Security
Ensuring secure runners - WarpBuild
We take security very seriously at WarpBuild. Here are some of the measures we take to ensure that your builds, runners, and build environments are secure.
Compliance
SOC2 Type 2
WarpBuild is SOC2 Type 2 certified with 3 Trust Services Criteria: Security, Availability, and Confidentiality. The controls required for SOC2 compliance are implemented. We are happy to share our security documentation and work with you to ensure that we meet your compliance needs. Please request the documentation in our trust center or email us at [email protected] to discuss your requirements.
Security
Compute isolation
Each runner runs in its own virtual machine. The VMs are created on demand and destroyed after each build. This ensures that your builds are isolated from other builds and that no data is left behind.
The VMs are ephemeral, not reused, and isolated for maximum performance and security.
Storage protection
Each runner has its own encrypted storage volume that is created on demand and destroyed after each build. When caching is enabled to speed up your builds, the cache is encrypted and stored securely in a location that is only accessible to your runner.
Secrets
WarpBuild does not access or store any build secrets. Secrets are stored in your source code repository and are only accessible to your runner environment.
Control plane egress IPs
If your organization uses a GitHub IP allow list or restricts inbound traffic to a GitHub Enterprise Server instance, allowlist the WarpBuild control plane egress IPs. See control plane egress IPs for the list of IP addresses.
Audit log
Every change made in your organization through the dashboard or the API is recorded in the organization's audit log: who made it, what changed, when and from where. Events are written to write-once storage in your organization's data region, where nobody, including WarpBuild, can change or delete them before the retention period ends. Organization admins can view, filter and export the log from Organization → Security → Audit logs. See Audit logs.
Last updated on