Enterprise security on every plan
Every connection to CloudRepo uses TLS 1.2 or later, and stored artifacts are encrypted at rest with AES-256.
Every security control and its status
| Control | Status |
|---|---|
| MFA An authenticator app plus backup codes; the owner can require it. MFA guide | Live |
| Audit log Sign-ins, token changes, uploads and changes to the MFA requirement, newest first, for the organization's owner. Audit Log guide | Live |
| Encryption at rest and in transit | Live |
| Human support | Live |
| Unlimited users, no per-seat pricing | Live |
| SSO (SAML, OIDC) Set up under Security, SAML or OIDC SSO guide | Included |
| SCIM | Coming soon |
| Access log | Coming soon |
For your security review: Security questionnaire
Looking for security documentation, our DPA, or subprocessor list?
Visit our Trust CenterInfrastructure
Your artifacts stay in the US
CloudRepo is a US company based in Fargo, North Dakota. Your artifacts and account data are stored in the United States (AWS). Certain operational subprocessors process limited categories of data (including billing contacts, operational records, support conversations, email addresses, and error and session metadata) and may do so outside the United States.
- Your artifacts stay in the US
-
Artifacts (Amazon S3) and metadata (Amazon DynamoDB) are stored in the United States, with primary hosting in AWS US-West (N. California). Some subprocessors handle limited data outside the United States; see our subprocessor list.
- Redundancy Across Availability Zones
-
Redundancy across multiple AWS Availability Zones within a single US region (US-West-1) for high availability. AWS Shield Standard provides baseline protection against common network and transport layer DDoS attacks, automatically, on the AWS services we use.
Security Model
Security Practices
Your artifacts are protected by encryption in transit and at rest, with AWS Shield Standard providing baseline DDoS protection.
- Encrypted in transit and at rest
- TLS 1.2 or later on every connection between your clients and CloudRepo, and AES-256 encryption at rest for every stored artifact.
- Access Control & Authentication
- Token-based authentication, granular repository permissions, and team-level access controls.
- Data Redundancy & Backups
- Automated backups with point-in-time recovery. 99.999999999% (11 nines) durability with object versioning on our Amazon S3 backed artifact storage.
- Network Security
- AWS Shield Standard DDoS protection, VPC network isolation, and security group enforcement. Infrastructure hardening and regular security patching across all systems.
- Monitoring & Incident Response
- Automated system monitoring and alerting via CloudWatch and Grafana. Security event logging and analysis. Documented incident response procedures.
- Vulnerability Management
- We recommend integrating dependency vulnerability scanning tools like Snyk, Dependabot, or Trivy into your CI/CD pipeline. CloudRepo supports this workflow through standard artifact upload and download APIs. Formal automated vulnerability scanning of our own systems is on our roadmap.
Compliance
Transparency Over Certifications
CloudRepo does not currently hold SOC 2 or ISO 27001 certifications. Instead, we publish exactly how we protect your data, gaps included.
- Data Processing Agreement
- We process verified deletion requests within 30 days. Our DPA spells out what deletion covers and what it keeps. Cancelling a subscription does not delete data on its own. Download our DPA.
- Security Documentation
- Comprehensive Security Practices Document, Compliance Status Letter, and published Subprocessor List. Visit our Trust Center to download.
- No known security breaches in our history.
- Security issues triaged within one business day at security@cloudrepo.io.
Architecture
Built on AWS
CloudRepo runs on AWS infrastructure for reliability, performance, and security.
Storage Layer
All artifacts stored in Amazon S3 with 99.999999999% durability. S3 versioning enabled for artifact history. Server-side encryption with AES-256.
Metadata & Database
Amazon DynamoDB for fast, scalable metadata storage. Automated backups with point-in-time recovery.
Compute & Application
Runs across multiple AWS Availability Zones in our US-West region for high availability.
Network & Delivery
AWS Shield Standard for DDoS protection. VPC isolation and security groups for network segmentation. TLS 1.2+ encryption for every connection to CloudRepo.
Questions about security?
We're happy to discuss our security practices, compliance roadmap, and how we protect your artifacts. Contact us for more details.