Security

What we hold, how it's protected, and what we haven't done yet.

ReleaseGreen stores which accounts, identifiers and release targets belong to your apps, plus your notes. It does not ask for store passwords, signing keys or build artifacts. Here is how what it does hold is handled.

• Only public material is accepted.Certificates and fingerprints, never private keys. A pasted private key is rejected rather than stored.
• Encrypted per organization.Free-text fields are encrypted with AES-256-GCM using a data key unique to your organization. Each ciphertext is bound to its organization and row, so a copied value will not decrypt anywhere else. Data keys are themselves wrapped by a key in Google Cloud KMS that never leaves Google, and that key rotates every 90 days.
• Tenant isolation in the database.Every query runs inside your organization's context and Postgres row-level security enforces it. The web application's database role cannot bypass it, and the application refuses to start if it ever could.
• Read-only GitHub access.The GitHub App requests read access to repository contents on the repositories you pick. Access tokens are created per repository, kept in memory for one check and never written down. The app's private key is only available to the background worker, not the web process.
• A tamper-evident audit log.Sign-ins, membership changes and billing events are written to an append-only log in which each entry includes a hash of the one before it, so edits or deletions show up.
• Careful outbound requests.Checks that look up public registries or your website go through a fetcher that blocks private and internal addresses, caps response size and does not follow redirects into them.
• Payments stay with Stripe.Card details go to Stripe Checkout and never touch our servers. We keep Stripe's identifiers and your subscription status.
• Sign-in.An emailed one-time code or a passkey. No passwords to leak.
• Hosting.Google Cloud, europe-west1 (Belgium): Cloud Run and Cloud SQL, with automated backups and point-in-time recovery. Access to the encryption key and to secrets is logged.

What we have not done

• No independent penetration test yet.
• No SOC 2 or ISO 27001 report. If you need one to buy, tell us.
• Deleting an organization makes its data unreadable immediately. Encrypted copies in backups age out with the backup retention window.

Reporting a problem

If you think you have found a vulnerability, email hello@partechsystems.com with the details. We will acknowledge it, and we will not pursue anyone who reports in good faith and does not access other people's data.