Our data is secured? This was a common question regarding our new customers. Security is one of the biggest considerations in everything we do!
The entire Waydev team is focused on keeping you and your data safe. We adhere to industry-leading standards to manage our network, secure our application, and set policies across our organization.
Your security is critical to us. We do not keep a copy of your repositories, we only copy the “Git” folder and right away after our analyzation is done we delete it.
We download a bare clone of your repositories using that token. A bare clone involves downloading only the diffs and does not check out a working tree.
Eventually, these stats get written to our database. No code is persisted at any point in the process. The service that initially cloned your repositories gets its container destroyed.
We always connect via SSH key pairs. When you disconnect your repositories, all associated data is purged from the system.
This can be accomplished securely by allowing public access via secure SSH access to internal repositories.
This ensures that all data transmitted to Waydev is done over a secure protocol, and allows our customers to maintain strict authentication and access security using SSH keys.
Waydev does not store your git credentials. Our code only interacts with Github, BitBucket or GitLab using temporary token credentials that expire after one hour.
Secure data transfer We use industry standards 256-Bit SSL (https) encryption for all internet-facing traffic to secure your data in transit.
For the credit card payment information we use Stripe (www.stripe.com) for all credit card processing of your payment information.
Stripe has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level This is the most stringent level of certification available in the payments industry. To accomplish this, we make use of best-in-class security tools and practices to maintain a high level of security at Stripe.
Encryption of sensitive data and communication
All card numbers are encrypted at rest with AES-256. Decryption keys are stored on separate machines. None of Stripe’s internal servers and daemons are able to obtain plaintext card numbers; instead, they can just request that cards be sent to a service provider on a static whitelist. Stripe’s infrastructure for storing, decrypting, and transmitting card numbers runs in separate hosting infrastructure and doesn’t share any credentials with Stripe’s primary services (API, website, etc.).
All passwords, social logins, and long-term git tokens are managed and held by Auth0. You’d give access to their system using standard OAuth flow. Read more about Auth0’s security and privacy certifications here: https://auth0.com/security.