|Trust Center

CircleCI

CI/CD is the foundation of engineering productivity and speed. At CircleCI, we know that a team’s velocity must go hand in hand with building securely. World-class engineering teams don’t sacrifice security for speed, but rather, choose platforms like CircleCI that deliver both.

Our product philosophy for our customers has 8 pillars:

  • Security for All: We believe that security features should be accessible to all customers, regardless of their plan level.
  • Unobtrusive Security: We design security features to be intuitive and easy to use and believe most of all they must not interfere with the user experience.
  • Secure by Default: We build secure defaults out of the box.
  • Traceability: We believe visibility can drive accountability.
  • Store of No Value: We strive to minimize the amount of valuable or sensitive data stored.
  • Fail Securely: When we fail, we fail in a secure way.
  • Least Privilege: We grant users and systems only the minimum level of access necessary to perform their intended functions.
  • Complete Mediation: We ensure that all user actions are fully authorized and authenticated at all times.

We are constantly evaluating how we can improve both our internal security posture, and how we improve security for our customers. We invite questions and conversations on security at CircleCI and look forward to working with you to improve the security of the software ecosystem as a whole.

For customers interested in signing a Data Processing Addendum with CircleCI, you can sign our DPA here.

fa-envelope alpaca-fa-regular
compliance@circleci.com
fa-link alpaca-fa-regular
Privacy Policy

Controls

fa-magnifying-glass alpaca-fa-regular
Infrastructure security
ControlStatus
Remote access encrypted enforced

The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection.

fa-circle-check alpaca-fa-solid
Organizational security
ControlStatus
Anti-malware technology utilized

The company deploys anti-malware technology to environments commonly susceptible to malicious attacks and configures this to be updated routinely, logged, and installed on all relevant systems.

fa-circle-check alpaca-fa-solid
MDM system utilized

The company has a mobile device management (MDM) system in place to centrally manage mobile devices supporting the service.

fa-circle-check alpaca-fa-solid
Product security
ControlStatus
Control self-assessments conducted

The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are taken based on relevant findings. If the company has committed to an SLA for a finding, the corrective action is completed within that SLA.

fa-circle-check alpaca-fa-solid
Internal security procedures
ControlStatus
Development lifecycle established

The company has a formal systems development life cycle (SDLC) methodology in place that governs the development, acquisition, implementation, changes (including emergency changes), and maintenance of information systems and related technology requirements.

fa-circle-check alpaca-fa-solid

Top