Security and Trust Center
Where code executes, which providers receive what, how secrets are handled, and what is retained. Written for the security review, not for the brochure.
Who is responsible for what
The platform is the same in every edition. Responsibility for operating it is not.
Code and data flows
Every outbound path from a run, what travels on it, and what controls it.
In a self-hosted deployment there is no BranchRunner-operated component in any of these paths.
What security information is published?
This page publishes the documented responsibility model, data-flow discussion, control descriptions, and current stated status. It does not imply unpublished certifications or contractual commitments.
Where does code execute?
The published operating model describes agents running in workspaces on runtime workers, separated from the control plane.
How are credentials handled?
Evaluate the documented reference boundary and the provider configuration for your environment. Deployment-specific identity and secret-manager scope must be confirmed before commitment.
Which controls are enforced?
Only controls explicitly described with their edition and availability scope should be treated as published. Planned or unverified controls are not commitments.
How do we share future security requirements?
Use the Enterprise interest form to describe the systems and requirements that matter. Submitting it does not start a security review or create a certification, SLA, or binding agreement.
Controls
Each control notes which editions it applies to, because a self-hosted deployment and a managed one are not the same security posture.
Each run executes in its own Git worktree and container set on a worker. No agent process runs on the control plane, and no two runs share a checkout.
TLS for all service-to-service and browser traffic. Data at rest encrypted at the volume level, with database-level encryption for secret references.
Secrets are stored as references and injected into the workspace at run time. Reveal and copy are logged; deleting a secret lists the workflows that depend on it.
Single sign-on is available in every edition. Community and Cloud include fixed basic roles; Enterprise adds granular roles scoped per repository and action. Enterprise SCIM provisioning is planned.
Each agent role is scoped for read, write and execute. Destructive tool use, external deployment and stage handoff can each require a named person.
Workspace egress is denied by default and allowlisted per environment and per run. Workers can sit in a private network with no inbound exposure.
Approvals, tool calls, secret reveals, policy decisions and configuration changes are recorded as events on the run, exportable for review.
Self-hosted deployments keep retention and deletion under the operator’s configuration and available storage. No managed Cloud backup or retention policy is currently offered; any future policy would be published with that offering.
Self-hosted operators own backup and restore procedures for the control-plane database. Managed and Enterprise recovery objectives have not been offered.
Which provider a session uses is configuration, visible per session. Nothing is routed through a BranchRunner proxy when you bring your own keys.
Advisories are published with affected versions, severity and remediation. Self-hosted operators are responsible for applying them.
Data-processing terms and subprocessor information are not publicly published. They are not represented as available on this website.
Compliance status
Honest status, including the things we have not done. Nothing here is a certification claim until the row says it is available.
Report a vulnerability
Report suspected vulnerabilities privately to [email protected]. The address is published in our RFC 9116 security.txt file. A detailed disclosure policy and response commitments are not yet published.
Advisories and subprocessors
No public advisory feed has been published.
OVHcloud hosts the public website, database, form submissions, and uploaded files; its processing location is not yet confirmed. Cloudflare provides website traffic delivery, security, and the country header used for notice selection. Google Analytics and Microsoft Clarity measure website use as described in the privacy policy. Roborian, Inc. is under consideration for a possible future Cloud offering; no customer Cloud deployment exists and it is not currently a customer-data subprocessor. Any future providers would be disclosed before a service is offered.
A Community or self-managed deployment has no BranchRunner subprocessors, because we do not operate any part of it. Your own providers are your subprocessors.
Bring your security team to the first call
We will walk the architecture and the data flows, and answer what is not yet certified.