Security architecture
Understand where work runs, what data is shared, and how your team controls access and production releases.
Read the runner architecture and AI provider documentation for setup details.
For feedback or to report security vulnerabilities, please email security@deployment.io.
Execution in your cloud
The runner checks out repositories, builds software, and executes agent tasks in your cloud account. Deployment.io coordinates that work through its control plane. Access is scoped through the permissions configured for your runner and team.
Control-plane data
Job state, logs, and metadata flow back to Deployment.io to coordinate work and display progress. Traffic between the runner and control plane uses TLS.
AI providers and credentials
Agents send model requests to the configured provider using your vendor account. Running the agent in your cloud does not mean every model request stays there. Provider data handling depends on the selected service and account configuration.
Provider API keys are encrypted at rest, displayed in masked form, and supplied to the agent container at execution time. AWS Bedrock routes model calls through your AWS account.
Production approvals
For Managed delivery, your designated reviewer approves production through the release process agreed during scoping. Platform approval policies are configurable per agent key; configure them to match your review requirements.
Access and handover
The runner operates with permissions in your cloud account. Review runner roles, team access, and provider credentials as part of setup and handover. Contact security@deployment.io to discuss security requirements before an engagement.