Appsec360 | Security

Our founding team has run security teams and built secure products at Microsoft, Zynga, GE and Zero. Appsec360 is built from the ground up with the latest security-first design principles.

What we store?

We mainly rely on metadata, such as state change events in your issue tracking system and version control systems.

We use OAuth-based APIs in most cases, and we pro-actively select the minimal scopes needed to provide the service.


Data is stored encrypted in AWS Cloud Platform. Keys are securely managed and regularly rotated with Amazon's Key Management Service.

Data in transit is encrypted using TLS.

Access control

We exclusively authenticate users using Github. We do not store user passwords.

User can control the level of access granted.

Data Retention

Your data is retained while you are our customer. In case you leave our service, all data will be removed upon the customer request or within one year of inactivity.
If you want to remove your data, please contact us at

Responsible Disclosure Policy

We do not have a bug-bounty program yet. Please contact us at for security questions or concerns.

Is there an on-premise version?

We only offer Appsec360 as a hosted SaaS at this time.