Security you can inspect. Infrastructure you control.
Because Gitxen runs on your own servers, the strongest guarantee is structural: your source, history and secrets never leave your boundary. On top of that, protection ships on by default.
How your code is protected
Defence in depth, on by default.
Data sovereignty
Single-tenant and self-hosted. Repositories, sessions and files live in your own Postgres and filesystem — no third-party SaaS holds your code.
Encryption
Git and web traffic over TLS (HTTPS) and SSH; secrets and tokens stored hashed or encrypted at rest in your database.
Strong authentication
Mandatory TOTP two-factor for staff, passkeys / WebAuthn, SSO and SCIM for organizations.
Secret scanning
Pushed credentials are detected and surfaced as alerts so leaked keys can be rotated fast.
Code & dependency scanning
SARIF code-scanning ingestion and dependency alerts flag vulnerable code and packages.
Branch protection & rulesets
Required reviews and checks, protected branches, and configurable rulesets keep the default branch safe.
Audit logging
A tamper-evident audit trail records security-relevant actions across the platform.
Scoped access
Personal access tokens, deploy keys and OAuth apps with least-privilege scopes; access resolves through one enforced path.
Isolated execution
CI jobs and codespaces run in isolated containers, kept away from other tenants and the host.
Compliance posture
Architected for the standards you answer to.
Self-hosting puts data residency and retention in your hands, which is the foundation most frameworks — GDPR among them — are built on. Formal certifications such as SOC 2 are on our roadmap; we will publish attestations here as they are completed rather than claim them before they exist.
Responsible disclosure
Found something? Tell us.
We welcome reports from security researchers and aim to acknowledge every credible disclosure within one business day. Please report privately before any public disclosure.
Report a vulnerability