Security
Security and data handling
What Protet collects from your builds, how long it keeps it, and where it runs. If your security review needs something that is not covered here, ask us directly.
What is collected
Protet collects the commands your build runs: the executable and its arguments for every process the job starts. The GitHub Action records them with auditd; the Kubernetes sensor records them with eBPF through Tetragon. Source code, build artifacts and build output are not collected. How each collector works is on How it works.
Cloud
On all cloud plans, including the Free plan on the hosted service, a finding is streamed live to whatever is subscribed with your credential the moment it fires. The activity your build sends is used only to check that build. It is held for at most 24 hours and is never archived, shared or published. Each build's result is kept for up to 6 hours so that your collector, CI job or SIEM relay, including the GitHub Action, can read it back, then deleted.
Every ingest event is authenticated with a per-customer credential, kept separate from the credentials used for anything else. Suspending an account blocks its ingest access immediately.
Protet does not use your data to improve the service without a separate, explicit agreement. See Privacy and the DPA.
On-prem deployment
On-prem and air-gapped deployments are available on request. The detection pipeline then runs entirely inside your own infrastructure. Nothing about your build sessions, neither the commands executed nor the findings generated, leaves your network unless you configure delivery to somewhere outside it. Protet's control plane never sees your build activity in this mode; its only role is issuing the license and the signed detection bundle your deployment verifies offline.
Detection bundles and licenses are cryptographically signed and verified locally before use. A deployment can run fully air-gapped: pull the signed bundle once, verify it, and operate with no ongoing network dependency on Protet's control plane.
Account and credential handling
- Passwords and tokens are never stored or logged in a form that could be read back, not even by us.
- Session cookies are locked down against theft and cross-site misuse.
- Every license change and account-status change is logged with who made it and when.
Transport and application hardening
- TLS everywhere in production, with standard browser-hardening headers on every response.
- Sign-up, login and verification are rate-limited to blunt automated abuse.
- The application runs as a non-root user in its container.
Infrastructure
The control plane is hosted on Swiss infrastructure (Infomaniak).
Reporting a vulnerability
If you find a security issue, we want to hear about it before anyone else does. Email hello@protet.io with what you found and how to reproduce it. We reply to every report. Our security.txt carries the same contact.