Security & Compliance

PR and issue content is processed in-memory and never stored at rest. Only generated release notes are persisted—your source data stays yours.

All sensitive credentials (API keys, tokens, webhook secrets) are encrypted with AES-256-GCM before reaching the database. Quarterly automated key rotation with zero-downtime re-encryption.

Connect your own AWS Bedrock credentials for complete data sovereignty. Your AI inference stays within your AWS account—ReleaseRay never sees the prompts or responses.

All database connections enforce SSL with sslmode=verify-full and CA certificate pinning. No plaintext database traffic, ever.

Comprehensive security controls across access management, encryption, audit logging, change management, and incident response—aligned with SOC 2 Trust Service Criteria.

Encryption keys rotate quarterly via automated CI/CD workflows. Previous keys are retained for seamless decryption of existing data during the transition window.

Every action—draft generation, publishing, credential access, data deletion—is logged with actor, timestamp, IP, and context for full accountability.

Formal endpoint security policies, scheduled penetration testing, and vulnerability scanning ensure continuous security posture improvement.

Server-side JWT validation on every authenticated endpoint, Zod schema validation on all inputs, CSRF origin verification with strict URL parsing, and SSRF protection on outbound webhooks.

Multi-tier rate limiting across webhooks, API, LLM, and billing endpoints. Circuit breaker pattern fails closed on security-critical paths—no silent bypasses when infrastructure is degraded.