Security & compliance

Everything your security review will ask for.

Self-hosted software shifts most of the compliance surface onto you — which is the point, and also why you need to know exactly where our responsibility ends. This page is written for the person who has to sign off, not for a marketing funnel.

Report a vulnerability Hardening guide ↗

Deployment: On your hardware, your network
Vendor access: None. We cannot reach your instance
Telemetry: None collected, ever
Data residency: Wherever you install it
Air-gapped: Supported, offline bundle
Disclosure: security@rhodecode.com
Advisories: Published with every patch

01Shared responsibility

Who is responsible for what

A managed SaaS vendor takes on your infrastructure risk and gives you their breach exposure. Self-hosting inverts that. Neither is automatically safer — but only one of them lets you answer “where is our source code?” with a rack number.

Control RhodeCode You

Application code and patches Ours Apply them

Vulnerability disclosure Ours Subscribe to advisories

Host operating system None Yours

Network and firewall None Yours

Backups and restore testing None Yours

Identity provider We integrate Yours to operate

Access policy and reviews We enforce Yours to define

Audit log retention We record Yours to keep

02Disclosure

Disclosure and advisories

Advisories published with every patch

Advisories go to the mailing list and the documentation on the same day the patch ships, with mitigation for sites that cannot upgrade immediately — air-gapped installs often cannot. We do not embargo advisories to protect a release narrative.

02.1

Report

Mail security@rhodecode.com. A core developer reads it, not a triage queue.

Acknowledged within 24 h

02.2

Assess

We reproduce against supported versions and score severity honestly.

Assessed within 5 days

02.3

Patch

A fix ships in a point release, with mitigation for sites that cannot upgrade at once.

Critical: days, not quarters

02.4

Publish

The advisory goes to the mailing list and the documentation on the day the patch ships.

Same day as the patch

Known issues & advisories ↗

03Controls

Controls a reviewer can map to a framework

We do not claim certifications the product cannot hold — a self-hosted binary is not SOC 2 audited; your deployment of it might be. What we can give you is the control surface, mapped to the clauses reviewers usually cite.

Ref Control What RhodeCode enforces Maps to

03.1 Access control User, group, repository-group and path-level grants with explicit denies and inheritance. SOC 2 CC6.1 · ISO A.9.2 · NIST AC-3

03.2 Authentication LDAP, Active Directory, SAML 2.0, CAS, OAuth, PAM and 2FA against your own directory. SOC 2 CC6.1 · ISO A.9.4 · NIST IA-2

03.3 Audit logging Immutable log of every grant, revoke, push and force-push, streamable to your SIEM. SOC 2 CC7.2 · ISO A.12.4 · NIST AU-2

03.4 Change management Reviewer rules, required approvals and signed commits on protected branches. SOC 2 CC8.1 · ISO A.14.2 · NIST CM-3

03.5 Network restriction Per-subject IP binding, so a credential outside the range authenticates nowhere. SOC 2 CC6.6 · ISO A.13.1 · NIST SC-7

03.6 Segregation of duties Path-based reviewer rules assign owners the author cannot approve for. SOC 2 CC5.2 · ISO A.6.1 · NIST AC-5