with the same scope and retention exclusions

General Commitments

• We do not sell customer data to third parties
• Customer data (artifacts and repository contents) is used solely to run, support, debug and improve the CloudRepo service

11. Compliance Roadmap

CloudRepo does not currently hold formal security certifications such as SOC 2 or ISO 27001. We believe in transparency about where we are and where we are headed.

Ongoing

• Continued investment in security infrastructure and operational practices
• Periodic review of all subprocessor compliance status
• Regular evaluation of certification options

We evaluate certification options periodically. For now, certification costs are out of proportion to our size, so we focus on strong security practices and publishing them openly.

12. Document Revision History