Our source control, code review and build automation run on GitHub Enterprise Cloud. As of this writing, GitHub holds SOC 1 Type II, SOC 2 Type II and SOC 3 reports, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications, and a PCI DSS Attestation of Compliance. GitHub also commissions independent third-party penetration tests and runs a public bug bounty program covering its platform.
These are GitHub's own certifications, for GitHub's own infrastructure and operations — not Apivom's. We state that distinction plainly because it matters: a vendor's security questionnaire answer that blurs "the platform we build on is certified" with "we are certified" is the kind of answer we'd flag if we received it from one of our own vendors.
What we can say with confidence is this: the platform our source code lives on has been through independent, recurring audits covering access control, change management, availability, and confidentiality — the SOC 2 trust services criteria — plus the broader information-security management system scope of ISO/IEC 27001. That is a meaningfully different starting point than hosting source code on unaudited infrastructure.
On top of that platform, we add our own controls: enforced two-factor authentication for every engineer with source code access, and automated dependency vulnerability scanning on every repository — both described elsewhere on this page.
What this does not mean
We do not currently hold our own SOC 2 or ISO/IEC 27001 certification for Apivom as a company. GitHub's certifications cover GitHub; they do not extend to how we configure our repositories, who we grant access to, or how we build and deploy our own application. Those are exactly the practices we describe on the rest of this page, so you can evaluate them directly rather than taking a platform certification as a proxy for them.