Security

Gorilli Compliance reads your websites, repositories and policy documents, so it holds information you would not want exposed. This page explains how that data is handled.

Workspace isolation

• Every asset, scan, finding and document belongs to a single workspace, and every query is scoped to that workspace.
• Each member has a role (owner, admin, member or viewer) that limits what they can change in the workspace.

Secrets

• GitHub tokens are encrypted before they are stored and are only decrypted on the server when a scan or fix pull request needs them.
• Secrets found in scanned content are replaced with a non-reversible fingerprint before they are stored as evidence.
• Account passwords are stored as bcrypt hashes.

Scan evidence

• Evidence collected during a scan is append-only: new scans add records, they do not rewrite old ones.
• Each evidence record is stored with a SHA-256 hash, so you can show that it has not changed since it was collected.

Webhooks and connections

• GitHub push webhooks and billing webhooks are verified against their signatures before they are processed. Unsigned or mismatched requests are rejected.
• Websites are fetched over HTTPS.

Reporting a vulnerability

If you believe you’ve found a security issue in Gorilli Compliance, please email security@example.com. Include a description of the issue, steps to reproduce, and any relevant context.

Please do not publicly disclose the issue until we’ve had a reasonable chance to investigate and remediate.

Certifications

Gorilli Compliance helps you prepare compliance evidence for your own company. It does not itself hold a SOC 2 report or ISO 27001 certification, and its findings and generated documents are not legal advice.