Question 1

Is Spacelift SOC 2 compliant?

Accepted Answer

Spacelift is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Spacelift GDPR compliant?

Accepted Answer

According to Spacelift's public trust center, Spacelift is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Spacelift SOC 2 Type I or Type II?

Accepted Answer

Spacelift is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Spacelift's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Spacelift's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Spacelift penetration tested?

Accepted Answer

Yes — Spacelift undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Question 6

Can I get Spacelift's SOC 2 report?

Accepted Answer

Spacelift's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 7

Does Spacelift have a penetration test report?

Accepted Answer

Spacelift publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Question 8

Is Spacelift secure?

Accepted Answer

Security isn't a single yes/no, but Spacelift is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does Spacelift have a bug bounty or vulnerability disclosure program?

Accepted Answer

Spacelift hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@spacelift.io or via a /security page (Spacelift lists a security contact).

Question 10

Who are Spacelift's subprocessors?

Accepted Answer

Spacelift lists 12 subprocessors on its trust center, including HubSpot, Google Workspace, AWS, Slack, Datadog. Buyers use this for fourth-party risk review.

Question 11

Where does Spacelift host or store data?

Accepted Answer

Spacelift hosts on AWS, and handles Credit card information, Personal health information, PII data in a very limited scope needed for authentication purposes or/and concerning services usage. Data residency details are on its trust center.

Question 12

Where is Spacelift's trust center or security page?

Accepted Answer

Spacelift's trust center is at https://trust.spacelift.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

I found a security bug. Do you have an established bug bounty program?

Accepted Answer

Yes! Please find the details here: https://yeswehack.com/programs/spacelift-io-bug-bounty-program

Question 14

Will Spacelift have access to our code repositories?

Accepted Answer

Yes, Spacelift requires access to a code repository that contains infrastructure code (Spacelift is an infrastructure orchestrator, and it's main function is to act as a middleware between this code and your cloud)

Question 15

Do you have direct access to your customers' data (including sensitive data)?

Accepted Answer

Spacelift operates on the cloud API level without a need to access stored data - we require read only access to selected code repositories. HIPPA and PCI are not applicable in our case, as we do not have access to such data. You can explicitly deny access to any sensitive data, such as PHI or cardholder data.

Question 16

Can you execute a Business Associate Agreement (BAA) for HIPPA data?

Accepted Answer

Given we don't need and don't have any access to PHI (as we only require read only access to selected code repositories and we operate on Cloud API level), we do not fall under HIPAA, so there is no need to sign a BAA. To eliminate any potential risk in this regard, you can configure the services to make sure we won't ever have access to PHI (e.g. explicitly deny access to the PHI data encryption key). We highly advise our customers to keep the least privilege principle. If you are interested in taking this approach, our security team can provide more details.

Question 17

Are you ISO 270001 certified?

Accepted Answer

In terms of ISO 27001, we are using it for internal purposes for risk management, however we are not certified as we decided to maintain product-related certification SOC 2 Type II. You can find the latest report in the resources section.

Question 18

What encryption do you use?

Accepted Answer

In our product we use at least TLS 1.2 for encryption in transit and AES-256 for encryption at rest. For private workers, there is also an option to BOYK. Nevertheless, this software is designed for Infrastracture as Code (IaC) management and is not intended for encryption purposes. Encryption within the software serves only as an auxiliary function to support its primary goal of IaC management. That type of encryption used is standard across most SaaS platforms. We provide integrations with external secret managers vaults.

Question 19

I want to delete my account. How should I proceed?

Accepted Answer

First of all, please mark your account for deletion. In order to do so: 1. Log into your account 2. Go to "Organization Settings" 3. Click “Mark for deletion” at the top of this page. Once the account is marked for deletion, please contact us at support@spacelift.io or privacy@spacelift.io to action the erasure.

Spacelift

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

Octopus Deploy

1099-Prep

Ask Ai