SECURITY
Our founding team has run security teams and built secure products at Microsoft, Zynga & GE. Appsec360 is built from the ground up with the latest security-first design principles.
WHAT WE STORE?
We mainly rely on metadata, such as state change events in your issue tracking system and version control systems. We use OAuth-based APIs in most cases and pro-actively select the minimal scopes needed to provide the service.
ENCRYPTION
Data is stored encrypted in the AWS Cloud Platform. Keys are securely managed and regularly rotated with Amazon's Key Management Service. Data in transit is encrypted using TLS.
ACCESS CONTROL
We exclusively authenticate users using Github. We do not store user passwords.
User can control the level of access granted.
DATA RETENTION
Your data is retained while you are our customer. If you leave our service, all data will be removed upon the customer's request or within one year of inactivity.
If you want to remove your data, please get in touch with us at support@appsec360.com
RESPONSIBLE DISCLOSURE POLICY
We do not have a bug-bounty program yet. Please contact us at support@appsec360.com for security questions or concerns.
Is there an on-premise version?
We only offer Appsec360 as a hosted SaaS at this time.