Security
Your source code stays yours.
Attesta is designed to work from metadata and hashes. Here are the principles behind that, and an honest roadmap for what is not built yet.
No certifications today
Design principles
Metadata and hashes, not source code
The core ledger is designed to work from commit and PR metadata, review events, check results, and hashes. It does not need your source code.
Tamper-evident by construction
Every event includes the hash of the previous event. Editing history breaks the chain and verification shows where.
Least privilege
The git app asks for read-only scopes limited to metadata. API keys are scoped. CI uses workload identity rather than long-lived secrets.
Honest certainty
Attested, Declared, and Inferred are always labelled. Estimates are never presented as proof.
Tenant isolation
Each workspace has its own ledger and its own keys. Records from one tenant are never mixed into another's chain.
Deletion you can reason about
Ledger entries hold metadata and hashes. Retention windows are set per plan, and what happens on deletion will be documented before general availability.
Security roadmap
Planned means we intend to build it. In design means we are working out how.
| Item | Description | Status |
|---|---|---|
| SSO (SAML/OIDC) | Sign in through your identity provider. | Planned |
| SCIM provisioning | Automated user lifecycle from your identity provider. | Planned |
| Regional storage | Choose where a workspace's records are stored. | In design |
| WORM retention | Write-once storage for long-retention plans. | In design |
| Self-hosted collector | Run the event collector inside your own network. | In design |
| Signed ledger checkpoints | Periodic signatures over the chain head, with public verification keys. | In design |
| Independent security assessment | Third-party penetration testing of the platform. | Planned |
| Compliance programme | We have not yet started any formal certification. We will publish the scope and status here when that changes. | Planned |
Responsible disclosure
If you believe you have found a security issue in this website or in Attesta, please tell us through the contact form and choose the topic “Security or responsible disclosure”. Include what you found, how to reproduce it, and how to reach you. Please do not access other people’s data or disrupt the service while testing.