Security
What we do, and what we have not done yet.
DevFactory sits close to your source code and your build pipeline, so this page is worth reading properly rather than skimming for a badge.
Isolation between sessions
Each build session runs in its own git worktree with its own assigned ports. Sessions cannot read or write each other's working state, which is what makes running several agents at once safe rather than merely fast.
Tenant separation
Project data is separated at the database layer using row-level security, so isolation is enforced by the database rather than by application code remembering to filter. Access to a project requires an explicit grant.
Encryption
Traffic is served over TLS. Evidence artifacts and screenshots are encrypted at rest in object storage.
The evidence ledger is append-only
Gate results are written once. Nobody can quietly rewrite what a gate found after the fact, including us, which is the property that makes the record worth anything.
Secrets
Credentials are held in a secret store and referenced, never written into task records, evidence artifacts or logs. Where a value has to be shown, only a prefix is stored.
Reporting a vulnerability
Send it to security@devfactory.in with enough detail to reproduce. We will confirm receipt, tell you what we found, and credit you if you want the credit. Please give us a reasonable window to fix it before publishing.
What we do not have
No SOC 2 report, no ISO 27001, no penetration test certificate. DevFactory is in private beta and we are not going to imply otherwise, because a security page that overstates itself is the clearest possible signal about how the rest of the product is built. If your procurement process needs those documents today, we are not ready for you yet, and we would rather tell you now.
Last updated Aug 20, 2026.