Compliance
The controls a public-sector, financial or defense reviewer asks about, the supply chain of a release, and the status of each attestation.
Public-sector controls
| Control | Answer |
|---|---|
| Data residency | Everything with content stays in your organization's cell; the only cell today is eu1 in AWS eu-central-1. See Data residency. |
| Identity | WorkOS, through platform.ciresk.com; WorkOS stores identity data in the US and holds no build content. |
| Tenancy and access | Every table with organization data carries the organization id with row-level security enabled; the request role has no UPDATE and no DELETE on the audit log or the job journal. See Security model. |
| Encryption | At rest: SSE-KMS with a customer-managed key per cell for the object store, and the same key for the database. In transit: HTTPS at the cell's load balancer; the bucket refuses requests without TLS. |
| Audit | An audit_log row for job runs and cancellations, leases, policy changes, OIDC exchanges, worker and repository changes, with X-Request-Id; append-only for the request role; readable through the API. Export is not available yet. |
| Secrets | Deploy secrets live on the workers' secrets backend, not in the control plane; a worker holds no git credential; pass_env values are injected into the task process only and masked in logs. |
| Isolation | Tasks run as an unprivileged user under cgroup caps with a per-task egress proxy; untrusted work runs in its own network namespace in block mode, only on workers labelled isolation=vm or disposable. |
| Operator access | No product path for Ciresk staff to an organization's content; the infrastructure paths are not yet behind a break-glass gate. See Security model. |
| Operations | Migrations apply at boot and are expand/contract, so the previous release runs on the new schema; the database has 14 days of automated backups with point-in-time recovery. |
| Egress | Per-organization allowlist on every worker, in audit mode by default; block mode by policy, and always for untrusted. |
Supply chain
Every release publishes a checksums.txt with the sha256 of each file; the release build signs it with minisign, and the CLI's publish step refuses an unsigned release. The shell installer (curl -fsSL https://get.ciresk.com/ci | sh) and the Windows installer (irm https://get.ciresk.com/ci.ps1 | iex) check the sha256 and the signature, and refuse to install without minisign; ciresk ci update checks the sha256 and the signature when one is published. Releases ship no SBOM, no provenance attestation and no container image signature today.
Attestations
| Item | Status |
|---|---|
GDPR Art. 28 DPA with sub-processor list (AWS eu-central-1, WorkOS) | Not available yet |
| SOC 2 Type II | No report exists today |
| ISO 27001 | Not available yet |
| DORA pack for financial clients | Not available yet |
| NIS2 supplier requirements | Not available yet |
| SBOMs, SLSA provenance, CRA SBOM obligations (from 2027-12-11) | Not available yet |
| Penetration test by an independent party | Not performed yet |
| Audit export formats and legal hold | Not available yet (per-organization retention of logs, artifacts and job events is a policy setting: Retention) |
Nothing in this table is certified or attested today.