SECURITY IN APPCIRCLE

Reading Time: 3 minutes

A well-established CI/CD pipeline gets entwined with many enterprise processes and the security of the pipeline gets more and more crucial. In this article, we will outline how Appcircle ensures the security of your CI/CD pipeline.

Code Security in Appcircle

• Appcircle connects to your repository to fetch your projects and branches so that you can build your apps in the cloud, however the source codes are not stored in Appcircle infrastructure.
• The source code is fetched for the build only to a brand-new build agent specifically created for that build. Once the build is complete, the agent is killed along with all the source code and any leftover data from the build.
• GitHub, GitLab and Bitbucket are all supported by Appcircle through oAuth. The agents connecting to your repositories follow the protocols enforced by the repository providers.
• For all other repository providers, the only provided option is to use SSH connections for the utmost security.
• Appcircle never modifies the contents of the repository itself. During the build, it is possible to modify the contents with custom scripts and workflow steps by the user, but these are not permanent and only applicable for the local copy.
• Appcircle team does not have access to the source code for any means and purposes. The oAuth tokens or the SSH keys are stored securely in an AWS vault and they are only used to fetch the branch and commit list or during the build.

Infrastructure Security in Appcircle

• Appcircle fully runs on AWS, who considers cloud security as the highest priority with many built in security features and services. For more information on the cloud security, please refer to the AWS Security Center.
• Appcircle is built on Kubernetes. For every single build, there is a brand-new virtual machine specifically created for you. This enables Appcircle to keep your source codes secure and isolated from others.
• The virtual build agents run on an internal private network and they are not directly accessible from the outside.
• Even your concurrent builds run on different containers which eliminate the chances of conflicts and instability.
• After the build is done, the virtual machine is killed and there is no residual data storage.
• Only the selected build artifacts and the build logs are retained, and they are not accessible by the Appcircle team.
• The same level of security is also applicable for the Appcircle simulator/emulator. A brand new virtual device is generated for every session and once the session ends, the virtual device is killed and no residual data is stored.
• The same also applies for the shared app preview links. For every new session, a new device is generated even though the app is the same and you can set an expiration date for the public links as well.

Data Security in Appcircle

• All secret data, including the keys, signing identities, environment variables and secrets are stored in an AWS vault. Since these are highly confidential and crucial elements for DevOps, Appcircle provides the best-in-class security for any private element.
• For instance, the secret environment variables (both text keys and files) are not accessible externally. They can only be utilized in a build and they cannot be exposed by the build module users (e.g. they are automatically removed from the build logs). They cannot be modified and the only way to update them is deleting and re-adding.
• As for the signing identities, again, if a user does not have access to the signing identities module, they cannot view, download or edit the signing identities while being able to use them in builds.
• You can be highly confident when sharing the build logs with developers or others for any kind of assistance needed. They can see neither your secrets nor the signing identities.

Enterprise-Grade User Management and Logging in Appcircle

• For enterprises, Appcircle provides fine-grained permissions for all submodules so that you can manage which user can access which module in what level. This makes it well suited for team without the need to worrying about widespread access.
• Appcircle provides logs for all modules so that the enterprise admin can track which build is done by whom or who ran an in-browser app preview session and when. This provides full transparency and visibility across the entire platform.

Billing Safety with Appcircle

• Appcircle uses Stripe, which is world's one of the most used and trusted payment platform. Your credit card information is never stored in Appcircle and does not pass through Appcircle infrastructure.
• All transactions are done exclusively through the Stripe platform directly and transactions are done with 3D Secure for the supported credit cards.

Even Higher Security with Private Cloud and On-Premise Options

• The Kubernetes-based next generation architecture of Appcircle enables private cloud and on-premise deployments as well. Even though Appcircle provides high security, you can optionally ensure that the full CI/CD pipeline is hosted in your own infrastructure.

With Appcircle, you can manage the full CI/CD pipeline of mobile apps in a secure and trusted environment.