# Security

## Compliance

- **ISO 27001:2022** certified
- **SOC 2** Type 2 attested

For policies, certificates, subprocessors, and live security posture, visit
the [Avrea Trust Center](https://trust.avrea.com).

## Encryption

All cache traffic between runners and cache proxies is encrypted in transit.
Cache data is encrypted at rest in storage colocated with the runners.

## Console and API access

The Avrea console, API, and documentation are served exclusively over HTTPS
with managed TLS certificates. Sign-in uses OAuth through **GitHub** or
**Google**, or your organization's [SAML single sign-on](/saml-sso/)
connection. Avrea does not store passwords.

Organizations can enforce SAML sign-in for verified company domains, keeping
authentication, MFA, and access policies under the control of their identity
provider.

## GitHub App permissions

The Avrea GitHub App requests only the permissions its features need. See
[GitHub App Permissions](/github-permissions/) for the complete list, what
each permission is used for, and how Avrea scopes its tokens.

## Network access

[Static IP egress](/static-ip/) gives an organization one stable public IPv4
address for outbound runner traffic. This makes it practical to restrict
databases, APIs, and other external services to connections from your Avrea
organization.

## Cache isolation

Caches are isolated by repository:

- **GitHub Actions cache** is further scoped by Git ref.
- There is no cross-repository or cross-organization cache access.

## Cache authentication

- **GitHub Actions cache** uses JWT tokens issued by GitHub for scoping and access control.
- **Build cache** requests are authenticated by the runner infrastructure. Only your jobs running on Avrea runners can access your cache, and caches are isolated by repository.

## Reporting vulnerabilities

If you discover a security issue, please contact [security@avrea.com](mailto:security@avrea.com).