Security and trust information for Reign.
See how Reign is deployed, how customer environments and data are protected, what the standard security pack contains, and how to report a vulnerability.
Data practicesThe standard packsecurity.txt
Attestation: iTmethods holds a SOC 2 Type II attestation for Reign Ops. The report, scope and period are available under non-disclosure. Reign Factory and Reign Gateway run on the same infrastructure as Reign Ops, and are operated by the same operations team under the same processes. The SOC 2 Type II scope is being updated to include them. What we hold, and the scope →
Security responsibilities for the selected deployment.
Each statement is tied to the selected deployment and the service in scope.
Reign runs as a dedicated single-tenant instance for each customer, on Reign Dedicated, operated by iTmethods, or in the customer’s own AWS or Azure account. Air-gapped and sovereign deployment are supported.
Identity, administrative access, service identities and privileged operations follow the requirements agreed for the customer environment. The deployment record identifies who administers the service and where access activity is recorded.
The deployment record documents data flows, storage, retention, encryption, key responsibility, telemetry and evidence destinations for the selected pattern.
Monitoring, vulnerability management, change control, incident response, backup and recovery are defined for the service in scope, with named ownership and escalation routes.
Encryption. Isolation. Evidence.
The architectural choices a reviewer actually asks about, stated without a badge wall.
Encryption in transit and at rest
TLS on the public surface. Encryption at rest on managed infrastructure. Key handling for a given instance is described in the pack, not asserted as a slogan here.
Where are the keys?
Tenant isolation
Every product deploys as a single-tenant dedicated instance. There is no multi-tenant operating model. Deployment options →
Who else is on this instance?
Evidence by design
Identity, policy decisions and change records are produced as the work happens.
What can you send a reviewer?
Security evidence available for review.
Sensitive material is provided through the appropriate protected channel.
Depending on the service and deployment in scope, iTmethods can provide architecture and data-flow information, the current subprocessor list, access and change-control information, relevant operating evidence and, under non-disclosure, the attestation report.
What the standard pack contains
What the standard pack contains
A current list of subprocessors, with advance notice of changes.
The list is maintained. It is released with the pack and kept current after signature.
The list
We maintain a list of the subprocessors involved in operating a customer instance, with the category of processing each one performs and the region in which it performs it. The list is released under non-disclosure as part of the standard pack and is not published on this page. No vendor is named here.
Notice of change
Changes to the list are notified in writing to the contacts a customer nominates for this purpose, in advance of the change taking effect, with the reason for the change and the category of processing affected. Where a customer holds an objection right under the agreement, the notice states how to exercise it. The mechanism sits in the contract rather than on this page.
Categories of data involved
- Source code and repository metadata belonging to the customer, where the engagement covers build and delivery tooling.
- Pipeline, build and deployment telemetry, including job records, timings and outcomes.
- Identity and access records for the users of the platform, sufficient to authenticate them and to evidence who did what.
- Configuration and policy definitions for the platform itself.
- Support correspondence and any artifacts a customer attaches to it.
Personal data in scope is generally limited to the workplace identity of platform users. Where an engagement puts a wider category in scope, that is recorded in the agreement rather than assumed by us.
What Gateway records at the model boundary.
The selected deployment defines approved model and tool destinations, capture and retention settings, and where evidence is stored. Reign Gateway applies policy before a call reaches an approved destination and records the caller, policy decision, destination and outcome. Content capture is off by default, so Gateway can record the decision without storing the text that triggered it. Calls outside policy are refused and recorded. This is enforcement with evidence, not a guarantee that mistakes are impossible.
Report a security concern.
One address, monitored, with a person behind it.
Report a suspected vulnerability through security@itmethods.com or the published security.txt. Include the affected component or address, steps to reproduce, the likely impact and a way to contact you. Customers should continue to report service incidents through their established escalation route.
What to include
What to include
- The affected component or address, and the version if you know it.
- Steps to reproduce, in enough detail that we can follow them.
- The impact you believe the issue has.
- How you would like to be credited, or that you would prefer not to be.
What we do with it
What we do with it
- The report is acknowledged to the address it came from and assigned to an owner.
- It is triaged by engineers who work on the affected component.
- Where a customer instance is affected, the affected customers are notified through the contacts held for that purpose.
- The reporter is told what was concluded, including when the conclusion is that no change is required.
We ask that reporters do not access, modify or retain data belonging to anyone else while testing, and that details are withheld from publication until a fix is available. We do not operate a paid bounty program, and we state no response window here rather than invent one we cannot hold to.
Send the questionnaire.
Send it to us with the deadline it is working to, and we will put the engineers who own each control in the room.