Security
How Stepclimb protects your account and your code.
Last updated
Overview
We design Stepclimb so that a mistake in one place does not expose everything. This page lists what we do today, and nothing we do not do.
Data protection
- All traffic uses TLS.
- Data is encrypted at rest by our database and hosting providers.
- API keys and webhook secrets are shown once. API keys are stored as hashes.
- Every query is scoped to your organization.
Access control
- Sign in with GitHub, with optional two factor authentication.
- Roles limit what each team member can change.
- Staff access to production data is limited, logged and used only for support you request or to fix incidents.
Application security
- Rate limiting on public endpoints and on the API.
- Free tier abuse limits: a GitHub account at least 30 days old and one public repository pull request a month.
- Outbound webhooks are signed so you can verify them.
- Dependencies are updated regularly and checked for known vulnerabilities.
Infrastructure
We run on the providers listed on the subprocessors page. We rely on their physical and network security controls.
Incident response
If a breach affects your data we will tell you without undue delay and share what happened, what data was involved and what we are doing about it.
Report a vulnerability
Email contact@buffersoltech.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before you disclose it. We will not take legal action against honest research.