Security, built into your product.
How we handle your code, your data and your access while we work, and the controls we build in so your product is ready for an audit.
Your accounts. Only the access we need.Removed when we’re done.
Your code lives in your GitHub and your product runs in your cloud account. You invite us with only the access the work needs, and at handover we remove it and confirm it in writing.
The controls your auditor looks for.Built in as we build.
Access control, audit logs, encryption and the evidence to show them. Built into your product as it’s made, not added the month before an audit.
We build it in. Your auditor signs it off.We don’t certify anyone.
SOC 2 and HIPAA are judged on your company and your product. We build the controls into the architecture and prepare the evidence; your auditor tests them and issues the report.
How we handle your work.On our side of the build.
The people, the paperwork and the places your product is worked on.
- Confidentiality
- A mutual NDA before you share anything sensitive
- People
- Staff engineers, each under contract with CodeShip
- Where we work
- Inside your accounts and your repositories
- Your data
- Used only to build your product
- At handover
- Our access removed, and confirmed in writing
Questions, answered.Before you sign anything.
Is CodeShip SOC 2 certified?
No, and it isn’t CodeShip your auditor examines. SOC 2 and HIPAA are judged on your company and your product. We build the controls into your product, prepare the evidence, and follow your security requirements while we work; your auditor tests it and issues the report.
Our customer sent a security questionnaire. Can you help?
Yes. We answer the parts about how your product is built and how we work on it. If the review found gaps, see Enterprise readiness.
Who can see our code and data?
Only the people working on your product, inside accounts you own, with only the access the work needs. We remove it at handover and confirm it in writing.
Will you sign our NDA?
Yes, or we’ll send our mutual NDA. Either way it’s signed before you share anything sensitive.
Bring your security questions.
We’ll walk you through how we’d handle your code, your data and your audit.
Not ready for a call? Write to us.