What you control, what we control, and what we cannot see.
RhodeCode is installed on your hardware, inside your network boundary. That shortens the data-flow diagram a security review has to reason about, and it changes who is responsible for what — which is set out below rather than implied.
RhodeCode collects no telemetry and your instance never contacts us. The product does make outbound connections in normal use — to AI providers, integrations and identity providers you configure.
Deployed by
What happens when you report a vulnerability
security@rhodecode.comFour steps, each with a stated target rather than a promise to look into it.
Report to security@rhodecode.com. PGP fingerprints for encrypted reports are published in the documentation.
Mail security@rhodecode.com. A core developer reads it, not a triage queue.
Acknowledged within 24 hWe reproduce against supported versions and score severity honestly.
Assessed within 5 daysA fix ships in a point release, with mitigation for sites that cannot upgrade at once.
Critical: days, not quartersThe advisory goes to the mailing list and the documentation on the day the patch ships.
Same day as the patchControl mapping
Which RhodeCode control helps you evidence which clause. The clause column is its own column because that is how an auditor reads it.
| Control | What it does | Maps to |
|---|---|---|
| 03.1Access control | User, group, repository-group and path-level grants with explicit denies and inheritance. | SOC 2 CC6.1 · ISO A.9.2 · NIST AC-3 |
| 03.2Authentication | LDAP, Active Directory, SAML 2.0, CAS, OAuth, PAM and 2FA against your own directory. | SOC 2 CC6.1 · ISO A.9.4 · NIST IA-2 |
| 03.3Audit logging | Immutable log of every grant, revoke, push and force-push, streamable to your SIEM. | SOC 2 CC7.2 · ISO A.12.4 · NIST AU-2 |
| 03.4Change management | Reviewer rules, required approvals and signed commits on protected branches. | SOC 2 CC8.1 · ISO A.14.2 · NIST CM-3 |
| 03.5Network restriction | Per-subject IP binding, so a credential outside the range authenticates nowhere. | SOC 2 CC6.6 · ISO A.13.1 · NIST SC-7 |
| 03.6Segregation of duties | Path-based reviewer rules assign owners the author cannot approve for. | SOC 2 CC5.2 · ISO A.6.1 · NIST AC-5 |
These are the controls RhodeCode provides and the clauses they help you evidence. They are not a certification: RhodeCode is software you operate, so the audited entity is you.
Send us the security questionnaire
Most of a source-control security review is answered above. For the rest, write to us and an engineer will answer it — including the questions where the answer is "you, not us".