Your code deserves serious protection

Security isn't a feature we added later—it's fundamental to how Repolaris is built. From architecture to operations, every decision considers security first.

Our Commitment

Repolaris is built for teams that take security seriously. We understand that your source code is among your most valuable assets, and we treat it accordingly.

Defense in depth

Multiple layers of protection

Least privilege

Minimal access by default

Transparency

Clear documentation of practices

Continuous improvement

Regular audits and updates

Infrastructure Security

Data Centers

EU-based infrastructure

All data hosted in European data centers operated by Scaleway.

  • 24/7 on-site security
  • Biometric access controls
  • Video surveillance
  • Environmental controls

Network Security

Perimeter protection

  • DDoS mitigation
  • Web Application Firewall (WAF)
  • Intrusion detection/prevention
  • Network segmentation

Encryption

Data protection

  • TLS 1.3 for all traffic
  • HSTS enforced
  • Perfect forward secrecy
  • Modern cipher suites only

Compute Security

Container isolation

  • Workloads run in isolated containers
  • Minimal base images
  • Read-only filesystems where possible
  • No privileged containers

Application Security

Secure Development

  • Security-focused code review
  • Static analysis (SAST)
  • Dependency scanning
  • Security training for developers

Authentication

  • Secure password hashing (Argon2)
  • Multi-factor authentication
  • Passkey/WebAuthn support
  • Session management with secure tokens

API Authentication

  • Scoped personal access tokens
  • SSH key authentication
  • OAuth 2.0 / OIDC
  • Short-lived tokens for CI

Data Protection

  • AES-256 encryption at rest
  • TLS 1.3 encryption in transit
  • Tenant-isolated encryption keys (Enterprise)
  • Encrypted backups

Compliance & Certifications

Certified

SOC 2 Type II

Annual audit of security, availability, and confidentiality controls.

Certified

ISO 27001

Information security management system certification.

Compliant

GDPR

Full compliance with EU General Data Protection Regulation.

Compliant

CCPA

Compliance with California Consumer Privacy Act.

Responsible Disclosure

We reward security researchers who report vulnerabilities responsibly.

Bug Bounty Program

Scope

  • • repolaris.io domains
  • • API endpoints
  • • Client applications

Rewards

  • CriticalUp to €5,000
  • HighUp to €2,000
  • MediumUp to €500
  • LowUp to €100

Security Features

Available to All

Free tier and above

  • Two-factor authentication
  • SSH key management
  • Personal access tokens with scopes
  • Session management
  • Audit log (limited history)
  • Branch protection rules
  • Required reviews

Teams Plan

Additional features

  • Team-level audit logs
  • Environment secrets with approval
  • Enhanced branch protection
  • Secrets management

Enterprise Plan

Full security suite

  • SSO (SAML/OIDC)
  • SCIM provisioning
  • Full audit log export
  • IP allowlisting
  • Session policies
  • Customer-managed encryption keys
  • Dedicated infrastructure
  • Advanced compliance controls

Frequently Asked Questions

Is my code encrypted?

Yes. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).

Who can access my code?

Only users you authorize. Our employees access customer data only for support with explicit permission, and all access is logged.

Do you have a SOC 2 report?

Yes. SOC 2 Type II reports are available to customers under NDA.

How do you handle security incidents?

We have documented incident response procedures. Affected customers are notified promptly. Post-incident reviews improve our practices.

Can I run a penetration test?

Enterprise customers may conduct penetration tests with prior coordination. Contact security@repolaris.io.

Security questions?

Our security team is happy to discuss your requirements.