Hosting and data residency
Prodgator runs on a major cloud provider. Customer data is stored and processed in United States regions.
Encryption
- In transit: all connections use TLS 1.2 or higher. Plain HTTP requests are redirected to HTTPS.
- At rest: stored data is encrypted with AES-256.
- Provider tokens and webhook secrets are encrypted separately for each organization before they are stored.
- Encryption keys are held in a managed key service with access controls and automatic key rotation.
Access control and tenant isolation
Sign-in is handled by WorkOS. The Enterprise plan adds SAML and OIDC single sign-on. Inside an organization, every member has a role (reader, operator, editor or admin). Business and Enterprise add custom roles. Each request is tied to one organization, and your data is never combined with another organization's. Services use scoped permissions that allow only the access they need.
Audit logging
The Enterprise plan includes an audit log of administrative actions in your organization.
Backups and data retention
Production data has point-in-time recovery enabled. Pipeline and deployment history is kept for the retention period of your plan (Free: 7 days; Team: 30 days; Business: 90 days; Enterprise: 365 days).
Vulnerability management
Dependencies are audited on every change, and changes are reviewed and tested before they are released. See below for how to report a vulnerability.
AI features
AI features use a model provider that runs inside our cloud provider's United States regions. Your data is not used to train models. See the AI docs for what is sent and when.
Subprocessors
- Cloud infrastructure provider: hosting, storage, email delivery and AI models
- Identity provider: sign-in and single sign-on
- Payment processor: billing and payments
Slack, Jira and other integrations receive data only when you connect them. Email security@prodgator.io for the current named list.
Reporting a vulnerability
Email security@prodgator.io with the details and steps to reproduce. We reply within three business days. Please do not test against other customers' data, and give us a reasonable time to fix an issue before you publish it. Our security.txt has the same contact.