No-compromise security for mobile teams

Q: What does CI security mean on Bitrise?

CI security on Bitrise encompasses comprehensive security measures throughout the continuous integration process, including ephemeral isolated VMs, no source code storage, granular access controls, and encrypted data handling.

Q: How does Bitrise approach DevOps security?

Bitrise approaches DevOps security through multiple layers including SOC 2 Type II certification, PCI DSS compliance, GDPR compliance, ISO 27001 standards, ephemeral isolated VMs, encrypted data transmission, and comprehensive access controls.

Q: What secure infrastructure options are available?

Bitrise offers multiple infrastructure options: Public Build Platform with isolated VMs on shared hardware, Dedicated Build Platform with reserved physical machines, Private Build Platform with dedicated hardware and static IPs, Bitrise on AWS running in your own AWS account, and Bitrise Runners for fully self-hosted control.

Q: Do you store our source code?

No. Code only touches Bitrise if your workflow clones it, and only over SSH/TLS. Source code is not stored on Bitrise infrastructure.

Q: Can we run this in our own environment?

Yes. Bitrise on AWS runs in your own AWS account, VPC, and region where source code never leaves your environment. Bitrise Runners provides fully self-hosted control over data residency and policy.

Q: What reports can we request?

Security reports and compliance documentation are available through the Bitrise Trust Center, including SOC 2 Type II audit reports, PCI DSS assessments, and GDPR compliance documentation.

Q: Who has access to our code signing credentials?

Code signing credentials are protected through granular access controls with SSO, SAML, 2FA, and role-based permissions. Protected mode allows credentials to be locked so they can never be downloaded, viewed, or exported by anyone while still being usable in builds.

Trusted by industry-leading brands in finance, healthcare and other highly-regulated sectors.

Book a demo

Visit the Trust Center →

Certified, compliant, audit-ready

SOC 2 Type II

Independently audited, annually

PCI DSS

Assessed yearly by a QSA

GDPR

Fully compliant as a data controller

ISO 27001

Held by all our core infrastructure providers

“Bitrise has been instrumental in helping us not only run builds more efficiently, but also ensuring our users’ banking information stays secure. Bitrise was the rare third-party vendor that quickly passed through the verification checks and assessments that come with bringing new technology into a regulated financial institution.”

Dama Damjanovic

N26

Read the customer story

Choose your isolation level

Match your infrastructure to your risk profile. Every tier keeps the same CI/CD experience.

Explore all infrastructure options

Public Build Platform

Isolated VMs on shared hardware, destroyed after every build.

Find out more

Dedicated Build Platform

Physical machines reserved exclusively for your builds on demand.

Find out more

Private Build Platform

Hardware reserved for you at all times, own firewall, static IPs, site-to-site VPN

Find out more

Bitrise on AWS

Runs in your own AWS account, VPC, and region. Source code never leaves your environment.

Find out more

Bitrise Runners

Fully self-hosted, full control over data residency and policy.

Find out more

Build security you can count on

Ephemeral, isolated VMs

Each build gets a dedicated clean virtual machine, all files destroyed after.

No source code storage

Code only touches Bitrise if your workflow clones it, and only over SSH/TLS.

Granular access controls

SSO, SAML, 2FA, and role-based permissions on every secret.

Leak-proof code signing

iOS

Connect your Apple Developer account and Bitrise automatically creates, renews, and manages your signing certificates and provisioning profiles. No manual key handling.

Android

Upload your keystore once, your builds reference it through a time-limited, read-only download URL. Your alias and passwords are stored as protected build variables, never in plaintext config.

Protected mode

Lock any signing file and it can never be downloaded, viewed, or exported again, by anyone. Builds can still use it. The only remaining actions are delete and replace.

Data and network security

Encryption. AES-256-GCM at rest, TLS/SSH in transit
Backups. Geo-redundant, continuously backed up
Data residency. Choose your region via Bitrise on AWS (US, Ireland, Frankfurt, Singapore, Sydney)
Network. Web app firewalls, IDS/IPS, static exit IPs and VPN available for Dedicated/Private tiers.

Application security

Code review. Every change peer-reviewed by OWASP-trained engineers.
Automated scanning. Every PR scanned with RuboCop, Brakeman, and GoSec.
Penetration testing. Conducted by third-party testers, annually and after every major release
Vulnerability scanning. Continuous scanning via Invicti, Rapid7, and grype.
Bug bounty. Standing bounty program for outside security researchers

Put us through your security review

Book a demo Visit the Trust Center

Frequently Asked Questions

What does CI security mean on Bitrise?

Every build runs in its own isolated, ephemeral environment. Your source code is never stored, only pulled in over encrypted channels if your workflow clones it, and the machine is destroyed the moment your build finishes.

How does Bitrise approach DevOps security?

Isolation by default, access control on every secret, and infrastructure options (Dedicated, Private, AWS, self-hosted) that let you match physical control to your risk profile, not a one-size-fits-all cloud.

Is Bitrise built for DevSecOps?

Yes. Automated scanning runs on every pull request, third-party penetration testing happens annually and after major releases, and a standing bug bounty program keeps outside researchers testing our defenses year-round.

What secure infrastructure options are available?

Public Cloud, Dedicated Build Platform, Private Build Platform, Bitrise on AWS, and fully self-hosted Bitrise Runners. Explore all infrastructure options.

Do you store our source code?

No. It only reaches the build VM if your workflow clones it, and it stays encrypted the whole way.

Can we run this in our own environment?

Yes, Bitrise on AWS keeps your code in your AWS account, and Bitrise Runners let you go fully self-hosted.

What reports can we request?

SOC 2, PCI DSS, and penetration testing reports are all available by request via the Trust Center.

Who has access to our code signing credentials?

Only your project Admins can manage them. You can also lock signing files in Protected mode so they can never be downloaded or viewed by anyone again, only used by your builds.