Security
Compliance
Section titled “Compliance”- ISO 27001:2022 certified
- SOC 2 Type 2 attested
For policies, certificates, subprocessors, and live security posture, visit the Avrea Trust Center.
Encryption
Section titled “Encryption”All cache traffic between runners and cache proxies is encrypted in transit. Cache data is encrypted at rest in storage colocated with the runners.
Console and API access
Section titled “Console and API access”The Avrea console, API, and documentation are served exclusively over HTTPS with managed TLS certificates. Sign-in uses OAuth through GitHub or Google, or your organization's SAML single sign-on connection. Avrea does not store passwords.
Organizations can enforce SAML sign-in for verified company domains, keeping authentication, MFA, and access policies under the control of their identity provider.
GitHub App permissions
Section titled “GitHub App permissions”The Avrea GitHub App requests only the permissions its features need. See GitHub App Permissions for the complete list, what each permission is used for, and how Avrea scopes its tokens.
Network access
Section titled “Network access”Static IP egress gives an organization one stable public IPv4 address for outbound runner traffic. This makes it practical to restrict databases, APIs, and other external services to connections from your Avrea organization.
Cache isolation
Section titled “Cache isolation”Caches are isolated by repository:
- GitHub Actions cache is further scoped by Git ref.
- There is no cross-repository or cross-organization cache access.
Cache authentication
Section titled “Cache authentication”- GitHub Actions cache uses JWT tokens issued by GitHub for scoping and access control.
- Build cache requests are authenticated by the runner infrastructure. Only your jobs running on Avrea runners can access your cache, and caches are isolated by repository.
Reporting vulnerabilities
Section titled “Reporting vulnerabilities”If you discover a security issue, please contact security@avrea.com.