Security

How we protect your artifacts, and how to report a vulnerability.

Platform

• TLS 1.2 or newer on every endpoint; HTTP is redirected to HTTPS.
• Artifacts are encrypted at rest and addressed by content digest, so a layer cannot be silently replaced.
• No anonymous access: every registry, repository and API request must carry a valid token.
• Access tokens are stored hashed, scoped to one team and one role, and can be revoked at any time.
• Audit log of pushes, deletions and token changes, exportable on Business plans.

Operations

• Production access requires hardware-backed multi-factor authentication and is logged.
• Dependencies and base images are rebuilt and scanned weekly.
• Backups are encrypted, stored in a second region and restore-tested every quarter.

Reporting a vulnerability

Please write to security@nordbaysys.com with a description and steps to reproduce. We acknowledge reports within two working days. Give us reasonable time to fix the issue before disclosing it, and do not access data that is not yours. Machine-readable contact details are in security.txt.