We take our own
security seriously
Due to the sensitivity of the data stored in Aikido, security on our own platform is our highest priority.
Compliance
Aikido is ISO 27001:2022, ISO 42001 & AICPA's SOC 2 Type II compliant, and FedRAMP Certified: Class C (Moderate).
Pentesting & Bug Bounties
Aikido conducts annual external
pentests and maintains an active
bug bounty program.
Message help@aikido.dev with your Intigriti
username to get invited to the bug bounty program.
Aikido
never stores your code.
Aikido doesn't store your code after completing the analysis. We perform actions such as git clones in a fresh docker container for each repository. After analysis, the data is wiped and the docker container is terminated.
Online scanning
For GitHub, no refresh or access tokens are stored in our database. An Aikido database breach would not result in your GitHub code being downloadable. By default, our integrations require a read-only scope.
Local scanning
Alternatively, you can run Aikido locally (on-prem) as well. Download the Aikido local scanners to get started.
Frequently Asked Questions
Yes - you can connect a real repo (read-only access), or use our public demo project to explore the platform. All scans are read-only and Aikido never makes changes to your code. Fixes are proposed via pull requests you review and merge.
We clone your repositories into short-lived, isolated environments created just for your scans. These environments exist only for the duration of the analysis, which usually completes in one to five minutes. Once the scan finishes, every clone and container is automatically removed.
We can’t & won’t, this is guaranteed by read-only access.
Aikido does not store your code after an analysis. Some analyses, such as SAST and Secrets Detection, require a git clone operation. More detailed information can be found on help.aikido.dev.
We’re doing everything we can to be fully secure & compliant. Aikido has been examined to attest that its system and the suitability of the design of controls meets the AICPA's SOC 2 Type II & ISO 27001:2022 requirements. Find out more on our Trust Center.
The core platform is API-based, so you are up and running in minutes. This also makes Aikido less intrusive. We use an on-device agent for Device Protection, our endpoint security tool.
Yes we do! You can find our bug bounty programs on Intigriti.
Aikido is available on any device, worldwide.
Health checks & simple pings of the components are used to check if the functions are operational.
At Aikido, we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.
If you discover a security vulnerability, we would like to know about it so we can take steps to address it as quickly as possible.