Security & Trust

We secure the platform
that secures your stack.

Outrightly processes sensitive dependency data and security findings. Here is exactly how we protect your data.

security@outrightly.io
SOC 2 Type IIIn Progress
GDPRActive
HIPAA ReadyPlanned
ISO 27001Planned

Data Security

🔐

Encryption at Rest

All data stored in Outrightly databases is encrypted using AES-256-GCM. Database volumes are encrypted at the infrastructure level via our hosting provider. Encryption keys are managed through a dedicated key management service and rotated annually. Your dependency manifests and stack configurations are never stored in plaintext.
🔒

Encryption in Transit

All communication between your browser, our API, and our infrastructure uses TLS 1.3. We enforce HSTS with a max-age of one year including subdomains. Older TLS versions (1.0, 1.1) and weak cipher suites are disabled at the load balancer level.
🗂

Data Minimization

Outrightly only stores what is necessary to deliver the service: package names, ecosystems, and declared versions. We do not store your source code, environment variables, secrets, or any application runtime data. Uploaded manifest files are parsed in memory and discarded after import.

Access Controls

🧱

Row-Level Security

Every database query is scoped to the authenticated user via row-level security (RLS) policies enforced at the PostgreSQL layer — not just at the application layer. Cross-account data access is prevented by database-level policy, verified by our automated test suite. No application code path can bypass the RLS constraints.
🔑

Multi-Factor Authentication

MFA is available for all accounts via TOTP (authenticator apps). Enterprise accounts can enforce MFA as a policy requirement. We recommend enabling MFA for any account with connected Slack or PagerDuty integrations.
👁

Audit Logging

Full audit logs of user actions — logins, stack changes, alert acknowledgments, API key usage — are on our enterprise roadmap and currently in development. Basic activity history is available on the dashboard today. We will notify enterprise customers when full immutable audit logs are released.

Enterprise Roadmap

The following enterprise controls are actively being built. We are transparent about what is live today versus what is coming. Contact us for timelines or to join early access.

Roadmap
SSO / SAML 2.0
Single sign-on for enterprise identity providers (Okta, Azure AD, Google Workspace).
Roadmap
Role-Based Access Control (RBAC)
Granular roles: viewer, responder, admin. Scoped per team or stack.
Roadmap
Immutable Audit Logs
12-month retention, dashboard + API export, compliance-ready.
Roadmap
Custom Data Residency
EU and other regional deployments available on request for enterprise contracts.

Interested in early access? team@outrightly.io

Infrastructure

🌐

Hosting & Data Residency

Outrightly infrastructure runs in the US on Vercel (web layer) and Railway (worker, database). Data is stored in a PostgreSQL database in US-East regions. Enterprise customers requiring EU data residency can contact us for a private deployment option.
🔄

Backups

Database backups run every 6 hours and are retained for 30 days. Point-in-time recovery is enabled. Backups are encrypted with a separate key and stored in geographically isolated storage.
🚨

Incident Response

Our on-call rotation monitors infrastructure 24/7. In the event of a security incident affecting customer data, we will notify affected customers within 72 hours per GDPR Article 33 requirements. Historical incidents and postmortems are published on our status page.

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a vulnerability in Outrightly, please report it to us privately before public disclosure. We commit to:

  • Acknowledge receipt within 24 hours
  • Provide an initial assessment within 72 hours
  • Keep you informed throughout the remediation process
  • Credit you in our security advisories (if desired)

Out of scope: DoS attacks, social engineering, physical attacks, and issues in third-party services we rely on.

security@outrightly.ioPGP key available on request