Trust Center
How CloudRepo protects your data and artifacts: security, compliance and privacy.
Security
How We Protect Your Data
- Encryption at Rest & In Transit
- AES-256 encryption for all stored artifacts. Every connection to CloudRepo uses TLS 1.2 or later. Passwords hashed with PBKDF2+BLAKE2b-512.
- Access Controls
- MFA required on all production systems. Principle of least privilege enforced. No shared credentials. Individual accounts for all access.
- US-Based Infrastructure
- Artifacts and account data are stored in the United States on AWS: artifacts in Amazon S3 (99.999999999% durability), metadata in DynamoDB with automated backups. Some subprocessors handle limited data outside the United States; our subprocessor list names them.
- No known security breaches in our history.
- We respond to security reports within one business day.
Compliance
Our Compliance Posture
CloudRepo does not have a SOC 2 report or ISO 27001 certification. Here is what we do to protect your data.
Encryption at Rest and in Transit
AES-256 at rest, and TLS 1.2 or later between your clients and CloudRepo
US Data Residency
Artifacts and account data in the United States (AWS)
No known security breaches in our history.
See Track Record in our Security Practices
Our infrastructure runs on Amazon Web Services
Documentation
Security Documentation
Download our security documents for your vendor review process.
Security Practices
Comprehensive overview of our security controls, infrastructure, and processes.
Security Self-Assessment
Complete 43-question vendor security questionnaire for enterprise procurement.
Compliance Status Letter
Founder letter on our security commitment and compliance posture.
FAQ
Frequently Asked Questions
Common questions about our security and compliance practices.
-
CloudRepo does not hold SOC 2 certification. As a bootstrapped company, the cost of formal certification is disproportionate to our size. Instead, we publish exactly how we protect your data in our Security Practices, Data Processing Agreement and Subprocessor List.
-
Yes. SSO via SAML and OIDC is included.
-
All customer artifacts and account data are stored in the United States (AWS). Artifacts are stored in Amazon S3 with 99.999999999% durability. Metadata is stored in Amazon DynamoDB. Certain operational subprocessors process limited categories of data (including billing contacts, operational records, support conversations, email addresses, and error and session metadata) and may do so outside the United States; see our subprocessor list for details.
-
Email privacy@cloudrepo.io with your data deletion request. We process verified requests within 30 calendar days. Deletion is an operator-run procedure that covers your artifacts and repository data in Amazon S3. It does not remove account and identity records (your organization record, user records, credentials, API tokens, and SSO configuration are retained), and repository metadata rows are kept with storage counters reset to zero. Because object storage uses versioning and our databases use point-in-time recovery, prior copies remain recoverable to us for their retention window. Note that cancelling a subscription does not by itself delete anything: deletion begins only when you request it. You can also delete any repository and its contents yourself, at any time, from the portal or the API.
-
No known security breaches in our history.
-
Yes. Our Data Processing Agreement is available for download from our Trust Center. Contact us at security@cloudrepo.io if you need a countersigned copy.
Need a Custom Security Review?
We're happy to complete vendor questionnaires, discuss our security practices, or address specific compliance requirements.