Our founding team has run security teams and built secure products at Microsoft, Zynga, GE and Zero. Appsec360 is built from the ground up with the latest security-first design principles.
We mainly rely on metadata, such as state change events in your issue tracking system and version control systems.
We use OAuth-based APIs in most cases, and we pro-actively select the minimal scopes needed to provide the service.
Data is stored encrypted in AWS Cloud Platform. Keys are securely managed and regularly rotated with Amazon's Key Management Service.
Data in transit is encrypted using TLS.
We exclusively authenticate users using Github. We do not store user passwords.
User can control the level of access granted.
Your data is retained while you are our customer. In case you leave our service, all data will be removed upon the customer request or within one year of inactivity.
If you want to remove your data, please contact us at firstname.lastname@example.org
We do not have a bug-bounty program yet. Please contact us at email@example.com for security questions or concerns.
We only offer Appsec360 as a hosted SaaS at this time.