Trust & Security
Security is the product.
This page documents Harden's security controls, compliance posture, and data handling practices. It is written for InfoSec reviewers running vendor questionnaires, procurement teams evaluating risk, and engineering champions who need to defend their choice internally.
Last updated: April 24, 2026 · Security contact: security@harden.run
Security overview
Cloud
AWS
Multi-AZ resilience · 4hr RTO / 24hr RPO
Encryption
AES-256
At rest and in transit
SSO & MFA
Enforced
All employees, all admin paths
Penetration testing
Continuous + scheduled
AI/automated live · third-party scheduled
ISO 27001
Under evaluation
Post-SOC 2 Type II — no committed date
How customer data flows through Harden
Harden is a two-part system. A satellite runs inside the customer's Kubernetes cluster, in the customer's VPC. A control plane runs in Harden's AWS account and handles source code analysis and security artifact generation. Runtime traffic, secrets, and customer application data stay inside the customer perimeter.
Customer VPC
1 · 3→ Source code (TLS, signed upload)
← Signed bundles + policy artifacts
→ Telemetry & deployment status (no customer data)
Harden control plane — AWS us-west-2
1 · 2 · 3Customer source code is analyzed in our control plane; hardened bundles are pulled into the customer cluster and run there. No customer runtime data, secrets, or end-user PII traverses the control plane.
Enterprise option
Self-hosted control plane
For customers who require source code never to leave their perimeter, Harden offers a fully self-hosted control plane that runs inside your own AWS account. No source code transits Harden infrastructure. Contact us to discuss Enterprise tier pricing.
Infrastructure & data handling
- Cloud provider
- Amazon Web Services
- Production region
us-west-2(Oregon)- Account isolation
- Dedicated production AWS account, isolated from staging, dev, and corporate accounts
- Compute
- Amazon EKS, Kubernetes
1.35, Auto Mode, three availability zones in production - Application database
- Aurora PostgreSQL Serverless v2 (engine
16.4), IAM authentication, managed master credentials in AWS Secrets Manager, deletion protection enabled - Object storage
- Amazon S3,
AES-256server-side encryption, versioning enabled, all public access blocked - Cache / queue
- Amazon ElastiCache Redis
7.0, TLS in-transit, encryption at rest - Network
- Private VPC, all data stores in private subnets, NAT-gated egress, security groups scoped per service
- Encryption in transit
TLS 1.2+for all external endpoints; mTLS within the satellite-to-control-plane path- Encryption at rest
- AES-256 server-side encryption across all data stores (S3, Aurora, ElastiCache, EBS volumes)
- Backups & DR
- Aurora point-in-time recovery, S3 versioning. RTO target 4 hours, RPO target 24 hours.
- Data retention
- Customer source code, generated artifacts, and audit logs retained for 30 days after contract termination, then purged.
Identity, access & change management
- Employee SSO — All Harden employees access infrastructure via AWS IAM Identity Center (SSO) with mandatory MFA. No shared accounts. No long-lived IAM user credentials in any production deploy path.
- Production deploys — GitHub Actions OIDC federation, scoped to a protected GitHub environment with required reviewers. No human can deploy to production without an approved CI run.
- Direct prod changes blocked — A repo-level workflow blocks any pull request that modifies production infrastructure directly; production changes are required to go through staging and a separate promotion workflow.
- Code review — All changes require pull request review. CODEOWNERS routes infrastructure and CI changes to the platform team.
- Application access — Service workloads use AWS IRSA with least-privilege IAM roles scoped to specific S3 buckets, database users, and Secrets Manager entries.
- Endpoint security — Mandatory device management (MDM) on all employee laptops. Mandatory full-disk encryption (FileVault/BitLocker) enforced via MDM.
- Personnel — Background checks for all new hires.
Compliance roadmap
Now
SOC 2 Type II audit in progress with Keygraph. Pre-audit security controls implemented. keygraph.io
August 2026
SOC 2 Type II report targeted.
Late 2026 / 2027
ISO 27001 under evaluation, post-SOC 2.
Available on request under NDA
- Information security policy
- Architecture & data-flow diagrams (extended)
- Automated security testing report
- Third-party pen test summary (scheduled — Q3 2026)
- Sub-processor list
- Pre-audit SOC 2 readiness summary from Keygraph
Sub-processors
Harden uses the following third-party services to operate the product, the corporate website, and our internal business operations. We notify customers in advance of any material changes to this list.
| Sub-processor | Purpose | Data type |
|---|---|---|
| Amazon Web Services | Primary cloud infrastructure for the control plane (compute, storage, database, secrets, transactional email via SES) | Customer source code, generated artifacts, audit logs |
| Vercel | Hosting for the marketing website and customer dashboard frontend; Vercel Blob for static asset storage | Website content, dashboard frontend assets — no customer source code |
| GitHub | Source control and CI/CD pipelines for Harden's own engineering | Harden internal source; build artifacts |
| Snyk | Dependency and container vulnerability scanning for Harden's own code | Code dependency manifests (Harden, not customer) |
| Grafana Cloud | Application observability — logs, metrics, traces from the control plane | Operational telemetry; no customer source code or PII |
| Anthropic | LLM provider for AI-assisted analysis features | Customer-supplied prompts and code excerpts (opt-in features only) |
| Keygen.sh | License key generation and validation | License metadata — no customer data |
| Stripe | Billing and payment processing | Customer billing contact, payment method (handled by Stripe; Harden does not store card data) |
| Resend | Transactional email (product notifications, marketing) | Customer email addresses, names |
| Microsoft Clarity | Marketing website analytics (page-level usage) | Anonymized website visitor behavior on harden.run only — not used in the product |
| Intercom | Customer support and in-app messaging | Customer support conversation content, contact info |
| Keygraph | SOC 2 audit and compliance management | Audit evidence — no customer data |
Incident response
- Owner
- Pushpendre Rastogi, CTO
- Customer notification SLA
- 24 hours from confirmed incident
- Reporting
- Suspected vulnerabilities or incidents: security@harden.run
- Coordinated disclosure
- We follow responsible disclosure. Researchers acting in good faith will not be pursued legally; please give us reasonable time to remediate before public disclosure.
Privacy & data handling
- Data minimization
- Harden processes only the source code and metadata required to generate security artifacts. Customer end-user data is never ingested by the control plane.
- Data location
- All customer data is processed and stored in AWS
us-west-2. Cross-region transfer requires written customer authorization. - Data retention
- 30 days post-termination, then purged.
- Data subject requests
- Submit to privacy@harden.run.