SOC 2 Type II
In audit · Q4 2026
GDPR compliant
DPA on request
99.98% uptime
last 12 months
HIPAA-ready
Enterprise tier
Encryption
✓ In transit
- TLS 1.3 enforced on all API endpoints and the dashboard
- HSTS with 1-year max-age, includeSubDomains, preload
- Mutual TLS between control plane and in-cluster agents
- Automated certificate rotation via Let's Encrypt + internal CA
✓ At rest
- AES-256 encryption on all customer data at rest (AWS KMS-backed)
- Per-customer envelope encryption keys for sensitive secrets
- Encrypted database snapshots retained for 35 days
- Zero plaintext secrets in logs, audits, or support dumps
Infrastructure
✓ Hosting
- Primary region AWS eu-west-1 (Ireland), DR in us-east-1
- Enterprise plan: data residency EU-only or US-only on request
- Dedicated VPC per Enterprise customer available
- No customer data ever leaves the chosen residency zone
✓ Access control
- Mandatory 2FA for all employees with production access
- SSO via Google Workspace; hardware tokens (YubiKey) required for admins
- Just-in-time access to production — no standing credentials
- All production actions audit-logged and reviewed weekly
Application security
✓ Code & supply chain
- Mandatory peer review on all production merges
- Snyk + CodeQL static analysis on every PR
- Dependency pinning; renovate bot with auto-merge on patch-level only
- Reproducible builds signed with Sigstore cosign
✓ Runtime
- Falco runtime detection in production clusters
- WAF (Cloudflare) in front of all public endpoints
- Automatic rate-limiting + bot detection
- Weekly third-party penetration test (CureIQ, invoiced quarterly)
Vulnerability disclosure
We run a private bug bounty with established researchers. If you believe you have found a security vulnerability in our Service, please email security@kubedevkit.com encrypted with our PGP key. We triage within 24 hours and award rewards from $100 (informational) to $5,000 (critical RCE).
Compliance documents
Current customers on Pro and Enterprise can request the following under NDA from security@kubedevkit.com:
- SOC 2 Type I report (Type II available Q1 2027)
- GDPR Data Processing Agreement (DPA)
- Sub-processor list with location & purpose
- Penetration test executive summary (last 12 months)
- Business Continuity & Disaster Recovery Plan
- Insurance certificates (Cyber liability $5M, E&O $3M)
Incident response
Security incidents affecting customer data are communicated within 24 hours via email to primary account contacts, plus a public post-mortem on our status page within 7 days. We follow a strict four-phase process: contain, eradicate, recover, learn. No customer has suffered a data breach in our operating history.