Security & trust

How we protect your code and your data. rickub is built security-first — the git that’s never gonna let you down.

Encryption

In transit

All traffic — the web app, the API, and git over HTTPS and SSH — is encrypted with modern TLS or SSH. We redirect plaintext HTTP to HTTPS.

At rest

Your repositories, database records and backups are encrypted at rest on managed EU infrastructure.

Secrets

CI secrets are stored encrypted and are decrypted only inside the job that needs them. We never log secret values, and passwords are stored only as strong one-way hashes.

Access control

Deny by default

Authorization is deny-by-default: a request is refused unless a specific grant allows it. Repository access derives from ownership, organization role, collaborator grants and team membership — evaluated consistently on every access path.

Strong authentication

Sign in with a password plus optional two-factor authentication (TOTP). Git access uses scoped personal access tokens over HTTPS or registered SSH keys — never your password.

Organizations and SSO

Organizations can require two-factor authentication for members and connect single sign-on (SSO) so access follows your identity provider.

Least privilege

Internal access to production is limited to the people who need it, on a need-to-know basis, and is itself logged.

Monitoring and audit

Audit logging

Security-relevant actions — sign-ins, administrative actions, and organization changes — are recorded in an audit log. Organizations on eligible plans can forward their audit events to their own SIEM.

Isolated CI

Continuous-integration jobs run in isolated, ephemeral environments that are torn down after each run, so one build cannot reach another's data.

Vulnerability management

We track dependencies and platform updates and patch on a risk-prioritised basis.

Data residency and resilience

EU data residency

rickub is hosted and operated within the European Union (France). Personal data is processed in the EU/EEA — see our Privacy Policy.

Backups

We take regular, tested backups so we can recover from failures. Because git is distributed, your own clones are an additional line of defence.

Subprocessors

We use a short, EU-based list of subprocessors, published and kept current on our Subprocessors page.

Compliance posture

We build and operate rickub aligned to the SOC 2 Trust Services Criteria (security, availability and confidentiality) and to ISO/IEC 27001. We are working toward formal assessment against these frameworks. We describe them as targets we design to — we do not currently claim to hold a SOC 2 report or an ISO 27001 certificate, and we will say so plainly here once we do.

Reporting a vulnerability

Found a security issue? We want to hear from you. Email security@rickub.com with enough detail to reproduce it. Please give us reasonable time to investigate and fix before public disclosure, and don’t access or modify data that isn’t yours while testing. We won’t pursue good-faith research conducted under these guidelines.