Travis CI is GDPR- and Privacy Shield-compliant for the strictest of data protection standards for minimizing risk to your data and build artifacts.
Travis CI uses OAuth tokens for read-only access to repository data and write permissions to set up SSH keys, configure service hooks, and update build statuses.
Every job runs in an isolated virtual machine or container to prevent interference between concurrent builds.
Travis CI deploys in geographically diverse areas, with redundant facilities, to guarantee that your build history and artifacts are always securely held and accessible. We encrypt all data in transit with SSL/TLS.
Every virtualized build is destroyed after completion, and each new build begins with a fresh image for absolute guarantees against residual data.
Our mandatory automated process scans all raw job files using Trivy and detect-secrets to identify unmasked secrets, hide the offending credential, and produce a log scan report with the context your team needs to remediate.
Securely manage your credentials and keys for CI/CD builds with a new vault node and as little as additional lines of YAML in your .travis.yml file.
Leverage our CLI tooling to make confidential data or files in your jobs readable only by Travis CI.
Leverage Cosign (part of the Sigstore project) to sign container images or artifacts to confirm their origin wherever it’s being pulled and deployed.
When connecting to your VCS provider, like GitHub or Assembla, you stay in full control of how your OAuth tokens are used to read repository data and edit builds for new commits.
Control onboarding for new team members or contractors using Travis CI’s rich privilege limitation dashboard, ensuring only essential personnel can view secrets in pipeline configurations or custom debug output.
Generate a Software Bill of Materials for every build to automatically conform to your software supply chain policies. Then, easily and automatically upload the bill to any of the dozens of supported deployment providers.
We make our data security policies and partnerships readily available for verification.
For all other questions, please contact us.
Please contact our compliance team at [email protected].