Security & Trust
What ShipGate touches, what it stores, and what it does not claim.
Last updated: August 18, 2026
Two paths, and they differ
Continuous CI runs as a workflow in your own GitHub Actions. The workflow requests contents: read and nothing else; the analysis happens on your runner and what travels back is the run record that becomes the “WholeStack / Readiness Advisory” check. The free hosted scan is the other way round: at /scan/repo you hand us a repository or a folder so we can scan it. That is the trade for zero-setup, and it is worth knowing which of the two you are using.
What We Do Not Claim
Security pages usually open with badges. Here is the opposite list first, because it is the part that changes how you should plan.
No SOC 2 report exists and no audit is complete. If your process requires one, tell us early — we will say so in writing rather than hand you a readiness slide.
No certification, and no date to promise you one by.
ShipGate publishes no CLI or binary, so there is no release signature to verify. CI runs as a GitHub workflow in your own repository.
This page quotes no uptime percentage. Enterprise agreements carry negotiated response and availability terms; nothing is implied outside one.
Controls That Exist Today
Access
- SSO: a SAML 2.0 or OIDC connection per workspace, with verified email domains and optional workspace-wide enforcement.
- Directory sync: SCIM 2.0 provisioning and deprovisioning, with directory groups mapped onto workspace roles. Okta and Azure AD have named connectors; other providers connect as generic SCIM v2.
- Roles: role-based access control on workspace resources.
- Multi-factor: available on accounts.
Audit log
- Exports are an NDJSON bundle with a manifest, a hash chain, and an HMAC signature — so an export can be re-verified afterwards rather than merely trusted.
- Retention is configurable per workspace rather than fixed by us.
- A single synchronous export is capped; larger ranges must be exported in windows. That limit exists so an export cannot stall the service, and the API says so rather than truncating quietly.
Transport and storage
- In transit: HTTPS everywhere; HTTP is redirected.
- At rest: application data lives in a managed PostgreSQL database at our hosting provider, and OAuth tokens are encrypted before they are stored.
Service Levels
No uptime figure is published here, because publishing one we have not measured and cannot be held to is worse than saying nothing. Two things are worth knowing regardless of contract:
- The CI workflow runs on your runners. If our API is unavailable, your pipeline does not stop — the check does not report, and that absence is visible rather than silently green.
- Enterprise agreements carry written response targets, an escalation path, and a named support channel. Those numbers are negotiated per contract. Contact sales for terms.
Incident Response
If a breach affects user data, we will notify affected users and the relevant supervisory authorities as required by applicable law, and the notice will state what was affected, what we did, and what you should do. We are not going to characterise our internal runbook maturity on a marketing page.
Vulnerability Disclosure
We welcome responsible disclosure. Our full disclosure policy covers scope, timelines, and researcher protections. The quick version:
- Report to security@shipgate.dev.
- We aim to acknowledge reports within two business days.
- No legal action against researchers who follow responsible disclosure practices.
- Credit in advisories, if you want it.
Sub-processors
ShipGate is operated by the same company, on the same infrastructure, as the rest of the platform — so it shares one sub-processor list rather than keeping a second copy that can drift out of agreement with the first. See the current sub-processor list, which names each provider, what it handles, and where processing happens.
Data Retention
- Account and workspace data are retained while the account is active.
- Audit-log retention is configurable per workspace.
- To request an export or deletion, contact privacy@shipgate.dev.
Contact
Security: security@shipgate.dev
Privacy: privacy@shipgate.dev
Everything else: team@shipgate.dev