How we build, ship, and stand behind our software

Secure build & publishing pipeline

• CI-only publishing. Every image is built, scanned, and submitted by automated pipelines (GitHub Actions). There are no manual, laptop-built artifacts in the catalog.
• Certification gates as code. Each cloud's marketplace certification requirements are encoded as pipeline gates that fail the build before a non-compliant artifact can ship.
• Monthly CVE rebuild cadence. The whole fleet is rebuilt and re-certified on a monthly patch wave, with out-of-band rebuilds for critical CVEs; stale versions are pruned rather than left listed.
• Scanned before submit. Vulnerability scanning runs on every build immediately before submission, and components with unpatchable upstream binaries are rebuilt from source instead.

Hardened by default

• CIS-aligned baselines. Hardening follows Center for Internet Security benchmarks, with dedicated CIS-hardened editions for supported platforms.
• Zero default credentials. No image ships with a shared or well-known password — a unique admin secret is generated per deployment on first boot, stored root-only.
• Minimal surface. Container images are built on distroless/minimal bases where the upstream supports it; VM images ship only the packages the workload needs.

Your tenant, your data

Everything we sell deploys into your cloud subscription or tenancy, under your identity and network controls. Our software does not phone home, and we have no access to your instances or the data they process unless you engage us for managed services and explicitly grant that access.